welcome to part one of five for the series on the active directory project the goal of this project is to start from nothing at all to a fully functional domain environment built on Prem you do not want to miss out on this because this will allow you to learn how to install and configure active directory Splunk and windows machines for those who complete this project this is definitely something you can talk about during your interviews just like the other project series that I've done in the past I am sure there will be some errors popping up for some when tackling these labs and if that does happen I would love for you to build up your researching skills and if you are still unable to find the answer leave it in the comment section down below for part one of the series we will be focusing on creating our diagram and mapping out how we want to build out our lab logically along with the hardware requirements now unfortunately if you are using an M1 M2 2 or M3 Mac you would be required to set this up in the cloud using a cloud provider such as vulture or Azure for example since virtualization doesn't play nice if you have a Windows machine you can use Virtual box to set up everything that is what I'll use the main reason why we want to build out our diagram is to help understand how data might flow and how the pieces are strung up together during interviews some would actually provide you with a whiteboard and ask you to create a diagram of a basic lab and hopefully by participating in this project you will have more confidence in doing so to create our diagram I'll be using a site called draw. io as it is free to use and quick to access now one thing to keep in mind is that these diagrams do not need to be pretty you just need to do it and build it out later down the road you can make it look pretty especially if you're presenting this to a client but if it is just a lab environment I'd rather you focus on actually doing it versus spending hours on making it look visually appealing as for the hardware requirements ideally if you have a computer with at least 16 gigs of RAM and 250 gigs of disc space you should be fine anything under you might experience some random issues and your machines might be extremely slow so we'll need to adjust for that over to draw. io we want to search for a server Icon by clicking on the search shapes which we can find right here on the top left corner what we can do is type in server and hit enter and then you can choose whichever icon you want I will select the traditional server over here and drag it and I'll be using two servers so one is going to be for our Splunk and another is for our active directory so I'll just go ahead and right click and hit duplicate and now we got two servers now let's search for computer I'll go ahead and replace server with computer and hit enter and I think this one looks to be okay so I will grab that and drag it over and I will right click and duplicate again now we have two computers one is going to be our Target machine which is a Windows 10 machine and then the other is going to be our attacker machine and I'll color the attacker machine as red and we can do that on the top right corner by selecting the red color so I'll go ahead and do that and now our attacker machine is red this way we know exactly what we're looking at as now we can actually differentiate between the target machine and the attacker machine the last couple icons that I want to use is going to be a switch and a router as well as a cloud to indicate for the internet so let's go ahead and search for switch I'll click on more results to see what other icons exist and I do see this one here L2 switch this one looks pretty good so I'll go ahead and click on that and we'll search for router and this one looks to be pretty good drag this one up and the last one is going to be a cloud so I'll just type in cloud and we can just select the first one perfect now that we have our icons we want to start connecting them together and to do that we can highlight over them and then you will see an arrow up left down right what we can do is click on the arrow and then we can just drag it onto another icon in this case I'm connecting it to the Switch I'll move the computer just a bit that way we have a little bit more space and I don't like the connection here so instead I'm going to connect it like that let's do the same for the attacking machine connect it over to the switch and you might notice that some of the lines are not straight see that there's a little curve there what we can do is just drag it up until it's straight just like that I'll go ahead and move the the servers over let's put them on top of each other then I'll drag it and connect it to the switch now we do the router switch to router and then router to the internet beautiful now there are some couple options that you can do locate it over on the right hand side now if you take a look at our connectors for example this one right here you might notice that there's a little curve and if you don't like that we can actually change the way it looks by clicking on the drop down icon so once I click on it there's an option for a straight line I'll go ahead and select that and now you might notice that the Line is now straight and then we can just move it like this and it doesn't have any of that curving action as we see on the servers in my opinion I like it like this it looks a lot more cleaner so I'll leave it as straight now that we have everything connected I am just going to format it just a little bit that way it looks a little bit nicer and I am going to add in a our Network information so we can just double click anywhere on the screen and select text and I'll type in the domain so the domain that we're going to create I'm going to call it as my dfir as for the network I'll be using a 192.
168. 10. 0 sl24 and our Splunk server is going to have an IP of 192.
168. 10. 10 and our active Direct Dory server is going to have an IP of 192.
168. 10. 0 and lastly our attacker machine is going to have an IP of 192.
168. 1. 2 and just like that we have all of our networking information right here next let's add some data onto our icons so I'll just go ahead and double click an icon and then this server will be our Splunk server so I'll type in Splunk server with the IP of 192.
168 . 10 do10 the second server I will say active directory it will have an IP of 192. 168.
10. 0 it will also have a Splunk Universal forwarder as this will allow us to send data over to our Splunk server we will also have cismon installed that way it can collect Telemetry on this server and again send it over to Splunk the next is our Target machine this is going to be a Windows 10 machine and the IP this is just going to be a DHCP assigned IP it will have a Splunk Universal forward as well and sysmon as for our attacker machine this is going to be Cali Linux with an IP of 192.
