0% found this document useful (0 votes)
38 views

CSA Lab Setup Guide

Certified Security Analyst labs
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
38 views

CSA Lab Setup Guide

Certified Security Analyst labs
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 246

EC-Council

TM

C SA
Certified SOC Analyst

Classroom
Lab Setup
Guide

www.eccouncil.org
Table of Contents
Classroom Setup Instructions: CSA...................................................................................................................................................... 4
Classroom Requirements ........................................................................................................................................................................ 4
Hardware.................................................................................................................................................................................................... 5
Software ..................................................................................................................................................................................................... 5
Setup Document Overview .................................................................................................................................................................... 6
Training Room Environment ................................................................................................................................................................ 6
Instructor’s Computer ............................................................................................................................................................................. 7
Student Workstations .............................................................................................................................................................................. 9
Room Environment............................................................................................................................................................................... 12
Classroom Configuration ...................................................................................................................................................................... 12
Computer Names ................................................................................................................................................................................... 14
Instructor Acceptance ........................................................................................................................................................................... 14
Firewall Settings ...................................................................................................................................................................................... 15
Blackboard ............................................................................................................................................................................................... 15
Setup Checklist ....................................................................................................................................................................................... 16
Instructor Acceptance ........................................................................................................................................................................... 17
Assistance................................................................................................................................................................................................. 17
Detailed Configuration Tasks (CT)..................................................................................................................................................... 18
CT#1: Set Up Hardware ....................................................................................................................................................................... 18
CT#2: Turn Off the Windows Defender Firewall in Host Machine............................................................................................ 18
CT#3: Download SOC Tools.............................................................................................................................................................. 32
CT#4: Install Hyper-V role in Windows 10 Host Machine ........................................................................................................... 32
CT#5: Configuring Network for Hyper-V........................................................................................................................................ 36
CT#5.1: Configuring Internal Network for Hyper-V ................................................................................................................ 36
CT#5.2: Configuring External Network for Hyper-V ............................................................................................................... 40
CT#6: Creating and Configuring Windows Server 2016 Virtual Machine .................................................................................. 42
CT#6.1: Creating a Virtual Machine and Installing Windows Server 2016 Standard Guest OS ........................................ 42
CT#6.2: Changing the Computer Name ...................................................................................................................................... 56
CT#6.3: Configuring Static IP Address ........................................................................................................................................ 59
CT#6.4: Sharing SOC-Tools Folder from Host Machine and Mapping to Windows Server 2016 VM ........................... 62
CT#6.5: Installing WinRAR in Windows Server 2016 VM....................................................................................................... 68
CT#6.6: Installing Web Browsers in Windows Server 2016 VM ............................................................................................. 68
CT#6.7: Installing Notepad++ in Windows Server 2016 VM ................................................................................................. 68
CT#6.8: Installing Java Development Kit 8u (JDK 8u) in Windows Server 2016 VM ....................................................... 68
CT#6.9: Installing Splunk Enterprise in Windows Server 2016 VM....................................................................................... 73
CT#6.10: Installing .Net Framework 3.5 (Includes .Net 2.0 and 3.0) ..................................................................................... 77
CT#6.11: Turn off Windows Firewall in Windows Server 2016 VM ..................................................................................... 82
CT#7: Creating and Configuring Windows Server 2012 Virtual Machine .................................................................................. 83
CT#7.1: Creating a Virtual Machine and Installing Windows Server 2012 R2 Standard Guest OS.................................. 83
CT#7.2: Changing the Computer Name ...................................................................................................................................... 97
CT#7.3: Configuring Static IP Address ...................................................................................................................................... 100
CT#7.4: Adding IIS (Internet Information Services) roles in Server Manager ................................................................... 105
CT#7.5: Sharing SOC-Tools Folder from Host Machine and Mapping to Windows Server 2012 VM......................... 113
CT#7.6: Install MS SQL Server 2016 Express Edition on Windows Server 2016 Virtual Machine ............................... 116
CT#7.7: Install Microsoft SQL Server Management Studio on Windows Server 2012 Virtual Machine ...................... 124

Lab Setup Guide Page 2 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7.8: Installing Notepad++ in Windows Server 2012 VM ...............................................................................................126
CT#7.9: Installing Web Browsers in Windows Server 2012 VM ........................................................................................... 126
CT#7.10: Configure the LuxuryTreats Website in Windows Server 2012 (Virtual Machine) .......................................... 126
CT#7.11: Configuring Host File in Windows Server 2012 ..................................................................................................... 135
CT#7.12: Setting up FTP Site in Windows 2012 ...................................................................................................................... 135
CT#7.13: Installing WinPcap on Windows Server 2012 ......................................................................................................... 142
CT#7.14: Turn off Windows Firewall in WinServer2012 ....................................................................................................... 144
CT#7.15: Change User Account Settings to disable notification on System Changes ....................................................... 149
CT#8: Creating and Configuring Windows 10 Virtual Machine ................................................................................................. 151
CT#8.1: Creating a Virtual Machine and Installing Windows 10 Guest OS ........................................................................ 151
CT#8.2: Creating New User Account in Windows 10 Virtual Machine ............................................................................... 167
CT#8.3: Change the Computer Name ........................................................................................................................................ 171
CT#8.4: Configuring Static IP Address ...................................................................................................................................... 174
CT#8.5: Sharing SOC-Tools Folder from Host Machine and Mapping to Windows 10 VM.......................................... 177
CT#8.6: Installing Web Browsers ................................................................................................................................................ 177
CT#8.7: Installing FTP Client ...................................................................................................................................................... 178
CT#8.8: Turn Off the Windows Defender Firewall................................................................................................................. 182
CT#9: Creating and Configuring Kali Linux Virtual Machine .................................................................................................... 187
CT#9.1: Creating a Virtual Machine and Installing Kali Linux OS ....................................................................................... 187
CT#9.2 Configuring Host File in Kali Linux............................................................................................................................. 203
CT#9.3 Updating Kali Linux ........................................................................................................................................................ 204
CT#9.4 Sharing SOC-Tools Folder from Host Machine ........................................................................................................ 205
CT#10: Installing and Configuring AlienVault OSSIM ................................................................................................................ 208
CT#11: Creating and Configuring Windows 10 Virtual Machine (SIEM2) .............................................................................. 231
CT#11.1: Creating a Virtual Machine and Installing Windows 10 Enterprise Guest OS.................................................. 231
CT#11.2: Change the Computer Name ...................................................................................................................................... 235
CT#11.3: Configuring Static IP Address .................................................................................................................................... 239
CT#11.4: Mapping SOC-Tools Folder from Host Machine to Windows 10 VM.............................................................. 239
CT#11.5: Installing Web Browsers .............................................................................................................................................. 239
CT#11.6: Turn Off the Windows Defender Firewall .............................................................................................................. 239
CT#12: Setting Checkpoints of Virtual Machines ......................................................................................................................... 244
CT#13: Setting Time Zone of Virtual Machines ........................................................................................................................... 245

Lab Setup Guide Page 3 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Classroom Setup Instructions: CSA
This document contains setup instructions for the Certified SOC Analyst (CSA) course. The course
requires a standard modular classroom seating configuration, one computer for each student, one
computer for the instructor, a dedicated switch, dedicated firewall, and Internet connection. This class
teaches SOC processes.
Before beginning the class, install and configure all computers using the information and instructions
that follow.
The information contained in this document is subject to change without notice. Unless otherwise
noted, the names of companies, products, people and data used in this document are fictional. Their
use is not intended in any way to represent any real company, person, product or event. Users of this
document are responsible for compliance with all applicable copyright laws. No part of this document
may be reproduced or transmitted by any means, electronic or mechanical, for any purpose, without
the express written consent of the International Council of Electronic-Commerce Consultants, herein
after referred to as the EC-Council. If, however, your only means of access is electronic, permission
is hereby granted to print one copy.
The EC-Council may have patents, patent applications, trademarks, copyrights or other intellectual
property rights covering the material in this document. Except as expressly provided in any written
license agreement from the EC-Council, providing this document does not give you any license to
those patents, trademarks, copyrights or other intellectual property.
Certified SOC Analyst and CSA are either registered trademarks or trademarks of the EC-Council in
the USA and/or other countries. Other product and company names mentioned herein may be the
trademarks of their respective owners.

Classroom Requirements
This section describes classroom equipment required for the Certified SOC Analyst (CSA) course.
Classroom Equipment

The following equipment is required for the general classroom setup:


 Climate control system adjustable within the classroom
 Lighting controls, adjustable within the classroom
 Whiteboard, 3 feet X 6 feet (1m X 2m) or larger
 Markers, whiteboard, assorted colors
 Eraser, whiteboard cleaner liquid
 Easel with flipchart or butcher paper pad, 24 inches X 36 inches
 Felt tip pens, blue and black required, other colors optional, chisel tip (not fine-point)
 Screen, projection, 6 feet diagonal measurement (non-reflective whiteboard surface may be
substituted)
 Instructor station:

Lab Setup Guide Page 4 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
o Desk, chair, and ergonomic keyboard
o Power outlet
o Network jack
o Projector, LCD, capable of 740 X 1280 pixels minimum w/ all connecting cables
 Student station (per student):
o Chair, ergonomic keyboard
o Workstation, minimum horizontal workspace 9 square feet (3 feet X 3 feet)
o Power outlet, one per student station
o Network jack, one per student station

Hardware
Hardware requirements for instructor, student and victim computers are identical:
 Intel Core i5 or equivalent CPU with minimum CPU speed of 3.2 GHz
 Minimum 16 GB RAM (16 GB is recommended)
 Hard disk, 500 GB or larger, 7200 RPM or faster
 DVD drive (DVD R/W drive preferred)
 One Network adapters (minimum of a 10/100 NIC, but a 10/100/1000 is preferred), full
duplex (disable any additional network adapters installed)
 Monitor (minimum requirement is 17-inch LCD
 Mouse or compatible pointing device, and sound card with amplified speakers
 Internet access
The following additional hardware is also required:
 An unmanaged switch, with sufficient ports to allow connection of all instructor and student
workstations plus at least 5 additional, unused ports for connection of additional equipment
or for use as “spares.”

Software
All computers in the class require the following software:
 Microsoft Windows 10 Enterprise or Professional (64-bit) fully patched
 Adobe Acrobat Reader DC or later version
 WinRAR v5.60 or later version
 Web browsers: Internet Explorer, Firefox, and Chrome
 Word, Excel, and PowerPoint Viewers or Microsoft Office 2016/Open Office

Lab Setup Guide Page 5 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
 Hyper-V (built-in role in Windows 10 Enterprise or Professional (64 bit))
o Microsoft Windows Server 2016 Standard (64-bit)
o Microsoft Windows Server 2012 R2 Standard (64-bit)
o Microsoft Windows 10 Enterprise (64-bit)
o AlienVault_OSSIM_64bits_5.3.0.iso (downloadable at
http://downloads.alienvault.com/c/download?version=current_ossim_iso)
o Kali Linux (64 bit)
o SOC-Tools downloadable from Aspen portal.

Setup Document Overview


This document provides background information for technical staff responsible for setting up a
training room facility for the Certified SOC Analyst course. This guide describes the requirements for
the network equipment and computer stations that are installed and configured by the facilities
personnel for the training courses.

Training Room Environment


The training room environment consists primarily of the following equipment:
 Instructor’s Computer
 Student Workstation
Equipment Number Operating Minimum System Requirements
(Class of 12 System
Students)
Instructor’s 1 Microsoft Intel Core i5 or equivalent PC with 200 GB
Computer Windows 10 free disk space (with two logical partitions C:
enterprise or and D:), minimum of 16 GB RAM, 1 NIC
Professional (64- (disable or unplug extras), 17-inch monitor,
bit) fully patched and compatible mouse
Student 12 Microsoft Intel Core i5 or equivalent PC with 200 GB
Workstations Windows 10 free disk space (with two logical partitions C:
Enterprise or and D:), minimum of 16 GB RAM, 1 NIC
Professional (64- (disable or unplug extras), 17-inch monitor,
bit) fully patched and compatible mouse

Lab Setup Guide Page 6 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Instructor’s Computer
The instructor’s computer must:

 Be installed with Windows 10 Enterprise or Professional (64 bit), later service packs and
full patches applied
 Have Microsoft Office/Open Office or PowerPoint, Word, and Excel Viewers installed
 Be running IP protocol
 Have all SOC Essential Tools downloaded from Aspen to the hard drive in D:\SOC-Tools
folder for easy access (See CT#3 in Configuration Task section)
 Be installed with Hyper-V in Windows 10 host machine (see CT#4 in Configuration Task
section)
 Configuring Internal Network for Hyper-V (See Configuration Task CT#5)
 Be configured with Hyper-V VMs and guest operating systems
o Create and Configure Windows Server 2016 Standard Virtual Machine (See Configuration
Task CT#6)
 Create a Virtual Machine and Install Windows Server 2016 Standard (See
Configuration Task CT#6.1)
 Change the Computer Name of Windows Server 2016 Virtual Machine (See
Configuration Task CT#6.2)
 Configure Static IP address for Windows Server 2016 Virtual Machine (See
Configuration Task CT#6.3)
 Share SOC-Tools Folder from Host Machine and Map to Windows Server 2016
Virtual Machine (See Configuration Task CT#6.4)
 Install WinRAR in Windows Server 2016 Virtual Machine (See Configuration Task
CT#6.5)
 Install Web Browsers in Windows Server 2016 Virtual Machine (See Configuration
Task CT#6.6)
 Install Notepad++ in Windows Server 2016 Virtual Machine (See Configuration Task
CT#6.7)
 Install Java Development Kit 8u (JDK 8u) in Windows Server 2016 Virtual Machine
(See Configuration Task CT#6.8)
 Install Splunk Enterprise in Windows Server 2016 Virtual Machine (See Configuration
Task CT#6.9)
 Install .Net Framework 3.5 (Includes .Net 2.0 and 3.0) in Windows Server 2016 Virtual
Machine (See Configuration Task CT#6.10)
o Create and Configure Windows Server 2012 Virtual Machine (See Configuration Task
CT#7)

Lab Setup Guide Page 7 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
 Create a Virtual Machine and Install Windows Server 2012 R2 Standard OS (See
Configuration Task CT#7.1)
 Change the Computer Name of Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.2)
 Configure Static IP address for Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.3)
 Add IIS roles in Server Manager of Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.4)
 Share SOC-Tools Folder from Host Machine and Map to Windows Server 2012
Virtual Machine (See Configuration Task CT#7.5)
 Install MS SQL Server 2016 Express Edition on Windows Server 2012 Virtual
Machine (See Configuration Task CT#7.6)
 Install Microsoft SQL Server Management Studio on Windows Server 2012 Virtual
Machine (See Configuration Task CT#7.7)
 Install Notepad++ in Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.8)
 Install Web Browser in Windows Server 2012 Virtual Machine (See Configuration
Task CT#7.9)
 Configure the LuxuryTreats Website in Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.10)
 Configure Host File in Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.11)
 Setup FTP Site on Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.12)
 Install WinPcap on Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.13)
o Create and Configure Windows 10 Virtual Machine (See Configuration Task CT#8)
 Create a Virtual Machine and Install Windows 10 Guest OS (See Configuration Task
CT#8.1)
 Create New User Account in Windows 10 Virtual Machine (See Configuration Task
CT#8.2)
 Change the Computer Name in Windows 10 Virtual Machine (See Configuration Task
CT#8.3)
 Configure Static IP Address for Windows 10 Virtual Machine (See Configuration Task
CT#8.4)
 Share SOC-Tools Folder from Host Machine and Map to Windows 10 Virtual
Machine (See Configuration Task CT#8.5)

Lab Setup Guide Page 8 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
 Install Web Browsers in Windows 10 Virtual Machine (See Configuration Task
CT#8.6)
 Install FTP Client in Windows 10 Virtual Machine (See Configuration Task CT#8.7)
 Turn off the Windows Defender Firewall in Windows 10 Virtual Machine (See
Configuration Task CT#8.8)
o Create and Configure kali Linux Virtual Machine (See Configuration Task CT#9)
 Create a Virtual Machine and Install Kali Linux OS (See Configuration Task CT#9.1)
 Configure Host File in Kali Linux (See Configuration Task CT#9.2)
 Updating Kali Linux (See Configuration Task CT#9.3)
o Install and Configure AlienVault OSSIM (See Configuration Task CT#10)
o Create and Configure Windows 10 Virtual Machine (SIEM2) (See Configuration Task
CT#11)
o Setting Checkpoints of Virtual Machines (See Configuration Task CT#12)
o Setting Time Zone of Virtual Machines (See Configuration Task CT#13)
o Has an LCD projector connected to an instructor’s machine?
o Use ghost images (recommended) to reduce the setup time in case of computer failure

Student Workstations
Student workstations must:
 Be installed with Windows 10 Enterprise or Professional (64 bit), later service packs and
full patches applied
 Have Microsoft Office/Open Office or PowerPoint, Word, and Excel Viewers installed
 Be running IP protocol
 Have all SOC Essential Tools downloaded from Aspen to the hard drive in D:\SOC-Tools
folder for easy access (See CT#3 in Configuration Task section)
 Be installed with Hyper-V in Windows 10 host machine (see CT#4 in Configuration Task
section)
 Configuring Internal Network for Hyper-V (See Configuration Task CT#5)
 Be configured with Hyper-V VMs and guest operating systems
o Create and Configure Windows Server 2016 Standard Virtual Machine (See Configuration
Task CT#6)
 Create a Virtual Machine and Install Windows Server 2016 Standard (See
Configuration Task CT#6.1)
 Change the Computer Name of Windows Server 2016 Virtual Machine (See

Lab Setup Guide Page 9 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Configuration Task CT#6.2)
 Configure Static IP address for Windows Server 2016 Virtual Machine (See
Configuration Task CT#6.3)
 Share SOC-Tools Folder from Host Machine and Map to Windows Server 2016
Virtual Machine (See Configuration Task CT#6.4)
 Install WinRAR in Windows Server 2016 Virtual Machine (See Configuration Task
CT#6.5)
 Install Web Browsers in Windows Server 2016 Virtual Machine (See Configuration
Task CT#6.6)
 Install Notepad++ in Windows Server 2016 Virtual Machine (See Configuration Task
CT#6.7)
 Install Java Development Kit 8u (JDK 8u) in Windows Server 2016 Virtual Machine
(See Configuration Task CT#6.8)
 Install Splunk Enterprise in Windows Server 2016 Virtual Machine (See Configuration
Task CT#6.9)
 Install .Net Framework 3.5 (Includes .Net 2.0 and 3.0) in Windows Server 2016 Virtual
Machine (See Configuration Task CT#6.10)
o Create and Configure Windows Server 2012 Virtual Machine (See Configuration Task
CT#7)
 Create a Virtual Machine and Install Windows Server 2012 R2 Standard OS (See
Configuration Task CT#7.1)
 Change the Computer Name of Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.2)
 Configure Static IP address for Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.3)
 Add IIS roles in Server Manager of Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.4)
 Share SOC-Tools Folder from Host Machine and Map to Windows Server 2012
Virtual Machine (See Configuration Task CT#7.5)
 Install MS SQL Server 2016 Express Edition on Windows Server 2012 Virtual
Machine (See Configuration Task CT#7.6)
 Install Microsoft SQL Server Management Studio on Windows Server 2012 Virtual
Machine (See Configuration Task CT#7.7)
 Install Notepad++ in Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.8)
 Install Web Browser in Windows Server 2012 Virtual Machine (See Configuration
Task CT#7.9)

Lab Setup Guide Page 10 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
 Configure the LuxuryTreats Website in Windows Server 2012 Virtual Machine (See
Configuration Task CT#7.10)
 Configure Host File in Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.11)
 Setup FTP Site on Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.12)
 Install WinPcap on Windows Server 2012 Virtual Machine (See Configuration Task
CT#7.13)
o Create and Configure Windows 10 Virtual Machine (See Configuration Task CT#8)
 Create a Virtual Machine and Install Windows 10 Guest OS (See Configuration Task
CT#8.1)
 Create New User Account in Windows 10 Virtual Machine (See Configuration Task
CT#8.2)
 Change the Computer Name in Windows 10 Virtual Machine (See Configuration Task
CT#8.3)
 Configure Static IP Address for Windows 10 Virtual Machine (See Configuration Task
CT#8.4)
 Share SOC-Tools Folder from Host Machine and Map to Windows 10 Virtual
Machine (See Configuration Task CT#8.5)
 Install Web Browsers in Windows 10 Virtual Machine (See Configuration Task
CT#8.6)
 Install FTP Client in Windows 10 Virtual Machine (See Configuration Task CT#8.7)
 Turn off the Windows Defender Firewall in Windows 10 Virtual Machine (See
Configuration Task CT#8.8)
o Create and Configure kali Linux Virtual Machine (See Configuration Task CT#9)
 Create a Virtual Machine and Install Kali Linux OS (See Configuration Task CT#9.1)
 Configure Host File in Kali Linux (See Configuration Task CT#9.2)
 Updating Kali Linux (See Configuration Task CT#9.3)
o Install and Configure AlienVault OSSIM (See Configuration Task CT#10)
o Create and Configure Windows 10 Virtual Machine (SIEM2) (See Configuration Task
CT#11)
o Setting Checkpoints of Virtual Machines (See Configuration Task CT#12)

Lab Setup Guide Page 11 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Room Environment
 The room must contain a whiteboard measuring a minimum of 1 yard by 2-3 yards in length
(1 meter by 2-3 meters)
 The room should contain an easel and large tablet (optional)
 The room must be equipped with legible black and blue felt tip pens

Classroom Configuration
The configuration of this classroom is modular. Computers can be added or removed by either row
or column, depending on the needs of the particular class. The following is a sample room setup that
provides optimal support. This setup allows for ease of access to "troublespots" by the instructor,
and allows students to break into functional small and larger teams.

Lab Setup Guide Page 12 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Set up the machines based on the classroom setup diagram. The lab exercises for the students are
instructor led and they are based on the network security tools in the trainer slides.

Lab Setup Guide Page 13 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Computer Names
Assign computer names to student machines like CSASTUDENT1, CSASTUDENT2,
CSASTUDENT3, and so on. Instructor machine should be named as INSTRUCTOR.

Instructor Acceptance
Before the training class is scheduled to begin, the instructor will visit the training facility to inspect
and accept the setup. The technical contact (System Administrator) for the facility must be available
to answer questions and correct any setup issues. Both the instructor and the facility technical contact
will ensure completion of the following checklists before the training setup is deemed acceptable.

Lab Setup Guide Page 14 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Firewall Settings
Do not block any ports while accessing the Internet through the firewall. You should be able to ping
servers on the Internet.
Block the firewall in all the configured machines.

Blackboard
 Write the following on the blackboard top left corner
o Instructor name: <Name of the instructor>
o The username/password to logon to the student machine
 At the center of the board write the following letters in bold

Welcome to CSA Class!

Lab Setup Guide Page 15 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Setup Checklist
The arrangement of items in the setup checklists is designed to allow the process to be completed in
the most efficient manner possible and validate that the setup has been done correctly. Before
beginning the setup checklist, log off any connected users.

Tick List
Here

 Open Network. Verify that all classroom computers are visible in Network
 Verify that the SOC tools are on the computer in SOC-Tools folder in the D:\ drive
 Verify that Internet access is available
 Visit https://www.eccouncil.org to check the Internet access
 Verify each computer has 200 GB or more free disk space
 Verify Microsoft PowerPoint, Word, and Excel viewer are installed (or Microsoft
office/Open Office is installed)
 Verify if you can successfully boot Windows Server 2012, Windows 10, Windows Server
2016, OSSIM, virtual machines
 Verify that all the VMs are configured as per the configuration tasks
 Verify that the Instructor computer can image through the overhead projector
 Placement of LCD (overhead) projector is appropriate
 Cable wiring organized and labeled
 Student workstations and chair placement is satisfactory
 Whiteboard and dry erase markers and erasers are available
 Instructor station is properly organized and oriented
 Computers are labeled with client number
 EC-Council courseware (Official EC-Council CSA Box) is available for students
 Write down the facility’s technical contact person’s mobile phone number. Contact him
in case of network problem

Lab Setup Guide Page 16 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Instructor Acceptance
The technical contact (System Administrator) for the facility must be available to answer questions
and correct any setup issues.
The Instructor will inspect both the classroom and the items covered in the setup checklist(s) to ensure
that the classroom and setup meet EC Council standards. Any deficiencies discovered by the
Instructor must be corrected before the scheduled start time for the class.

Assistance
If you have problems or require assistance in setting up the Lab for your CSA class, please e-mail
[email protected]

Lab Setup Guide Page 17 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Detailed Configuration Tasks (CT)
CT#1: Set Up Hardware
1. Set the computer’s BIOS to start first from the DVD-ROM drive and then from the hard
drive (Drive C:\).
2. Now keep Windows 10 DVD in the DVD-ROM.
3. Configure the hard disk to have one active primary partition (C:\ of 300 GB) and one
extended logical partition (D:\ of 200 GB).
4. Follow the steps to install Windows 10.
5. Once installed, check for updates and, if found any, update the Windows 10 host machine.
6. Install the wireless network adapters according to the manufacturer’s instructions.

CT#2: Turn Off the Windows Defender Firewall in Host


Machine
1. Now, check for the system updates and if found any, update the Windows 10 virtual machine
to the latest.
Note: Installing the updates might take some time.

2. Turn on the machine and log in with credentials.

Lab Setup Guide Page 18 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. In the Type here to search field present at the lower left corner of the screen, type Control
Panel. A search result containing Control Panel desktop app appears. Click Control Panel.

Lab Setup Guide Page 19 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. In the Control Panel window, click System and Security.

5. Click the Windows Defender Firewall in the System and Security window.

Lab Setup Guide Page 20 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. In the Windows Defender Firewall window, click Turn Windows Defender Firewall on
or off link in the left-pane of the window.

7. In the Customize Settings window, select Turn off Windows Defender Firewall (not
recommended) radio button for all Domain, Private and Public network settings and click
OK.

Lab Setup Guide Page 21 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Again, in the Windows Defender Firewall window, click Advanced settings link in the left-
pane.

9. Once the Windows Defender Firewall with Advanced Security appears on the screen, click
Windows Defender Firewall Properties link in the Overview section.

Lab Setup Guide Page 22 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
10. When the Windows Defender Firewall with Advanced Security on Local Computer
Properties window appears, in the Domain Profile tab, choose Off from the Firewall state
drop-down list. Then navigate to Private Profile and Public Profile tabs and ensure that the
Firewall state is Off. Click Apply and then click OK.

11. Close all the windows.

Lab Setup Guide Page 23 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
12. Right-click the Windows button at the lower left corner of the screen and click Run.

13. Run window appears, type gpedit.msc and click OK.

Lab Setup Guide Page 24 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
14. When the Local Group Policy Editor window appears, in the left-pane navigate to Local
Computer Policy  Computer Configuration  Administrative Templates 
Windows Components  Windows Defender Antivirus. Double-click the Turn off
Windows Defender Antivirus policy in the right-pane of the window as shown in the
screenshot.

Lab Setup Guide Page 25 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
15. When the Turn off Windows Defender Antivirus window appears, choose the Disabled
radio button and click Apply and OK to turn off Windows Defender Antivirus.

16. Windows Defender Antivirus is turned off.

Lab Setup Guide Page 26 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
17. Close all the windows.
18. Right-click Windows button at the lower left corner of the screen and click Settings.

Lab Setup Guide Page 27 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
19. In the Settings window, click Update & Security.

20. In the Settings window, Update & Security settings will be available in the left-pane. Click
Windows Security. This page appears in the right-pane. Click Open Windows Defender
Security Center button as shown in the screenshot.

Lab Setup Guide Page 28 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
21. In the Windows Defender Security Center window, click Virus & threat protection.

22. In the Virus & threat protection page, click Virus & threat protection settings.

Lab Setup Guide Page 29 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
23. When the Virus & threat protection settings page appears, turn off Real-time protection,
Cloud-delivered protection, and Automatic sample submission. If a User Account
Control pop-up window appears, click Yes. After turning off the above mentioned, click the
home icon present in the left menu bar.

Lab Setup Guide Page 30 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
24. Then, click App & browser control in the Windows Defender Security Center window.

25. In the App & browser control page, select the Off radio button under Check apps and
files, SmartScreen for Microsoft Edge, and SmartScreen for Microsoft Store apps. If a
User Account Control pop-up window appears, click Yes.
Note: If you are unable to turn off the SmartScreen for Microsoft Edge radio button, leave
the setting for SmartScreen for Microsoft Edge radio button as it is, and continue with the
setup.

26. Close all the windows.

Lab Setup Guide Page 31 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#3: Download SOC Tools
1. In the host machine, create a folder in the Drive D: named SOC-Tools.
2. Log in to your Aspen account. (You will see your course listed under My Courses.)  Click
TRAINING button under the course to access the e-Courseware, Lab Manuals, and Tools
in the Training area  Click Download Tools tab from the left-pane.
3. Click the module names from the right-pane and download all the SOC Tools files to the
D:\SOC-Tools folder.
4. Right-click the .zip files in the D:\SOC-Tools folder and select the Extract Here
option.

CT#4: Install Hyper-V role in Windows 10 Host


Machine
Note: Hardware Requirements for installing Hyper-V
 A 64-bit processor with second-level address translation (SLAT).
 CPU support for Virtual Machine Monitor Mode Extension (VT-c on Intel CPU’s).
 Virtualization technology may have a different label based on the motherboard manufacturer.
 Hardware-enforced data execution prevention.
1. Login to the Windows 10 host machine. To verify compatibility, open up PowerShell or a
Command Prompt (cmd.exe) and type systeminfo.exe. This returns information about
Hyper-V compatibility. If all listed Hyper-V requirements have a value of Yes, your system
can run the Hyper-V role. Close the Command Prompt.

Lab Setup Guide Page 32 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. Right-click on the windows start button icon and select Apps and Features.

3. The App and Features window appears; click on Programs and Features link as shown in
following screenshot.

Lab Setup Guide Page 33 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. The Program and Features window appears, click Turn Windows features on or off.

5. The Windows Features list will appear, check the Hyper-V feature as shown in the
screenshot. Click OK.

Lab Setup Guide Page 34 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. After applying the requested changes with regard to Hyper-V feature, click Restart now.
7. Once the system reboots, launch the Hyper-V Manager. This can be done in two ways:
By typing Hyper-V Manager in the Type here to search field at the lower left corner of
window and clicking on Hyper-V Manager.
(or)
Click the Windows icon present at the lower left corner of the window, navigate down and
expand the Window Administrative Tools folder to find the Hyper-V Manager icon.
Click Hyper-V Manager.

Lab Setup Guide Page 35 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Hyper-V Manager window appears along with the current machine’s name in the left-pane
as shown in the screenshot.

9. Hyper-V has been successfully installed in the Window 10 host machine.

CT#5: Configuring Network for Hyper-V


CT#5.1: Configuring Internal Network for Hyper-V
1. Launch Hyper-V Manager.
2. Click Virtual Switch Manager in the right pane of Hyper-V Manager. The Virtual Switch
Manager window appears.
3. Select New virtual network switch from left pane, and select Internal as the network type
in the pane of the window.

Lab Setup Guide Page 36 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Click Create Virtual Switch button.

5. The newly created virtual switch appears in the left pane. Enter the name of the virtual switch
as Internal Network under the Name field, select Internal network radio button, click
Apply and then click OK.

Lab Setup Guide Page 37 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Right-click on Network icon (lower right corner of the desktop), and click Open Network
and Internet Setting from the context menu.

7. The Settings window appears. In the Settings window, click on Change adaptor options.

8. In the Network Connections window, right-click on created Internal Network switch; and
click Properties from the context menu.

Lab Setup Guide Page 38 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
9. Internal Network adapter properties window appears, scroll down and select Internet
Protocol Version 4 (TCP/IPv4) and click Properties.

10. Select Use the following IP address radio button, and type the following values as shown in
the screenshot and click OK.
o IP address: 10.10.10.2
o Subnet mask: 255.255.255.0
o Default gateway: 10.10.10.1
o Preferred DNS server: 8.8.8.8

Lab Setup Guide Page 39 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. Close the Properties window, and other windows that were open except Hyper-V Manager.

CT#5.2: Configuring External Network for Hyper-V


1. Launch Hyper-V Manager.
2. Click Virtual Switch Manager in the right pane of Hyper-V Manager. The Virtual Switch
Manager window appears.

Lab Setup Guide Page 40 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. Select New virtual network switch from left pane and select External as the network type
in the pane of the window. Click Create Virtual Switch button.

Lab Setup Guide Page 41 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. The newly created virtual switch appears in the left pane. Enter the name of the virtual switch
as External Network under the Name field, select External network radio button, click
Apply and then click OK.

CT#6: Creating and Configuring Windows Server 2016


Virtual Machine
CT#6.1: Creating a Virtual Machine and Installing Windows Server
2016 Standard Guest OS
1. Launch Hyper-V Manager. If already launched, skip to step two.

Lab Setup Guide Page 42 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. Select your local machine in the left pane, then click New in the Actions pane, and then click
Virtual Machine… in the right pane as shown in the screen shot.

Note: Every machine has a unique name, so the name of your machine differs from the name
shown in the above screenshot.
3. New Virtual Machine Wizard window appears, click Next button.

Lab Setup Guide Page 43 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Specify Name and location of new virtual machine. Assign the name of the virtual machine
as SIEM1.
5. The default location for storing the virtual machine is
C:\ProgramData\Microsoft\Windows\Hyper-V\.
6. Click check box to store virtual machine in different location or set it to default location.
7. Click Next.
Note: You can specify the location either in the Specify Name and Location section or in
the forthcoming Connect Virtual Hard Disk section.

Lab Setup Guide Page 44 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Choose the generation of the virtual machine and click Next.

9. Assign the amount of Startup memory to allocate to this virtual machine in MB (here, 3072)
and uncheck Use Dynamic memory for the virtual machine.
10. Click Next.

Lab Setup Guide Page 45 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. In the next step, Configuring Network, select Internal Network adaptor from Connection
drop-down list and click Next.

12. In Connect Virtual Hard Disk step, allocate 127 GB default space for hard disk and click
Next.

Lab Setup Guide Page 46 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
13. The installation options section appears, select Install an operating system from a
bootable CD/DVD-ROM radio button.
o If you have a Windows Server 2016 DVD choose Physical CD/DVD drive radio button
and then click Next.
o If you have a Windows Server 2016 ISO file, then choose Image file (.iso) radio button
and click browse button to provide the path of ISO file and click Next.

14. New Virtual Machine Wizard appears with summary information.


15. Click Finish.

Lab Setup Guide Page 47 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. Hyper-V Manager creates SIEM1 virtual machine profile.
17. In Hyper-V Manager main window, you see a new virtual machine named SIEM1. Right-
click on the newly created virtual machine and click Settings from the context menu.

18. Setting for SIEM1 window will open click on Add Hardware and select Network Adapter
click Add button.

Lab Setup Guide Page 48 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
19. Select Default Switch from the Virtual switch dropdown. You will see Network Adaptor
Default Switch added for SIEM1.

20. Click Apply and OK.

Lab Setup Guide Page 49 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
21. In Hyper-V Manager main window, right-click SIEM1 virtual machine and click Connect
from the context menu.

22. SIEM1 Virtual Machine window appears click Start button as shown in the screenshot.

Lab Setup Guide Page 50 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
23. When SIEM1 virtual machine is turned on, Windows Setup window will appear. Fill the
required details and click Next.

24. Click Install Now in the Windows Setup to continue installation.

Lab Setup Guide Page 51 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
25. In the Select the operating system you want to install select Windows Server 2016
Standard Evaluation (Desktop Experience) option and click Next.

26. Check I accept the license terms and click Next.

Lab Setup Guide Page 52 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
27. In the Which type of installation do you want? click Custom Install Windows only
(advanced) option.

28. Click Next.

Lab Setup Guide Page 53 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
29. Installing Windows screen appears; wait until it completes the installation.

30. Once the installation is completed machine will restart.


31. Customize settings window will appear, then enter admin@123 as Password and Reenter
password for the Administrator account and click Finish.

Lab Setup Guide Page 54 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
32. Click Ctrl+Alt+Delete icon from the menu to login to SIEM1.

33. Login screen appears. Type the password (admin@123) and press Enter.

34. Now, check for the system updates and if found any, update the Windows Server 2016 virtual
machine to the latest.
Note: Installing the updates might take some time.

Lab Setup Guide Page 55 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#6.2: Changing the Computer Name
1. Close the Server Manager window. Right-click Start button and click on System.

2. In the System window, click Change settings.

Lab Setup Guide Page 56 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. In the Computer Name tab of the System Properties window, click Change.

4. Type SIEM1 in the Computer name field and click OK.

Lab Setup Guide Page 57 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. Alert will be prompted to restart the system, click OK.

6. You will be return back to System Properties window, click Close.

7. You will be prompted to restart the system, click Restart Now.

Lab Setup Guide Page 58 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#6.3: Configuring Static IP Address
1. Login as Administrator. Close the Server Manager window that opens after successful sign
in, right-click on Network icon (lower right corner of the desktop) and click Open Network
and Sharing Center from the context menu.

2. Network and Sharing Center window appear, click Change adapter settings link from the
left pane.

3. In the Network Connections window, right-click on Unidentified network (Ethernet 3)


adapter and click Properties from the context menu.
Note: The Name of Unidentified network may vary.

Lab Setup Guide Page 59 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Ethernet adapter Properties window appears; and select Internet Protocol Version 4
(TCP/IPv4) and click Properties.

Lab Setup Guide Page 60 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. Select Use the following IP address and Use the following DNS server addresses radio
buttons, and type the following values as shown in the screenshot and click OK.
o IP address: 10.10.10.16
o Subnet mask: 255.255.255.0
o Default gateway: 10.10.10.2
o Preferred DNS server: 8.8.8.8
Note: Once you click on OK button, Networks section pane appears on the right side of the
desktop screen, then click Yes.

Lab Setup Guide Page 61 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Click Close to close the Ethernet Properties window.

7. Now, check whether Windows Server 2016 is installed and working properly and check
whether Internet is accessible.

CT#6.4: Sharing SOC-Tools Folder from Host Machine and Mapping


to Windows Server 2016 VM
1. Navigate to D:\ (where SOC-Tools) folder is located, in your host machine.
2. Right-click on SOC-Tools folder and click Properties from the context menu.
Note: If you have placed SOC-Tools in a different drive then screenshots may differ in your
lab environment.

Lab Setup Guide Page 62 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. SOC-Tools Properties window appears, click Sharing tab, and then click Share button as
shown in the screenshot.

4. File Sharing window appears, select Everyone from drop-down list and click Add in Choose
people to share with wizard.

Lab Setup Guide Page 63 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. Everyone will be added to the list. Click Everyone from the list and select Read/Write option
from the dropdown menu. Click Share button.

6. Your folder is shared screen appears, click Done button as shown in the screenshot.
Note: Your local host machine name will differ in your lab environment.

Lab Setup Guide Page 64 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
7. Close all the windows that were open in your host machine.
8. Switch to SIEM1 virtual machine, if it is turned off then turn on the machine, and login with
the administrator credentials (username: Administrator and Password: admin@123). Once
logged in, close the Server Manager window.
9. Open File Explorer, and type [IP Address OR Host Name of your host machine] in the
address bar and press Enter.

10. Windows Security pop-up will appear, type your Host machine credentials, check the
Remember my credentials check box and click OK.

Lab Setup Guide Page 65 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. Right-click on SOC-Tools shared folder and click Map network drive from the context menu
as shown in the screenshot.

12. Map Network Drive window appears, assign drive letter as Z:\, make sure that Reconnect at
sign-in option is checked and click Finish.

Lab Setup Guide Page 66 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
13. SOC-Tools mapped network drive appears in the File Explorer view, click This-PC from the
left pane to confirm.

14. Now you can see that SOC-Tools directory is mapped to your SIEM1 machine as shown in
the screenshot.
Note: Throughout this configuration, the IP address of the host machine will differ in your
lab environment.

Lab Setup Guide Page 67 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#6.5: Installing WinRAR in Windows Server 2016 VM
1. Navigate to Z:\SOC-Tools\Lab Prerequisites\WinRAR folder.
2. Alternatively, you can also download the latest version of WinRAR from Vendor.
3. Double click on winrar-x64-540.exe to begin the installation.
4. WinRAR setup window appears.
5. In the WinRAR 5.10 setup window, click Install.
6. Complete the install by choosing defaults throughout the installation process.
7. After completing the installation, the installation location of WinRAR files window opens
automatically.
8. Close the window.

CT#6.6: Installing Web Browsers in Windows Server 2016 VM


1. Navigate to Z:\SOC-Tools\Lab Prerequisites in guest operating systems.
2. Open Web Browsers folder.
3. Follow wizard-driven installation steps and install Firefox and Chrome web browsers.
4. You can also download latest version of web browsers from respective vendors.

CT#6.7: Installing Notepad++ in Windows Server 2016 VM


1. Navigate to Z:\SOC-Tools\Lab Prerequisites in guest operating systems.
2. Open Notepad++ folder and double-click npp.7.3.2.Installer.
3. Follow the wizard-driven installation steps, to install Notepad++.
4. You can also download latest version of Notepad++ from its vendor site.

CT#6.8: Installing Java Development Kit 8u (JDK 8u) in Windows


Server 2016 VM
1. Navigate to Z:\SOC-Tools\SOC Lab Prerequisites in guest operating systems.
2. Open JDK Folder and double-click jdk-8u191-windows-x64.exe.
3. Follow the wizard-driven installation steps to install JDK.

Lab Setup Guide Page 68 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Click Close to finish the installation.

5. For Setting-up JAVA_HOME System Variable, open File Explorer and right-click on This
PC and select Properties option from the context menu.

Lab Setup Guide Page 69 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. System window will appear, click on Advanced system settings option.

7. System Properties window will appear, Navigate to Advanced Tab. Click Environment
Variables… button.

Lab Setup Guide Page 70 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Environment Variables window will appear, click on New… button in under System
variables pane.

9. New System variable window will appear, enter details given below.
Variable Name: JAVA_HOME
Variable value: C:\Program Files\Java\jdk1.8.0_191 (if you did not change the path while
installing JDK).
Note: if you have changed the Path while installing JDK, locate Java installation directory and
enter the path of Java installation directory as Variable value. Click OK button.

Lab Setup Guide Page 71 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
10. You will see JAVA_HOME variable listed under System variables pane. Click OK.

11. Click OK button in the System Properties Window. Restart the system to complete the java
installation.

Lab Setup Guide Page 72 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#6.9: Installing Splunk Enterprise in Windows Server 2016 VM
1. Launch SIEM1.
2. Login as Administrator (Username: Administrator and Password: admin@123).
3. Navigate to Z:\SOC-Tools\Lab Prerequisites\Splunk Enterprise.
(Ensure you have installed google chrome in windows server 2016 before installing Splunk
Enterprise).
4. Double click splunk-7.1.1-8f0ead9ec3db-x64-release.msi to start the installation. If the
Open File - Security Warning window pops up appears, click Run. Note: If a notification
appears stating the "SmartScreen has prevented the app from running", click More info, and
then click Run anyway.

5. The Splunk Enterprise Installer window appears. Accept the license agreement and click Next.

Lab Setup Guide Page 73 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Set administrator password for Splunk Enterprise by giving a password (admin@123).

7. Click Install to install Splunk Enterprise.

Lab Setup Guide Page 74 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Wait for the installation to complete. Click Finish to complete Splunk enterprise setup.

9. Splunk Enterprise launches in your default browser. The First time signing in? page appears.
Enter the username (admin) and password (provided while installation (admin@123) in
their respective fields and click Sign in.

Lab Setup Guide Page 75 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
10. You will be successfully logged in to Splunk Enterprise.

11. To increase default maximum number of concurrent of searches per CUP in Splunk
Enterprise, navigate to c:\Program Files\Splunk\etc\system\default and open file
limits.conf with Notepad++.
12. Go to line no 144 and set max_searches_per_cpu=2, click save and close the file.

Lab Setup Guide Page 76 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#6.10: Installing .Net Framework 3.5 (Includes .Net 2.0 and 3.0)
1. To open Server Manager, click Start  Server Manager icon.
2. To open Server Manager, click Start  Server Manager icon.

3. Click Add roles and features as shown in the screenshot.

Lab Setup Guide Page 77 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Add Roles and Features Wizard appears, by default Before You Begin section selected, click
Next.

5. In Installation Type section leave the selection to default, click Next.

Lab Setup Guide Page 78 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. In Server Selection section, leave the settings to default and click Next.

7. In Server Roles section, click Next.

Lab Setup Guide Page 79 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. In Select features section, check .NET Framework 3.5 Features check box, and click Next.

9. In Confirm installation selections, check Restart the destination server automatically if


required option. Add Roles and Features Wizard pop-up appears click Yes.

Lab Setup Guide Page 80 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
10. Click Install button to proceed for the selected features installation.

11. Wait until the installation is completed.

Lab Setup Guide Page 81 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
12. Once the installation is completed, you can see the message as Installation Succeeded as shown
in the screenshot, click Close button. If restart is required, restart the machine.

CT#6.11: Turn off Windows Firewall in Windows Server 2016 VM


1. Follow the step 3 to 11 of CT#2, to turn off firewall Windows Server 2016.

Lab Setup Guide Page 82 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7: Creating and Configuring Windows Server 2012
Virtual Machine
CT#7.1: Creating a Virtual Machine and Installing Windows Server
2012 R2 Standard Guest OS
1. Launch Hyper-V Manager. If already launched, skip to step two.
2. Select your local machine in the left pane, then click New under Actions pane, and then click
Virtual Machine in the right pane as shown in the screen shot.

Note: Every machine has a unique name, so the name of your machine differs from the name
shown in the above screenshot.

Lab Setup Guide Page 83 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. New Virtual Machine Wizard window appears, click Next button.

4. Specify Name WinServer2012 and location of new virtual machine. Assign the name of the
virtual machine as Windows Server 2012.
5. The default location for storing the virtual machine is
C:\ProgramData\Microsoft\Windows\Hyper-V\. You can choose different location to
store the VM’s or set it to default location.

Lab Setup Guide Page 84 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Click Next.
Note: You can specify the location either in the Specify Name and Location section or in
the forthcoming Connect Virtual Hard Disk section.

7. Choose the generation of the virtual machine (here, Generation 1) and click Next.

Lab Setup Guide Page 85 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Assign the amount of Startup memory to allocate to this virtual machine in MB (here, 2048)
and uncheck Use Dynamic Memory for this virtual machine.
9. Click Next.

10. In the next step, Configuring Network, select Internal Network adaptor from Connection
drop-down list and click Next.

Lab Setup Guide Page 86 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. Connect Virtual Hard Disk section appears, allocate default 127 GB space for hard disk and
click Next.

12. The installation options section appears, select Install an operating system from a
bootable CD/DVD-ROM radio button.
o If you have a Windows Server 2012 DVD choose Physical CD/DVD drive radio button
and then click Next.
o If you have a Windows Server 2012 ISO file, then choose Image file (.iso) radio button
and click browse button to provide the path of ISO file and click Next.

Lab Setup Guide Page 87 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
13. New Virtual Machine Wizard appears with summary information. Click Finish.

14. Hyper-V Manager creates Windows Server 2012 virtual machine profile.
15. In Hyper-V Manager main window, you see a new virtual machine named WinServer2012.
Right-click on the newly created virtual machine and click Settings from the context menu.

Lab Setup Guide Page 88 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. Setting for WinServer2012 window will open, click on Add Hardware and select Network
Adapter, then click Add.

Lab Setup Guide Page 89 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
17. Select Default Switch from the Virtual switch dropdown. You will see Default Switch
Network Adaptor added for WinServer2012.

Lab Setup Guide Page 90 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
18. Click Apply and OK.

19. In Hyper-V Manager main window, you see a new virtual machine named WinServer2012.
Right-click on the newly created virtual machine and click Connect from the context menu.

Lab Setup Guide Page 91 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
20. WinServer2012 Virtual Machine window appears, click Start button as shown in the
screenshot.

21. When WinServer2012 virtual machine is turned on, Windows Setup window will appear. Fill
the required details and click Next.

Lab Setup Guide Page 92 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
22. Click Install Now in the Windows Setup to continue installation.

23. In the Select the operating system you want to install select Windows Server 2012 R2
Standard Evaluation (Server with a GUI) option and click Next.

Lab Setup Guide Page 93 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
24. Check I accept the license terms and click Next.

25. In the Which type of installation do you want? click Custom Install Windows only
(advanced) option.

Lab Setup Guide Page 94 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
26. Click Next.

27. Installing Windows screen appears; wait until it completes the installation.

28. Once the installation is completed machine will restart.

Lab Setup Guide Page 95 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
29. Settings window will appear, enter admin@123 as Password and Reenter password for the
Administrator account, and click Finish.

30. Click Ctrl+Alt+Delete icon from the menu to login to WinServer2012.

31. Login screen appears. Type the password (admin@123) and press Enter.

Lab Setup Guide Page 96 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
32. Now, check for the system updates and if found any, update the Windows Server 2012 virtual
machine to the latest.
Note: Installing the updates might take some time.

CT#7.2: Changing the Computer Name


1. Close the Server Manager window that opens. Right-click Start icon and click on System.

Lab Setup Guide Page 97 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. In the System window, click Change settings.

3. In the Computer Name tab of the System Properties window, click Change.

Lab Setup Guide Page 98 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. In the Computer name field, enter WinServer2012 and click OK.

5. When prompted to restart the system, click OK.

Lab Setup Guide Page 99 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. You will be returned to System Properties window, click Close.

7. You will be prompted to restart the system, click Restart Now.

CT#7.3: Configuring Static IP Address


1. Login as Administrator. Close the Server Manager window that opens after successful sign
in, right-click on Network icon (lower right corner of the desktop) and click Open Network
and Sharing Center from the context menu.

Lab Setup Guide Page 100 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. Network and Sharing Center window appear, click Change adapter settings link from the
left pane.

3. In the Network Connections window, right-click on Unidentified network (Ethernet) adapter


and click Properties from the context menu.
Note: The Name of Unidentified network may vary.

Lab Setup Guide Page 101 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Ethernet adapter Properties window appears; and select Internet Protocol Version 4
(TCP/IPv4) and click Properties.

Lab Setup Guide Page 102 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. Select Use the following IP address and Use the following DNS server addresses radio
buttons, and type the following values as shown in the screenshot and click OK.
o IP address: 10.10.10.12
o Subnet mask: 255.255.255.0
o Default gateway: 10.10.10.2
o Preferred DNS server: 8.8.8.8
Note: Once you click on OK button if Networks section appears on the right side of the
desktop screen, and then click Yes.

Lab Setup Guide Page 103 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Click Close to close the Ethernet Properties window.

7. Now, check whether Windows Server 2012 is installed and working properly.

Lab Setup Guide Page 104 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7.4: Adding IIS (Internet Information Services) roles in Server
Manager
1. To open Server Manager, click Start  Server Manager icon.

2. In Server Manager Dashboard, click Add Roles and Features.

Lab Setup Guide Page 105 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. Add Roles and Features Wizard appears, click Next.

4. In Installation Type section of the wizard, select Role-based or feature-based installation


radio button and click Next.

Lab Setup Guide Page 106 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. In Server Selection section, leave the selections to default and click Next.

6. Server Roles section appears, click the check box of Web Server (IIS) role.

Lab Setup Guide Page 107 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
7. Add Roles and Features Wizard window appears, click Add Features.

8. In the Server Roles section, you will observe the Web Server (IIS) option is checked. Click
Next.

Lab Setup Guide Page 108 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
9. Features section appears, select the checkboxes for .NET Framework 3.5 feature, as well as
all the checkboxes under .NET Framework 4.6 Features.

10. Scroll down and check Telnet Server feature option Click Next.

11. Click Add Features button if you get a prompt for the features to be added, while selecting
any features. Click Next.

Lab Setup Guide Page 109 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
12. Web Server Role (IIS) section appears in the wizard, click Next.

13. Selected Role Services section appears in the wizard. Check all features under Health and
Diagnostics.

Lab Setup Guide Page 110 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
14. Scroll down and Check FTP Server FTP Service, Management Tools IIS
Management Console, IIS 6 Metabase Compatability  IIS 6 Metabase
Compatability. Click Next.

15. In Confirm installation section wizard, click Install (Ignore the warning under the Custom
installation selections wizard).

Lab Setup Guide Page 111 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. Add Roles and Features Wizard will show the installation progress of the features. It will
take a while to complete the installation of selected roles.

17. After the completion of installation, click Close button and restart the machine.

Lab Setup Guide Page 112 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7.5: Sharing SOC-Tools Folder from Host Machine and Mapping
to Windows Server 2012 VM
1. Open File Explorer, and type [IP Address of your host machine] in the address bar and
press Enter.

2. Type your Host machine credentials, check the Remember my credentials check box and click
OK, in the Windows Security pop-up that appears.

Lab Setup Guide Page 113 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. Right-click on SOC-Tools shared folder and click Map network drive from the context menu
as shown in the screenshot.

4. Map Network Drive window appears, assign drive letter as Z:\, make sure that Reconnect at
sign-in option is checked and click Finish.

5. SOC-Tools mapped network drive appears in the File Explorer view, click This-PC from the
left pane to confirm.

Lab Setup Guide Page 114 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Now you can see that SOC-Tools directory is mapped to your Windows Server 2012 machine
as shown in the screenshot.
Note: Throughout this configuration, the IP address of the host machine will differ in your
lab environment.

Lab Setup Guide Page 115 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7.6: Install MS SQL Server 2016 Express Edition on Windows
Server 2016 Virtual Machine
1. Navigate to Z:\ SOC-Tools\Lab Prerequisites\SQL Server 2016 and double-click
SQLServer2016-SSEI-Expr.exe.
2. If Open File -Security warning pop-up appears, click Run.
3. SQL Server 2016 window appears click Custom.

Lab Setup Guide Page 116 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Specify SQL Server media download target location section appears, click Install.

5. The program starts downloading the setup files, wait for the Installation Center to launch.

Lab Setup Guide Page 117 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. SQL Server Installation Center window appears with Installation section displayed by default,
click New SQL Server stand-alone installation or add features to an existing installation
link and wait for some time.

7. Read the Software License Terms in the License Terms section, check the option I accept
the license terms and click Next.

Lab Setup Guide Page 118 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. SQL Server 2017 Setup Microsoft Update section appears, click Next.

9. The Install Rules verifies the system state of your computer before Setup continues.
10. After verification is finished, click Next.

Lab Setup Guide Page 119 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. The Feature Rules gets installed and Instance Configuration window appears.
12. In the Instance Configuration window, select Default instance that gives the Instance ID
as MSSQLSERVER. Click Next.

13. The Server Configuration window appears. Click Next.

Lab Setup Guide Page 120 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
14. In the Database Engine Configuration window, select Mixed Mode (SQL Server
authentication and Windows authentication). In Enter password field specify the
password qwerty@123. Click Next.

15. In the Reporting Services Configuration window, select Install and configure. Click
Next.

Lab Setup Guide Page 121 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. Consent to install Microsoft R Open window appears. Click Accept to download Microsoft
R Open.

17. Click Next.

Lab Setup Guide Page 122 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
18. Feature Configuration Rules installation occurs after the pre-requisite installation of
Microsoft R Open.
19. Installation Progress window appears. During installation, the Installation Progress page
provides status so that you can monitor installation progress as Setup continues.
20. After the installation completes click Next or the Complete page appears automatically.

21. Complete page appears.


22. The Complete page provides a link to the summary log file for the installation and other
important notes.
23. Click Close.

Lab Setup Guide Page 123 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
24. You are instructed to restart the computer. Save your work before you restart the computer.
25. You must read the message from the Installation Wizard when you finish Setup.

CT#7.7: Install Microsoft SQL Server Management Studio on


Windows Server 2012 Virtual Machine
1. Navigate the D:\SOC-Tools\Lab Prerequisites\SQL Server Management Studio
Double-click on SSMS-Setup-ENU.exe.
2. Click Run if security waring pop-up appears.

3. Microsoft SQL Server Management Studio welcome screen appears, click Install to begin the
setup.

Lab Setup Guide Page 124 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Microsoft SQL Server Management Studio begins the setup. Wait for the setup to finish.

5. Microsoft SQL Server Management Studio Setup Completed screen appears, click Close to
finish.

6. Close the SQL Server Installation Center window.

Lab Setup Guide Page 125 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7.8: Installing Notepad++ in Windows Server 2012 VM
1. Navigate to Z:\SOC-Tools\Lab Prerequisites in guest operating systems.
2. Open Notepad++ folder and double-click npp.7.3.2.Installer.
3. Follow the wizard-driven installation steps, to install Notepad++.
4. You can also download latest version of Notepad++ from its vendor site.

CT#7.9: Installing Web Browsers in Windows Server 2012 VM


1. Navigate to Z:\SOC-Tools\Lab Prerequisites in guest operating systems.
2. Open Web Browsers folder.
3. Follow wizard-driven installation steps and install Firefox and Chrome web browsers.
4. You can also download latest version of web browsers from respective vendors.

CT#7.10: Configure the LuxuryTreats Website in Windows Server


2012 (Virtual Machine)
1. Navigate to Z:\SOC-Tools\Lab Prerequisites\Websites.
2. Right-click the LuxuryTreats.zip file select copy from the context menu to copy the file.

Lab Setup Guide Page 126 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. Navigate to C:\inetpub\wwwroot folder and past the copied LuxuryTreats.zip file.

4. Right-click the LuzuryTreats.zip file and click Extract All option from the context menu.

Lab Setup Guide Page 127 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. Change the Destination folder to C:/inetpub/wwwroot/ and click Extract.

6. LuxuryTreats.zip file will be extracted, and you will see a LuxuryTreats folder created in
C:/inetpub/wwwroot. Delete the LuxuryTreats.zip file. After extracting the LuxuryTreats
folder delete the LuxuryTreats.zip file.

7. Open LuxuryTreats folder from C:\inetpub\wwwroot\ and open Web.config file in


notepad++ or in notepad.

Lab Setup Guide Page 128 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Scroll down to connectionStrings tag, Replace Server with your machine’s name in the
connectionString property of DBConn connection string as shown in the screenshot.
Note: If you have changed the password of sa user while installing SQL Server, change the
password in the connection string to given password for SQL Server sa user while installing
SQL Server.

9. Save the file and close it.


10. Now, launch SQL Server 2016 Management Studio and click Connect.

Lab Setup Guide Page 129 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. Microsoft SQL Server Management Studio window, right-click on Databases and select
New Database.

12. New Database window appears, specify Database name as Hotels and click OK.

Lab Setup Guide Page 130 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
13. Now expand the Databases node. You will observe that Hotels database appears under the
Object Explorer section, which implies that Hotels database has been successfully created.

14. Navigate to Z:\Lab Prerequisites\Website\DBScript.


15. Double-click Script.sql file, it will open in SQL Server Management Studio Editor.If you
are not connected to the database server Connect to Server Window appears give the
username and password and connect to the database server.

Lab Setup Guide Page 131 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. Now click Execute on the task bar.

17. This process will create necessary tables in the Hotels database.
18. Now click Start menu button, click Administrative Tools.

Lab Setup Guide Page 132 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
19. Double-click on Internet Information Services (IIS) Manager.

20. Internet Information Services (IIS) Manager main window appears, now in Connections pane
of the IIS Manager, right-click the Machine Name and click Add Website from context
menu.

21. Add Website wizard appears, type the Site name in Site name: field and click on Browse
button near Physical path: section. Here we are installing LuxuryTreats site, so we have
provided LuxuryTreats in the Site name: field.

Lab Setup Guide Page 133 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
22. Browse for Folder pop-up appears, navigate to C:\inetpub\wwwroot and choose
LuxuryTreats folder and click OK.

23. Now in Binding section choose http in Type: field. Choose the Host machine IP address
(Internal adaptor - 10.10.10.12) from IP address: field, and choose 80 in Port: field.
24. Type www.luxurytreats.com in Hostname: field, make sure that Start Website immediately
is checked and click OK.

Lab Setup Guide Page 134 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7.11: Configuring Host File in Windows Server 2012
1. In Windows Server 2012 navigate to C:\Windows\System32\drivers\etc and right click
on hosts file and click Edit with Notepad++ from context menu.
2. Hosts file opens in Notepad++ type <IP Address of the Windows Server 2012>
www.luxurytreats.com and click Save button and close the Notepad++ window.

CT#7.12: Setting up FTP Site in Windows 2012


1. Navigate to Z:\Lab Prerequisites\Website and copy the DemoFTPSite in to C: drive.

2. Click on Windows Start button Administrative Tools.

Lab Setup Guide Page 135 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
Lab Setup Guide Page 136 Copyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited.
3. Double-Click on Internet Information Services (IIS) Manager.

4. In the IIS Manager window expand WINSERVER2012. Right-click on Sites and click on Add
FTP Site from the context menu.

5. Give FTP site name as DemoFTPSite. Click … ellipse button.

Lab Setup Guide Page 137 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Browse for folder dialog box appears, navigate to C:\DemoFTPSite and click OK.

7. The physical path will be set to C:\DemoFTPSite. Click Next.

Lab Setup Guide Page 138 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Select IP Address 10.10.10.12 from the IP Address dropdown Port: 21 and check Start FTP site
automatically. Select No SSL as SLL option and click Next.

9. Check Anonymous and Basic for Authentication. Select Allow access to: All users as
Authorization and check Permissions: Read and Write click Finish.

Lab Setup Guide Page 139 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
10. You will see that DemoFTPSite will be successfully created in IIS Manager.

11. Click on DemoFTPSite and double-click on FTP Logging as shown in following screenshot.

12. Click on Select W3C Fields… button.

Lab Setup Guide Page 140 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
13. Tick All check boxes available in Information to Log window and click OK.

14. Click Apply in right side Action pane.

Lab Setup Guide Page 141 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
15. You will see Alerts The changes have been successfully saved.

16. Close all open windows.

CT#7.13: Installing WinPcap on Windows Server 2012


1. To install WinPcap, navigate to Z:\SOC-Tools\Prerequisite\WinPcap.
2. Double-click the WinPcap_4_1_3.exe file. WinPcap 4.1.3 Setup wizard will appear.
3. click Next.

Lab Setup Guide Page 142 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Accept the License Agreement, and install WinPcap by selecting the options that appear I
Agree in the wizard.

5. Click on Install button.

Lab Setup Guide Page 143 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Once Installation Complete Click Finish button to close this Wizard.

CT#7.14: Turn off Windows Firewall in WinServer2012


1. Right-click on Windows start button and click Control Panel.

Lab Setup Guide Page 144 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. In the Control Panel window, click System and Security.

3. Click the Windows Firewall in the System and Security window.

Lab Setup Guide Page 145 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. In the Windows Firewall window, click Turn Windows Firewall on or off link in the left-
pane of the window.

5. In the Customize Settings window, select Turn off Windows Firewall (not
recommended) radio button for all Domain, Private and Public network settings and click
OK.

Lab Setup Guide Page 146 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. You will see status of windows firewall is off, close the Windows Firewall window.

7. Again, in the Windows Firewall window, click Advanced settings link in the left-pane.

Lab Setup Guide Page 147 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Once the Windows Firewall with Advanced Security appears on the screen, click Windows
Firewall Properties link in the Overview section.

9. When the Windows Firewall with Advanced Security on Local Computer Properties
window appears, in the Domain Profile tab, choose Off from the Firewall state drop-
down list. Then navigate to Private Profile and Public Profile tabs and ensure that the
Firewall state is Off. Click Apply and then click OK.

10. Close all the windows.

Lab Setup Guide Page 148 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#7.15: Change User Account Settings to disable notification on
System Changes
1. Right-click on Windows Start Button and Select Control Panel.

2. Control Panel will open click on System and Security.

Lab Setup Guide Page 149 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. Click on Change User Account Control setting link.

4. Drag the scroll bar down Always notify to Never notify and click OK.

Lab Setup Guide Page 150 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#8: Creating and Configuring Windows 10 Virtual
Machine
CT#8.1: Creating a Virtual Machine and Installing Windows 10
Guest OS
1. Launch Hyper-V Manager. If already launched, skip to step two.
2. Select your local machine in the left pane, then click New, and then click Virtual Machine…
in the right pane as shown in the screen shot.

Note: Every machine has a unique name, so the name of your machine differs from the
name shown in the above screenshot.

Lab Setup Guide Page 151 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. New Virtual Machine Wizard window appears, click Next button.

4. Specify Name and location of new virtual machine. Assign the name of the virtual machine
as Windows10.
5. The default location for storing the virtual machine is
C:\ProgramData\Microsoft\Windows\Hyper-V\. You can choose different location to
store the VM’s or set it to default location.

Lab Setup Guide Page 152 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Click Next.
Note: You can specify the location either in the Specify Name and Location section or in
the forthcoming Connect Virtual Hard Disk section.

7. Choose the generation of the virtual machine (here, Generation 1) and click Next.

Lab Setup Guide Page 153 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. Assign the amount of Startup memory to allocate to this virtual machine in MB (here, 3072)
and uncheck Use Dynamic memory for the virtual machine.
9. Click Next.

10. In the Configure Networking step, select Internal Network from Connection drop-down list
and click Next.

Lab Setup Guide Page 154 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. Connect Virtual Hard Disk section appears, allocate 40 GB default space for hard disk and
click Next.

Lab Setup Guide Page 155 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
12. The installation options section appears, select Install an operating system from a
bootable CD/DVD-ROM radio button.
o If you have a Windows 10 DVD choose Physical CD/DVD drive radio button and then
click Next.
o If you have a Windows 10 file, then choose Image file (.iso) radio button and click browse
button to provide the path of ISO file and click Next.

13. Virtual machine wizard appears with summary information.

Lab Setup Guide Page 156 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
14. Click Finish.

15. Hyper-V Manager creates Windows10 virtual machine profile.

Lab Setup Guide Page 157 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. In Hyper-V Manager main window, you see a new virtual machine named Windows10.
Right-click on the newly created virtual machine and click Settings from the context menu.

17. Setting for Windows10 window will open click on Add Hardware and select Network
Adapter click Add button finally click OK button.

Lab Setup Guide Page 158 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
18. You will see Network Adaptor added in setting list, select virtual switch as Default Switch
click Apply and click OK.

19. In Hyper-V Manager main window, you see a new virtual machine named Windows10.
Right-click on the newly created virtual machine and click Connect from the context menu.

Lab Setup Guide Page 159 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
20. Windows10 Virtual Machine window appears click Start button as shown in the screenshot.

21. Windows Setup screen appears, in Windows Setup screens choose the Language and other
preferences then click Next.

Lab Setup Guide Page 160 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
22. Click Install now button to start the installation process of Windows 10.

23. License terms wizard appears, check I accept the license terms check and box and click
Next.

Lab Setup Guide Page 161 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
24. Click Custom: Install Windows only (advanced) option to proceed with the installation.

25. Where do you want to install Windows? wizard appears, click New to create a partition.

Lab Setup Guide Page 162 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
26. Provide 30000 MB in the Size field and click Apply.

27. Windows Setup pop-up appears, click OK.

Lab Setup Guide Page 163 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
28. Click Unallocated Space partition, then click on New, and then leave the size to default and
then click Apply.

29. After partitions are created, choose the partition to install Windows 10, and click Next.

Lab Setup Guide Page 164 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
30. Installing Windows screen appears; wait until it completes the installation.

31. Once the installation is completed machine will restart, and you will see the Get going fast
screen. Click Use Express settings button.

Lab Setup Guide Page 165 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
32. Create an account for this PC screen appears, fill the following details:
o Username: Admin
o Password: admin@123
Hint field need to be filled mandatory, you can fill with the desired hint, and click Next.

33. Windows 10 machine is ready as shown in the screenshot.

Lab Setup Guide Page 166 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#8.2: Creating New User Account in Windows 10 Virtual Machine
1. Click windows Start button Icon.

2. Click Settings.

3. Click on Accounts.

Lab Setup Guide Page 167 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Select option Family & Other users.

5. Click Add someone else to this PC button.

6. Click I don’t have this person’s sign-in information link.

Lab Setup Guide Page 168 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
7. Click Add a user without Microsoft account link.

8. Type username as Martin and password as user@123 type confirmed password and password
hint as user click Next.

Lab Setup Guide Page 169 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
9. User Martin will be created as shown following screenshot.

10. Now, check for the system updates and if found any, update the Windows 10 virtual machine
to the latest.
Note: Installing the updates might take some time.

Lab Setup Guide Page 170 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#8.3: Change the Computer Name
1. Right-click Start icon and click on System.

2. In the System window, click Change settings.

Lab Setup Guide Page 171 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. In the Computer Name tab of the System Properties window, click Change.

4. In the Computer Name field, enter Windows10 and click OK.

Lab Setup Guide Page 172 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. When prompted to restart the system, click OK.

6. You will be returned back to System Properties window, click Close.

7. You will be prompted to restart the system, click Restart Now.

Lab Setup Guide Page 173 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#8.4: Configuring Static IP Address
1. Login as Administrator (Username : Admin Password: admin@123). ight-click on Network
icon (lower right corner of the desktop) and click Open Network and Sharing Center from
the context menu.

2. Network and Sharing Center window appear, click Change adapter settings link from the
left pane.

3. In the Network Connections window, right-click on Unidentified network (Ethernet) adapter


and click Properties from the context menu.
Note: The Name of Unidentified network may vary.

Lab Setup Guide Page 174 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Ethernet adapter Properties window appears; and select Internet Protocol Version 4
(TCP/IPv4) and click Properties.

Lab Setup Guide Page 175 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. Select Use the following IP address and Use the following DNS server addresses radio
buttons, and type the following values as shown in the screenshot and click OK.
o IP address: 10.10.10.10
o Subnet mask: 255.255.255.0
o Default gateway: 10.10.10.2
o Preferred DNS server: 8.8.8.8
Note: Once you click on OK button if Networks section appears on the right side of the
desktop screen, and then click Yes.

Lab Setup Guide Page 176 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Click Close to close the Ethernet Properties window.

CT#8.5: Sharing SOC-Tools Folder from Host Machine and Mapping


to Windows 10 VM
1. Follow CT#6.4, to share SOC-Tools directory in Windows10 VM.

CT#8.6: Installing Web Browsers


1. Follow CT#6.6, to install web browser.

Lab Setup Guide Page 177 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#8.7: Installing FTP Client
1. Navigate to Z:\Lab Prerequisites\FileZilla folder.
2. Double click on FileZilla_3.40.0_win64-setup_bundled.exe to begin the installation.
3. If the Open - File Security Warning pop-up appears, click Run.
4. Follow the wizard steps (by selecting default options) to install FileZilla.
5. Click I Agree.

6. Leave default option as it is click Next.

Lab Setup Guide Page 178 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
7. Check Desktop Icon option from list and click Next.

8. Choose default installation location and Click Next.

Lab Setup Guide Page 179 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
9. Click Next.

10. Installation will start.

Lab Setup Guide Page 180 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
11. Uncheck Start FileZilla now option and click Finish button to complete filezilla installation.

Lab Setup Guide Page 181 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#8.8: Turn Off the Windows Defender Firewall
1. In the Type here to search field present at the lower left corner of the screen, type Control
Panel. A search result containing Control Panel desktop app appears. Click Control Panel.

Lab Setup Guide Page 182 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. In the Control Panel window, click System and Security.

3. Click the Windows Defender Firewall in the System and Security window.

Lab Setup Guide Page 183 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. In the Windows Defender Firewall window, click Turn Windows Defender Firewall on
or off link in the left-pane of the window.

5. In the Customize Settings window, select Turn off Windows Defender Firewall (not
recommended) radio button for all Domain, Private and Public network settings and click
OK.

Lab Setup Guide Page 184 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Again, in the Windows Defender Firewall window, click Advanced settings link in the left-
pane.

7. Once the Windows Defender Firewall with Advanced Security appears on the screen, click
Windows Defender Firewall Properties link in the Overview section.

Lab Setup Guide Page 185 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. When the Windows Defender Firewall with Advanced Security on Local Computer
Properties window appears, in the Domain Profile tab, choose Off from the Firewall state
drop-down list. Then navigate to Private Profile and Public Profile tabs and ensure that the
Firewall state is Off. Click Apply and then click OK.

9. Close all the windows.

Lab Setup Guide Page 186 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#9: Creating and Configuring Kali Linux Virtual
Machine
CT#9.1: Creating a Virtual Machine and Installing Kali Linux OS
1. Launch Hyper-V Manager. If already launched, skip to step two.
2. Select your local machine in the left pane, then click New, and then click Virtual Machine…
in the right pane as shown in the screen shot.

Note: Every machine has a unique name, so the name of your machine differs from the
name shown in the above screenshot.
3. New Virtual Machine Wizard window appears, click Next button.

Lab Setup Guide Page 187 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Specify Name and location of new virtual machine. Assign the name of the virtual machine
as Kali Linux.
5. The default location for storing the virtual machine is
C:\ProgramData\Microsoft\Windows\Hyper-V\. You can choose different location to
store the VM’s or set it to default location.
6. Click Next.
Note: You can specify the location either in the Specify Name and Location section or in
the forthcoming Connect Virtual Hard Disk section.

Lab Setup Guide Page 188 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
7. Choose the generation of the virtual machine (here, Generation 1) and click Next.

8. Assign the amount of Startup memory to allocate to this virtual machine in MB (here, 1024).
9. Click Next.

Lab Setup Guide Page 189 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
10. In the next step, select network adapter as Default Switch from connection drop-down list
and click Next.

11. Connect Virtual Hard Disk section appears, allocate 40 GB space for hard disk and click Next.

Lab Setup Guide Page 190 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
12. The installation options section appears, select Install an operating system from a
bootable CD/DVD-ROM radio button.
o If you have a Kali Linux choose Physical CD/DVD drive radio button and then click
Next.
o If you have a Kali Linux file, then choose Image file (.iso) radio button and click browse
button to provide the path of ISO file and click Next.

13. Virtual machine wizard appears with summary information.

Lab Setup Guide Page 191 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
14. Click Finish.

15. Hyper-V Manager creates Kali Linux virtual machine profile.

Lab Setup Guide Page 192 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. In Hyper-V Manager main window, you see a new virtual machine named Kali Linux. Right-
click on the newly created virtual machine and click Connect from the context menu.

17. Kali Linux Virtual Machine window appears click Start button as shown in the screenshot.

Lab Setup Guide Page 193 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
18. Kali Linux Boot menu appears, select Graphical install and press Enter.

19. Select a language window appears, choose a language (here, English) and click Continue.

Lab Setup Guide Page 194 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
20. In the Select your location section, choose a location (here, United States) and click
Continue.

21. Configure the keyboard section appears, choose a language (here, American English) and
click Continue.

Lab Setup Guide Page 195 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
22. Configure the network section appears, leave the Hostname to default and click Continue.

23. Configure the network section appears, leave the Domain name: field blank and click
Continue.

Lab Setup Guide Page 196 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
24. Set up users and passwords section appears, enter toor in both the Root password as well
as re-enter password to verify fields and click Continue.

25. In Configure the clock window, choose the time zone (here, Eastern) and click Continue
Wait until the installer fetches time from the network time server.

Lab Setup Guide Page 197 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
26. Partition disks window appears, choose the Partitioning method: Guided – use entire disk
and click Continue.

27. Another Partition disks window appears, select the disk SCSI1 (0,0,0) (sda) – 26.8 GB
VMware, VMware Virtual S and click Continue.
Note: The size of the disk (26.8 GB) may vary in your lab environment.

Lab Setup Guide Page 198 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
28. In the Partition disks window, choose the Partitioning scheme: All files in one partition
(recommended for new users) and click Continue.

29. Partition disks window appears displaying the overview of your currently configured
partitions, choose Finish partitioning and write changes to disk and click Continue.

Lab Setup Guide Page 199 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
30. A Partition disks window appears stating that the changes will be written to the disk, select
Yes and click Continue.

31. On completion of installation, Configure the package manager window appears, select No
and click Continue.

Lab Setup Guide Page 200 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
32. Install the GRUB boot loader on a hard disk window appears, select Yes in order to install the
GRUB boot loader to the master boot record and click Continue.

33. Select the available device in Device for boot loader installation (here, /dev/sda) and click
Continue. Wait until the GRUB boot loader is installed.

Lab Setup Guide Page 201 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
34. Wait until the partitions are formatted and the operating system is installed.
35. It takes some time for the installation to complete. Finish the installation window appears,
click Continue.

36. Once the installation is finished the machine will get restarted, and after the restart it will come
to the login screen. Login to the machine with Username: root and Password: toor.

Lab Setup Guide Page 202 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#9.2 Configuring Host File in Kali Linux
1. To add www.luxurytreats.com website to the host file, navigate to Places  Computer.

2. Navigate to etc folder then search for hosts file  right click on file and open with Text
Editor.

3. Add IP 10.10.10.12 address and url www.luxurytreats.com at the end of the file. Click Save
close the text editor.

4. Open browser and type www.luxurytreats.com in url and press Enter, you will navigate to
luxuryTreats website.

Lab Setup Guide Page 203 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#9.3 Updating Kali Linux
1. Open terminal and type gedit /etc/apt/sources.list. sources.list file will open in the
geditor.

2. Add following line of code at the end of the sources.list file. Click Save to save the file. close
the sources.list file.
deb http://http.kali.org/kali kali-rolling main contrib non-free
deb http://http.kali.org/kali sana main non-free contrib
deb http://security.kali.org/kali-security sana/updates main contrib non-free
deb http://old.kali.org/kali moto main non-free contrib

Lab Setup Guide Page 204 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. Type apt-get update to update the Kali Linux virtual machine.
Note: If not up-to-date, a prompt appears, asking for a user input as Y/N. Type Y and press
Enter to continue the process.

4. Type apt-get install ftp in terminal and press Enter to install ftp Client.

CT#9.4 Sharing SOC-Tools Folder from Host Machine


1. Click Files icon from the taskbar menu as shown in the screenshot.

Lab Setup Guide Page 205 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. In the Explorer window, Press Ctrl + L and type smb://[IP address of your host machine]
in the address bar and press Enter.
Note: IP address will differ in your lab environment.

3. Password required for [IP address of your host machine] pop-up appears, type credentials of
your host machine, select Remember forever radio button and click Connect.

Lab Setup Guide Page 206 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Shared SOC-Tools directory appears. Right-click the SOC-Tools directory and click Mount.

5. Scroll down and you will see host machine’s soc-tools shared folder mounted.

Lab Setup Guide Page 207 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#10: Installing and Configuring AlienVault OSSIM
It is recommended that you have a system with at least 16 GB of RAM. Before starting installation of
OSSIM virtual machine, ensure that you have set RAM to 8000 MB, no. of virtual CPU to 2, network
interface to Internal.
1. Launch Hyper-V Manager. If already launched, skip to step two.
2. Select your local machine in the left pane, then click New, and then click Virtual Machine…
in the right pane as shown in the screen shot.

3. New Virtual Machine Wizard window appears, click Next button.

Lab Setup Guide Page 208 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. Specify Name and location of new virtual machine. Assign the name of the virtual machine
as OSSIM SERVER. The default location for storing the virtual machine is
C:\ProgramData\Microsoft\Windows\Hyper-V\. You can choose different location to
store the VM’s or set it to default location. Click Next.
Note: You can specify the location either in the Specify Name and Location section or in
the forthcoming Connect Virtual Hard Disk section.

5. Choose the generation of the virtual machine (here, Generation 1) and click Next.

Lab Setup Guide Page 209 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Assign the amount of Startup memory to allocate to this virtual machine in MB (here, 8000)
7. Click Next.

8. In the next step, select network adapter as Internal Network from connection drop-down
list and click Next.

Lab Setup Guide Page 210 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
9. Connect Virtual Hard Disk section appears click Next.

Lab Setup Guide Page 211 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
10. The installation options section appears, select Install an operating system from a
bootable CD/DVD-ROM radio button.
o If you have an OSSIM DVD choose Physical CD/DVD drive radio button and then click
Next.
o If you have an OSSIM ISO file, then choose Image file (.iso) radio button and click browse
button to provide the path of ISO file and click Next.

11. Virtual machine wizard appears with summary information.

Lab Setup Guide Page 212 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
12. Click Finish.

13. In Hyper-V Manager window right-click on created OSSIM virtual machine and click Settings
from the context menu.

Lab Setup Guide Page 213 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
14. Settings for OSSIM SERVER window appears, click Processor from left pane and type 2 in
Number of virtual processors field, and click Apply and then OK.

15. In Hyper-V Manager window right-click on created OSSIM virtual machine and click Settings
from the context menu.

Lab Setup Guide Page 214 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
16. Click Add Hardware Select Network Adapter Click Add button.

17. Select Network Adapter select External Network.

Lab Setup Guide Page 215 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
18. In Hyper-V Manager main window, right-click on OSSIM newly created virtual machine
and click Connect from the context menu.

19. OSSIM Virtual Machine window appears click Start button as shown in the screenshot.

Lab Setup Guide Page 216 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
20. OSSIM virtual machine starts booting with the provided source.
21. ALIEN VAULT OSSIM setup wizard appears, choose AlienVault OSSIM 5.6.0 (64 Bit)
option and press Enter.
Note: The screenshots might differ if you have downloaded the latest version of AlienVault
OSSIM.

22. Select a language screen appears. Select your language and click Continue.

Lab Setup Guide Page 217 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
23. Select your location screen appears. Select your country and click Continue.

24. Configure the keyboard window appears. Select your preferred language and click Continue.

Lab Setup Guide Page 218 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
25. Configure the network window appears. Enter 10.10.10.17 in the IP address: field and click
Continue.
Note: IP may differ if you have chosen a different IP while configuring OSSIM.

26. Netmask: screen appears. Ensure the mask is set to 255.255.255.0 and click Continue.

Lab Setup Guide Page 219 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
27. Gateway: screen appears. Ensure that gateway is set to 10.10.10.2 and click Continue.

28. Name server addresses: screen appears. You can enter the DNS server address, or you can
leave the field default and click Continue.

Lab Setup Guide Page 220 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
29. Wait until the network configuration is completed.

30. Set up users and passwords screen appear. Enter toor in Root password: and Re-enter
password to verify fields and click Continue.
Note: You can type any password of your choice.

Lab Setup Guide Page 221 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
31. Configure the clock screen appears. Select your preferred time zone and click Continue.

32. It will take some time to complete the configuration, wait until it finishes.

Lab Setup Guide Page 222 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
33. Once configurations are completed, the ALIEN VAULT screen appears as shown in the
screenshot. Restart the machine.

34. After restart wait for the login screen to appear and enter root as the username and press
Enter key then type toor as password and press Enter.
Note: The password that you have set at step 30 in this Configuration Task.

Lab Setup Guide Page 223 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
35. AlienVault Setup screen appears as shown in the screenshot.

36. To setup Management Network, select Configure Network from System Preferences
screen.

Lab Setup Guide Page 224 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
37. In the Configure Network screen, select Setup Management Network.

38. In the Select Interface for Management Network screen, select eth0 (Default adaptor).

39. In the Setup Management Network, type IP 192.168.0.79 address and select OK.

Lab Setup Guide Page 225 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
40. In the Netmask screen, type IP 255.255.255.0 as netmask and select OK.

41. In the Gateway screen, type 192.168.0.1 as Gateway and select OK.

42. To setup Network Interface, Select Setup Network Interface option and click OK.

Lab Setup Guide Page 226 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
43. In the Setup Network Interface screen, select eth1 option and click OK.

44. In the Set Network Interface IP address screen, type 10.10.10.17 and select OK.

45. In the Set Management Network Mask screen, type 255.255.255.0 and select OK.

Lab Setup Guide Page 227 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
46. Select Back until you view the AlienVault Setup Screen. Select Configure Sensor option and
click OK.

47. In the Configure Sensor screen, select Configure AlienVault Server IP and select OK.

48. In the Configure Alienvault Server IP, enter 127.0.0.1 and select OK.

Lab Setup Guide Page 228 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
49. Select Back until you view the AlienVault Setup Screen. Select Apply all Changes option
and click OK.

50. Apply all Changes screen will appear Select Yes.

51. Once all changes are applied select the OK.

Lab Setup Guide Page 229 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
52. Select Reboot Appliance option and press Enter.

53. Select Yes to Reboot Appliance.

54. After reboot wait for the login screen to appear and enter root as the username and press
Enter key then type toor as password and press Enter.

Lab Setup Guide Page 230 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#11: Creating and Configuring Windows 10 Virtual
Machine (SIEM2)
CT#11.1: Creating a Virtual Machine and Installing Windows 10
Enterprise Guest OS
Follow the steps of CT#5.1, to create a VM and install Windows 10 guest OS.
Virtual Machine Name: SIEM2.
RAM: 2000 MB
1. Wait until Windows Setup screen appears, in Windows Setup screens choose the Language
and other preferences then click Next.

2. Click Install now button to start the installation process of Windows 10.

Lab Setup Guide Page 231 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
3. License terms wizard appears, check I accept the license terms check and box and click Next.

4. Click Custom: Install Windows only (advanced) option to proceed with the installation.

Lab Setup Guide Page 232 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
5. Installing Windows screen appears; wait until it completes the installation.

6. Once the installation is completed machine will restart, and you will see the Get going fast
screen. Click Use Express settings button.

Lab Setup Guide Page 233 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
7. Create an account for this PC screen appears, fill the following details:
o Username: admin
o Password: admin@123
o Hint field need to be filled mandatory, you can fill with the desired hint, and click Next.

8. Windows 10 machine is ready as shown in the screenshot.

Lab Setup Guide Page 234 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
9. Now, check for the system updates and if found any, update the Windows 10 (SIEM2) virtual
machine to the latest.
Note: Installing the updates might take some time.

CT#11.2: Change the Computer Name


1. Right-click Start icon and click on System.

Lab Setup Guide Page 235 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. In the System properties window, click Change settings.

3. In the Computer Name tab of the System Properties window, click Change.

Lab Setup Guide Page 236 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. In the Computer Name field enter SIEM2 and click OK.

5. When prompted to restart the system, click OK.

Lab Setup Guide Page 237 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. You will be returned back to System Properties window, click Close.

7. You will be prompted to restart the system, click Restart Now.

Lab Setup Guide Page 238 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#11.3: Configuring Static IP Address
1. Follow the steps as in the above Configuration Task, CT#8.4, to configure IPv4 address in
the Windows 10 VM with the following values:
 IP Address: 10.10.10.10
 Subnet Mask: 255.255.255.0
 Default Gateway: 10.10.10.2
 Preferred DNS server: 8.8.8.8

CT#11.4: Mapping SOC-Tools Folder from Host Machine to


Windows 10 VM
1. Follow CT#6.4, to share SOC-Tools directory in SIEM1 VM.

CT#11.5: Installing Web Browsers


1. Follow the steps 1 to 4 of CT#6.6, to install web browser.

CT#11.6: Turn Off the Windows Defender Firewall


1. In the Type here to search field present at the lower left corner of the screen, type Control
Panel. A search result containing Control Panel desktop app appears. Click Control Panel.

Lab Setup Guide Page 239 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
2. In the Control Panel window, click System and Security.

3. Click the Windows Defender Firewall in the System and Security window.

Lab Setup Guide Page 240 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
4. In the Windows Defender Firewall window, click Turn Windows Defender Firewall on
or off link in the left-pane of the window.

5. In the Customize Settings window, select Turn off Windows Defender Firewall (not
recommended) radio button for all Domain, Private and Public network settings and click
OK.

Lab Setup Guide Page 241 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
6. Again, in the Windows Defender Firewall window, click Advanced settings link in the left-
pane.

7. Once the Windows Defender Firewall with Advanced Security appears on the screen, click
Windows Defender Firewall Properties link in the Overview section.

Lab Setup Guide Page 242 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
8. When the Windows Defender Firewall with Advanced Security on Local Computer
Properties window appears, in the Domain Profile tab, choose Off from the Firewall state
drop-down list. Then navigate to Private Profile and Public Profile tabs and ensure that the
Firewall state is Off. Click Apply and then click OK.

9. Close all the windows.

Lab Setup Guide Page 243 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#12: Setting Checkpoints of Virtual Machines
1. After installing and configuring all the guest operating systems on virtual machines, set disable
Checkpoints for all these virtual machines.
2. Open Hyper-V Manager right click on a virtual machine and click Settings….

3. Click Checkpoints in left side pane then uncheck the Enable checkpoints check box, click
OK.

4. Perform this action for all the installed virtual machines.

Lab Setup Guide Page 244 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
CT#13: Setting Time Zone of Virtual Machines
1. Navigate to Date and Time Settings to ensure that all virtual machines Time zone
configuration is same.

Lab Setup Guide Page 245 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.
End of the Document

Lab Setup Guide Page 246 Copyright © by EC-Council


All Rights Reserved. Reproduction is Strictly Prohibited.

You might also like