1 1 00:00:00,280 --> 00:00:01,740 Network logging. 2 2 00:00:01,740 --> 00:00:04,000 In this lesson, we're going to discuss how we conduct 3 3 00:00:04,000 --> 00:00:06,310 network logging inside of our networks. 4 4 00:00:06,310 --> 00:00:08,890 Now all of our network devices are going to generate logs 5 5 00:00:08,890 --> 00:00:12,020 based on the information, events, warnings, alerts, 6 6 00:00:12,020 --> 00:00:14,280 and other critical data that they generate. 7 7 00:00:14,280 --> 00:00:15,860 If you have a very small network, 8 8 00:00:15,860 --> 00:00:18,180 it's pretty easy for you to log into a network device 9 9 00:00:18,180 --> 00:00:20,840 and review the logs individually or manually. 10 10 00:00:20,840 --> 00:00:23,270 But, if you're like me and you start working on large 11 11 00:00:23,270 --> 00:00:25,960 enterprise networks, this is impossible. 12 12 00:00:25,960 --> 00:00:26,810 For example, 13 13 00:00:26,810 --> 00:00:28,650 one of the networks I previously worked on 14 14 00:00:28,650 --> 00:00:31,760 had thousands of network switches and hundreds of routers. 15 15 00:00:31,760 --> 00:00:34,480 There is no way I could possibly log into each and every one 16 16 00:00:34,480 --> 00:00:36,740 of them and review those log files individually, 17 17 00:00:36,740 --> 00:00:38,070 each and every day. 18 18 00:00:38,070 --> 00:00:41,230 So instead we use something known as Syslog. 19 19 00:00:41,230 --> 00:00:44,130 Syslog is a protocol that's used to send these logs 20 20 00:00:44,130 --> 00:00:45,670 to a centralized server. 21 21 00:00:45,670 --> 00:00:48,440 This becomes the easiest way for us to gather all the logs 22 22 00:00:48,440 --> 00:00:50,100 across all our routers and switches 23 23 00:00:50,100 --> 00:00:51,880 and bring them back to a central point 24 24 00:00:51,880 --> 00:00:53,990 where we can analyze and review them. 25 25 00:00:53,990 --> 00:00:56,370 All of our routers, our switches, our servers, 26 26 00:00:56,370 --> 00:00:58,620 and all of our other devices can be configured 27 27 00:00:58,620 --> 00:01:01,250 to send their own logs back to the centralized server, 28 28 00:01:01,250 --> 00:01:03,420 to make our jobs easier and more efficient; 29 29 00:01:03,420 --> 00:01:05,070 if we use syslog. 30 30 00:01:05,070 --> 00:01:07,930 These centralized servers are known as syslog servers. 31 31 00:01:07,930 --> 00:01:09,600 Or you can have a SIM, 32 32 00:01:09,600 --> 00:01:11,860 which is a Security Information Management System. 33 33 00:01:11,860 --> 00:01:14,960 Or a SEM, a Security Event Management System. 34 34 00:01:14,960 --> 00:01:18,040 Or the new combination of the two known, as a SIEM, 35 35 00:01:18,040 --> 00:01:20,860 a Security Information and Event Management System. 36 36 00:01:20,860 --> 00:01:23,470 These days, most people have moved to a SIEM 37 37 00:01:23,470 --> 00:01:24,760 because it combines the functionality 38 38 00:01:24,760 --> 00:01:26,310 of all these other types of logging 39 39 00:01:26,310 --> 00:01:28,780 and analysis systems into one device. 40 40 00:01:28,780 --> 00:01:31,180 By sending all of your logs to the centralized server, 41 41 00:01:31,180 --> 00:01:33,203 it allows you, as an administrator or analyst, 42 42 00:01:33,203 --> 00:01:35,271 to normalize and correlate the events 43 43 00:01:35,271 --> 00:01:37,820 in order to see trends over time. 44 44 00:01:37,820 --> 00:01:39,660 For example, if I see someone's conducting 45 45 00:01:39,660 --> 00:01:40,846 a ping sweep of my firewall, 46 46 00:01:40,846 --> 00:01:42,870 that's really not that big of a deal. 47 47 00:01:42,870 --> 00:01:45,550 But, if I see that as coming within a few minutes of that 48 48 00:01:45,550 --> 00:01:47,700 sweep, and I see from the same IP address, 49 49 00:01:47,700 --> 00:01:50,150 somebody trying to connect to my servers or my clients, 50 50 00:01:50,150 --> 00:01:53,240 that may be a concern that can be flagged for investigation. 51 51 00:01:53,240 --> 00:01:55,590 Because maybe, they were preparing the environment 52 52 00:01:55,590 --> 00:01:56,820 by seeing what ports were open. 53 53 00:01:56,820 --> 00:01:58,780 And now they're launching an attack. 54 54 00:01:58,780 --> 00:02:00,570 When you configure your syslog server, 55 55 00:02:00,570 --> 00:02:02,740 your SIM, your SEM, or your SIEM, 56 56 00:02:02,740 --> 00:02:04,770 there are two primary components you have to have. 57 57 00:02:04,770 --> 00:02:07,270 You have to have a client and you have to have a server. 58 58 00:02:07,270 --> 00:02:08,700 Now, a client is just the device 59 59 00:02:08,700 --> 00:02:10,130 that's going to send the log information 60 60 00:02:10,130 --> 00:02:11,740 to the syslog server. 61 61 00:02:11,740 --> 00:02:14,240 This can be a router, a switch, a firewall, 62 62 00:02:14,240 --> 00:02:16,540 a web server, or any other type of device. 63 63 00:02:16,540 --> 00:02:18,950 Then you have a server and this is going to receive 64 64 00:02:18,950 --> 00:02:22,060 and store all those logs from all the different clients. 65 65 00:02:22,060 --> 00:02:24,360 Each client can be configured to send logs to the server 66 66 00:02:24,360 --> 00:02:26,250 based on different severity levels 67 67 00:02:26,250 --> 00:02:28,030 of the information they contain. 68 68 00:02:28,030 --> 00:02:30,030 Now, when it does this, it's going to send the data 69 69 00:02:30,030 --> 00:02:33,170 over port 514, using UDP, 70 70 00:02:33,170 --> 00:02:34,940 the User Datagram Protocol. 71 71 00:02:34,940 --> 00:02:37,582 Now syslog has eight different severity levels. 72 72 00:02:37,582 --> 00:02:39,670 The severity levels start at zero 73 73 00:02:39,670 --> 00:02:41,590 and they count upward to seven. 74 74 00:02:41,590 --> 00:02:43,810 So zero is going to be the most severe 75 75 00:02:43,810 --> 00:02:45,710 and seven is going to be the least severe 76 76 00:02:45,710 --> 00:02:47,330 or the most benign. 77 77 00:02:47,330 --> 00:02:49,800 Now level zero is going to be used for emergencies, 78 78 00:02:49,800 --> 00:02:51,720 and it's going to be considered the most severe condition 79 79 00:02:51,720 --> 00:02:54,660 because the system has now become unstable. 80 80 00:02:54,660 --> 00:02:57,200 With level one, we're going to have an alert condition. 81 81 00:02:57,200 --> 00:02:58,500 And this means there's a condition 82 82 00:02:58,500 --> 00:03:00,259 that should be corrected immediately. 83 83 00:03:00,259 --> 00:03:02,920 Level two is used for a critical condition. 84 84 00:03:02,920 --> 00:03:04,160 And it means there's a failure 85 85 00:03:04,160 --> 00:03:05,750 in the system's primary application. 86 86 00:03:05,750 --> 00:03:07,707 And it requires somebody immediate attention. 87 87 00:03:07,707 --> 00:03:10,430 With level three, we have an error condition. 88 88 00:03:10,430 --> 00:03:12,580 And it means that something is happening to the system 89 89 00:03:12,580 --> 00:03:14,740 that's preventing it from functioning properly. 90 90 00:03:14,740 --> 00:03:15,573 Now, for example, 91 91 00:03:15,573 --> 00:03:18,450 your file system storage may have reached it's limits 92 92 00:03:18,450 --> 00:03:20,570 and now the system can't write the data. 93 93 00:03:20,570 --> 00:03:22,200 And so it's generating a write error 94 94 00:03:22,200 --> 00:03:23,947 when it tries to save that log information. 95 95 00:03:23,947 --> 00:03:26,190 And that could generate an error condition. 96 96 00:03:26,190 --> 00:03:28,720 Now level four is going to be used for warning conditions, 97 97 00:03:28,720 --> 00:03:30,820 and it can indicate that an error is going to occur 98 98 00:03:30,820 --> 00:03:32,690 if action isn't taken soon. 99 99 00:03:32,690 --> 00:03:34,640 For example, let's say your file system 100 100 00:03:34,640 --> 00:03:36,950 only has two gigabytes of space remaining. 101 101 00:03:36,950 --> 00:03:38,690 So you need to free up more space 102 102 00:03:38,690 --> 00:03:40,610 before you start to get write errors. 103 103 00:03:40,610 --> 00:03:42,120 This can send an alert. 104 104 00:03:42,120 --> 00:03:43,970 This would be known as a warning condition 105 105 00:03:43,970 --> 00:03:46,140 because you're running out of this space. 106 106 00:03:46,140 --> 00:03:48,560 Now level five is used for notice conditions. 107 107 00:03:48,560 --> 00:03:50,770 And that means these are events that are unusual, 108 108 00:03:50,770 --> 00:03:53,640 but they're not exactly error conditions. 109 109 00:03:53,640 --> 00:03:56,220 Level six is for information conditions. 110 110 00:03:56,220 --> 00:03:58,280 And this is going to be a normal operational message 111 111 00:03:58,280 --> 00:03:59,700 that requires no action. 112 112 00:03:59,700 --> 00:04:01,750 For example, you might see in your logs 113 113 00:04:01,750 --> 00:04:03,690 that an application has started or paused 114 114 00:04:03,690 --> 00:04:05,160 or ended successfully. 115 115 00:04:05,160 --> 00:04:06,894 These are all informational logs. 116 116 00:04:06,894 --> 00:04:09,244 Level seven is going to be used for debugging conditions. 117 117 00:04:09,244 --> 00:04:11,884 And it's just information that's useful to developers 118 118 00:04:11,884 --> 00:04:14,722 as they're debugging their networks and their applications. 119 119 00:04:14,722 --> 00:04:17,190 Now, as a network or system administrator, 120 120 00:04:17,190 --> 00:04:18,920 it's your responsibility to determine 121 121 00:04:18,920 --> 00:04:20,440 what levels should be logged 122 122 00:04:20,440 --> 00:04:22,790 and how long do you want to keep those logs inside 123 123 00:04:22,790 --> 00:04:25,220 your syslog server or your SIEM? 124 124 00:04:25,220 --> 00:04:27,740 Now, while we would love to keep everything forever. 125 125 00:04:27,740 --> 00:04:30,050 For most of us, that's just not practical 126 126 00:04:30,050 --> 00:04:32,530 because we'll eventually run out of hard disk space. 127 127 00:04:32,530 --> 00:04:34,863 So, some administrators will limit what they log. 128 128 00:04:34,863 --> 00:04:36,720 And they decide to only log things 129 129 00:04:36,720 --> 00:04:38,490 from level zero to level five. 130 130 00:04:38,490 --> 00:04:41,440 And they'll ignore the informational or debugging logs. 131 131 00:04:41,440 --> 00:04:43,940 This all depends on your organization and the policies 132 132 00:04:43,940 --> 00:04:46,210 you're going to set forth inside your business. 133 133 00:04:46,210 --> 00:04:47,043 All right, 134 134 00:04:47,043 --> 00:04:49,260 we've talked a lot about logs so far in syslog. 135 135 00:04:49,260 --> 00:04:50,640 But we haven't really looked at one yet. 136 136 00:04:50,640 --> 00:04:53,390 So let's pull up a log and take a look inside. 137 137 00:04:53,390 --> 00:04:55,560 Here's an example from a syslog server. 138 138 00:04:55,560 --> 00:04:58,490 Here, we have the date, the time, the location, 139 139 00:04:58,490 --> 00:05:00,070 and then we have the log level. 140 140 00:05:00,070 --> 00:05:02,450 And you could see things like alerts, emergency, 141 141 00:05:02,450 --> 00:05:04,930 error, warning, notice, informational, 142 142 00:05:04,930 --> 00:05:05,964 and things like that. 143 143 00:05:05,964 --> 00:05:08,169 Then, you have the machine or the host name 144 144 00:05:08,169 --> 00:05:10,230 and the IP in the next column. 145 145 00:05:10,230 --> 00:05:12,180 So, you know, what machine did the reporting 146 146 00:05:12,180 --> 00:05:14,120 of this error or information or warning. 147 147 00:05:14,120 --> 00:05:17,830 Then you have the actual text of the log message itself. 148 148 00:05:17,830 --> 00:05:20,120 This will say things like, "this is a test message", 149 149 00:05:20,120 --> 00:05:22,940 or "this is an error. And here's the error I had". 150 150 00:05:22,940 --> 00:05:24,730 By having this information and understanding 151 151 00:05:24,730 --> 00:05:26,677 what it is, as an analyst or administrator, 152 152 00:05:26,677 --> 00:05:29,120 you can start going back and figuring out what caused 153 153 00:05:29,120 --> 00:05:31,320 the incident and what really occurred. 154 154 00:05:31,320 --> 00:05:34,380 Now for the exam, what do you need to know about syslog? 155 155 00:05:34,380 --> 00:05:36,970 Well, you need to understand the eight different levels. 156 156 00:05:36,970 --> 00:05:38,207 You may get a question that says, 157 157 00:05:38,207 --> 00:05:40,420 "what is level number three in syslog?" 158 158 00:05:40,420 --> 00:05:42,830 And you need to say, "that's an error message". 159 159 00:05:42,830 --> 00:05:44,040 Alright, let's go ahead 160 160 00:05:44,040 --> 00:05:45,880 and talk a little bit more about logs. 161 161 00:05:45,880 --> 00:05:49,190 Remember, a syslog server is all just a big collection of 162 162 00:05:49,190 --> 00:05:51,290 all the different logs from all the different servers 163 163 00:05:51,290 --> 00:05:53,480 and clients and network devices we have. 164 164 00:05:53,480 --> 00:05:55,390 Now, when it comes to network device logs, 165 165 00:05:55,390 --> 00:05:57,820 we can review these inside the syslog server, 166 166 00:05:57,820 --> 00:05:59,510 as well as by looking at our traffic logs 167 167 00:05:59,510 --> 00:06:00,870 and our audit logs. 168 168 00:06:00,870 --> 00:06:02,790 Now, when it comes to network traffic logs, 169 169 00:06:02,790 --> 00:06:04,868 these are going to contain information about traffic flows 170 170 00:06:04,868 --> 00:06:06,267 within your network. 171 171 00:06:06,267 --> 00:06:08,980 For example, if you collect network traffic logs 172 172 00:06:08,980 --> 00:06:09,856 from your router or your firewall, 173 173 00:06:09,856 --> 00:06:12,100 you're going to see a list of every connection 174 174 00:06:12,100 --> 00:06:13,798 that's been made to and from your network. 175 175 00:06:13,798 --> 00:06:14,718 For example, 176 176 00:06:14,718 --> 00:06:17,500 you could see the source IP, the source port, 177 177 00:06:17,500 --> 00:06:19,740 the destination IP, the destination port, 178 178 00:06:19,740 --> 00:06:21,350 as well as the Mac address of the client, 179 179 00:06:21,350 --> 00:06:23,780 the time it took to occur, the length of the packet, 180 180 00:06:23,780 --> 00:06:25,480 and even it's time to live. 181 181 00:06:25,480 --> 00:06:27,253 Then you can analyze these traffic flows 182 182 00:06:27,253 --> 00:06:30,080 to determine if this is normal traffic for you 183 183 00:06:30,080 --> 00:06:32,115 and something you'd expect to see in your baseline. 184 184 00:06:32,115 --> 00:06:34,400 Or, is this something that's abnormal 185 185 00:06:34,400 --> 00:06:36,190 and needs to be investigated further? 186 186 00:06:36,190 --> 00:06:38,470 For example, if you know that in a given day, 187 187 00:06:38,470 --> 00:06:40,210 you're used to seeing about a gigabyte of data 188 188 00:06:40,210 --> 00:06:42,420 leaving your network over port 443, 189 189 00:06:42,420 --> 00:06:44,750 but today you saw 10 gigabytes of data 190 190 00:06:44,750 --> 00:06:45,920 was leaving your network. 191 191 00:06:45,920 --> 00:06:48,100 That is something you need to worry about. 192 192 00:06:48,100 --> 00:06:50,290 So you might take a look at that and see, 193 193 00:06:50,290 --> 00:06:51,220 have you been hacked? 194 194 00:06:51,220 --> 00:06:52,810 Is somebody stealing all your data? 195 195 00:06:52,810 --> 00:06:54,080 Now does it mean that's happening? 196 196 00:06:54,080 --> 00:06:55,660 Well, not necessarily. 197 197 00:06:55,660 --> 00:06:58,640 But we do know it's abnormal, because we expect to see 198 198 00:06:58,640 --> 00:07:01,660 somewhere around one. And right now we're seeing around 10. 199 199 00:07:01,660 --> 00:07:03,335 So we need an investigate that closer 200 200 00:07:03,335 --> 00:07:05,570 and dive into those network traffic logs 201 201 00:07:05,570 --> 00:07:07,010 to see what's happening. 202 202 00:07:07,010 --> 00:07:08,970 Let's say for example, that happened in my company. 203 203 00:07:08,970 --> 00:07:10,580 I would want to investigate that. 204 204 00:07:10,580 --> 00:07:11,860 Now, most likely what I'll 205 205 00:07:11,860 --> 00:07:14,780 find is that my video editor was uploading all of our videos 206 206 00:07:14,780 --> 00:07:17,400 to cloud-based servers because 10 gigabytes of data 207 207 00:07:17,400 --> 00:07:19,750 is only about an hour or two, a video for our courses. 208 208 00:07:19,750 --> 00:07:22,270 Now she might edit all week and then on Friday, 209 209 00:07:22,270 --> 00:07:23,560 upload all that data. 210 210 00:07:23,560 --> 00:07:25,734 And that's why we're seeing that big spike on Friday. 211 211 00:07:25,734 --> 00:07:28,367 Similarly, if you see traffic that you're not expecting, 212 212 00:07:28,367 --> 00:07:30,940 like somebody saying data over some port that you're not 213 213 00:07:30,940 --> 00:07:32,980 using, like port 21 for FTP, 214 214 00:07:32,980 --> 00:07:34,630 but you don't have an FTP server. 215 215 00:07:34,630 --> 00:07:36,410 This could be something that's abnormal 216 216 00:07:36,410 --> 00:07:37,940 and suspicious as well. 217 217 00:07:37,940 --> 00:07:40,240 The key to understanding your network traffic logs 218 218 00:07:40,240 --> 00:07:42,320 is understanding what normal looks like. 219 219 00:07:42,320 --> 00:07:45,040 And so you have to understand what normal is 220 220 00:07:45,040 --> 00:07:46,060 in your baseline. 221 221 00:07:46,060 --> 00:07:47,910 So you can then determine what is abnormal 222 222 00:07:47,910 --> 00:07:49,410 and what needs to be looked at 223 223 00:07:49,410 --> 00:07:51,680 much more closely as you do investigations. 224 224 00:07:51,680 --> 00:07:53,961 Also, when you're looking at your traffic logs, 225 225 00:07:53,961 --> 00:07:56,600 this can help you during your troubleshooting efforts. 226 226 00:07:56,600 --> 00:07:57,440 For example, 227 227 00:07:57,440 --> 00:07:58,860 you might see that you're trying to send data 228 228 00:07:58,860 --> 00:08:00,400 to a particular IP address. 229 229 00:08:00,400 --> 00:08:02,611 But it's stopping at a particular router or firewall 230 230 00:08:02,611 --> 00:08:04,230 within your network. 231 231 00:08:04,230 --> 00:08:05,900 By investigating this and the traffic logs, 232 232 00:08:05,900 --> 00:08:08,212 you can determine why this blockage is occurring. 233 233 00:08:08,212 --> 00:08:10,770 Now the second type of network device log 234 234 00:08:10,770 --> 00:08:12,900 we need to talk about is an audit log. 235 235 00:08:12,900 --> 00:08:15,180 Now, an audit log or audit trail is a record 236 236 00:08:15,180 --> 00:08:16,650 of all the events and changes 237 237 00:08:16,650 --> 00:08:18,430 that have happened on that device. 238 238 00:08:18,430 --> 00:08:20,942 Every IT device keeps a log based on the events 239 239 00:08:20,942 --> 00:08:23,410 and an audit log is typically going to contain 240 240 00:08:23,410 --> 00:08:25,733 a sequence of events for a particular activity. 241 241 00:08:25,733 --> 00:08:28,140 In a network device, this would be something 242 242 00:08:28,140 --> 00:08:30,527 like a configuration change that you made to that system. 243 243 00:08:30,527 --> 00:08:32,590 So let's say, for example, 244 244 00:08:32,590 --> 00:08:34,920 you came into work and you found that somebody changed 245 245 00:08:34,920 --> 00:08:37,230 the configuration on your border gateway router. 246 246 00:08:37,230 --> 00:08:40,000 Now, you could log in and see who made that change 247 247 00:08:40,000 --> 00:08:41,820 and exactly what changes were made 248 248 00:08:41,820 --> 00:08:44,360 by reviewing that audit log for the device. 249 249 00:08:44,360 --> 00:08:46,330 For your convenience, these audit logs 250 250 00:08:46,330 --> 00:08:49,350 can be sent over syslog to that centralized server 251 251 00:08:49,350 --> 00:08:50,889 for review and analysis as well. 252 252 00:08:50,889 --> 00:08:53,400 Now, when it comes to servers and clients, 253 253 00:08:53,400 --> 00:08:55,130 we're usually going to be using windows machines 254 254 00:08:55,130 --> 00:08:56,550 in enterprise networks. 255 255 00:08:56,550 --> 00:08:58,810 For windows, there are three main types of logs 256 256 00:08:58,810 --> 00:08:59,940 you can also collect. 257 257 00:08:59,940 --> 00:09:03,460 These are application logs, security logs, and system logs. 258 258 00:09:03,460 --> 00:09:05,700 To view these logs, you can open your event viewer 259 259 00:09:05,700 --> 00:09:07,810 on a windows system and access the different 260 260 00:09:07,810 --> 00:09:08,950 types of logs. 261 261 00:09:08,950 --> 00:09:11,060 The first one is an application log. 262 262 00:09:11,060 --> 00:09:12,990 In windows this contains information 263 263 00:09:12,990 --> 00:09:15,620 about the software running on your client or server. 264 264 00:09:15,620 --> 00:09:17,040 Now, there are three severity levels 265 265 00:09:17,040 --> 00:09:18,520 in a windows application log. 266 266 00:09:18,520 --> 00:09:21,210 We have informational, warning, or error. 267 267 00:09:21,210 --> 00:09:23,260 For example, if you have Microsoft word 268 268 00:09:23,260 --> 00:09:24,854 and it crashes on you, you can go check 269 269 00:09:24,854 --> 00:09:28,500 the application log and figure out why it keeps crashing. 270 270 00:09:28,500 --> 00:09:31,000 Our second one we have is a security log. 271 271 00:09:31,000 --> 00:09:32,770 The security log contains information about 272 272 00:09:32,770 --> 00:09:34,790 the security of your client or server. 273 273 00:09:34,790 --> 00:09:36,520 This is going to have things like successful 274 274 00:09:36,520 --> 00:09:37,730 and failed login attempts, 275 275 00:09:37,730 --> 00:09:39,860 and other pertinent security information. 276 276 00:09:39,860 --> 00:09:42,760 This will also show you if an audit success or audit failure 277 277 00:09:42,760 --> 00:09:44,660 occurred for those logs. 278 278 00:09:44,660 --> 00:09:47,180 Now, the third one we have is a system log. 279 279 00:09:47,180 --> 00:09:49,060 The system log contains all the information 280 280 00:09:49,060 --> 00:09:50,870 about the operating system itself. 281 281 00:09:50,870 --> 00:09:52,610 There are three severity codes here; 282 282 00:09:52,610 --> 00:09:54,030 just like the application log. 283 283 00:09:54,030 --> 00:09:56,717 We're still going to have informational, warning, and error. 284 284 00:09:56,717 --> 00:09:58,900 In this example, there are four errors 285 285 00:09:58,900 --> 00:10:00,870 and the rest were informational items. 286 286 00:10:00,870 --> 00:10:03,220 The errors are notated by that red exclamation mark. 287 287 00:10:03,220 --> 00:10:05,175 Whereas, if you see the warning, 288 288 00:10:05,175 --> 00:10:06,008 it's going to be a yellow triangle. 289 289 00:10:06,008 --> 00:10:07,380 And information is a white circle 290 290 00:10:07,380 --> 00:10:08,773 with a blue I inside of it.