Cybersecurity Detection Lab - Detection Lab Installation walkthrough

[@rubenolguin2180]

Found your channel from I.T. Security Labs live steam. New to cybersecurity and love this type of content... New sub

[@bteeinfosec]

Thanks Ruben

[@MultiMooly]

Thanks a lot, really helpful.

[@bteeinfosec]

Thanks for the feedback

[@vinyldown8490]

thanks for the video, really useful!

[@bteeinfosec]

Thanks for the feedback Vinyl.

[@ahmmadhossain5981]

Thank you for your video

[@baderalmutairi9652]

Hello there, I need this detection Lab for my university project so please I would love some help. Everytime I download the DC I it pauses when reaching chocolatey downloads. I really really need help and I would love to pay for a session to just do the setup as I need it for my dissertation project

[@bteeinfosec]

Hello Bader, thank you for taking the time to watch my video. Please can you share the error you are getting and il see how to guide you. Thank you.

[@joeman5050]

When running the script ".\prepare.ps1" I am getting the error "[!] You need to install a provider such as VirtualBox or VMware Workstation to continue." I do have VMware 16 installed on my PC. Not sure how to move get passed this error.

[@gentjanthemeli5548]

I just started watching this video, what are the PC/ RAM requirements to set up this lab ?

[@bteeinfosec]

Hello Gentjan, Thank you for taking your time to watch our video. Deploy DetectionLab to your local machine with the following prerequisites - Windows, Linux, and MacOS are all supported - 55GB+ of free disk space (Hard drive) - 16GB+ of RAM is highly recommended, If you have less than 16GB, your laptop/PC would struggle running all VM's at the same time. Please let me know if you have more questions and please subscribe.

[@tobbybunde5230]

Hi thanks for the video, however both splunk, fleet and volocipratore are showwimg the below error. "was unreachable and may not have installed correctly". Any advise on how to go about it

[@bteeinfosec]

Hello Tobby, Sorry for the late response. The error you're seeing is because your logger was not properly installed. The logger consists of Splunk Enterprise, Fleet osquery Manager, Zeek, Suricata, Guacamole and Velociraptor server. If vagrant script failed to run properly, you would get errors. Il recommend destroying your logger using the command "vagrant destroy -f logger; vagrant up logger" OR "vagrant destroy -f logger, restart your host machine and run the command "vagrant up logger" again to reinstall your logger VM. Another option is to try the following troubleshooting steps in this link "detectionlab.network/deployment/troubleshooting/". Hopefully that helps with the issue you are facing.

[@Luminexidone]

When running the Vagrant logger command I get this: "The external program used to read TCP/IP routing tables in order to protect you against creating network collisions could not be found. On Linux and Mac OS X, this is `netstat`. Please make sure this is on your PATH. It is generally installed with your operating system." I'm running VMWare on Windows

[@bteeinfosec]

Hi @Aznkhmyboy. Thanks for watching my video. The github for this project is no longer maintained and has not been updated since January 2022, so there are prone to be errors. Some of them could be resolved manually. Could you share the screenshot of the error you got to [e-mail]. i can check it and see if it's something i can give you a workaround. Thanks.

[@xXKamigawaXx]

Hi bro. No agents have been installed. Splunk, Fleet, Velociptor, I can't find any hosts you can help me?

[@bteeinfosec]

Hello Pedro, Thanks for watching my video. Please like and subscribe. Regarding your question, Your Logger most likely did not install correctly. Il recommend destroying it using the vagrant destroy command (Check the end of the video on how to destroy VM's) and rerun the vagrant up logger again. This would save you from manually troubleshooting each application installed on your Ubuntu Logger machine. Hope this helps.

[@CAP.9350]

Where can I find the same follow through for de Azure environment?

[@bteeinfosec]

Hello Cesar A. thanks for taking your time to watch my video. I haven't tried installing it on Azure, but il try and make a video on it.

[@kostralian]

Good video. Is there a way we can automate the whole process of building the lab locally?

[@bteeinfosec]

Thanks for the feedback Coolang. Please can you explain what you mean by building the lab locally? Do you mean on a Virtual machines or Hardware. This was built on an on prem VMware Work Station.

[@kostralian]

@@bteeinfosec Hi Btee, I wonder if we can build the lab locally and automatically using some tools like Ansible

[@danjoe5733]

Thanks for this expository simplified tutorial .... one of the best . however , i keep getting this error " "Unable to connect to the remote server" [!] Velociraptor was unreachable and may not have installed correctly. " pls help

[@bteeinfosec]

Thanks so much Dan for your awesome feedback. In regards to the error you got, I believe you got this after running the ".\post_build_checks.ps1" script correct? Check if you can access velociraptor using the link " 192.168.56.105:9999" as a first step in troubleshooting. If you can't reach it, there was most likely a problem during the vagrant installation of logger. Other software and services, such as Splunk and Microsoft ATA, should be tested. If they're all up and running and you require Velociraptor in your lab, you'll have to manually reinstall it on your logger or destroy the logger VM using the vagrant destroy -f logger and rerun your vagrant up logger command again. If you do not require Velociraptor in your Lab, other software should work properly without it. Let me know if you have further questions.

[@wunderjoseph1136]

Hello broo ... can you gie me some help here ... i watched your video on youtube , am having issues installing Detectlab. The win10 is showing Disk read Error, every other thing seems to be working well ... only the WIN10 is showing DISK READ Error am installing it on my external DISK and i have enough space there.. but on my main system disk my free space is around 35GB,,,, could that be the issue ? please kindly help

[@bteeinfosec]

Hello Wunder, Sorry for the late response. Thank you for watching my video. Please can you post the error you are facing on the comment section, so I can see how to help. Thanks.

[@Zinki-g2c]

VERY NICE VIDEO

[@bteeinfosec]

Thanks for the feedback Kamel

[@jasonrobertcheney]

How many times did you have to install? I installed 3 times and all with errors?

[@bteeinfosec]

Hello Jason. Thanks for watching my video. I have installed and destroyed it multiple times and it still works for me. Sometimes you may need to do some manual troubleshooting though.

[@FadeLight-ud2sl]

[@ion_q]

6TB SSD RAID with 64GB DDR4 will be good yes

[@femidaramola1906]

Hi, thanks for the video. I have watch it more than 15 times, and i couldnt still fix my issue. When I run "Vagrant up" it gave me the following error. PLEASE HELP ME. WHAT CAN I DO. I HAVE SEARCH THE WHOLE INTERNET FOR SOLUTION, NOTHING WORKS There was an error while executing `VBoxManage`, a CLI used by Vagrant for controlling VirtualBox. The command and stderr is shown below. Command: ["startvm", "588d0250-fdea-4328-b328-8d03440dbcff", "--type", "gui"] Stderr: VBoxManage: error: VT-x is not available (VERR_VMX_NO_VMX) VBoxManage: error: Details: code NS_ERROR_FAILURE (0x80004005), component ConsoleWrap, interface IConsol

[@bteeinfosec]

Hello Femi, Thank you for watching my video. I reviewed the error you included to your comment. Although I did not try to install it on virtual box, but only on VMware, based on my research, there appears to be a compatibility issue with your vagrant and virtualbox. Try this few steps.. - Try updating your virtual box and try it again - If possible, try uninstalling your virtualbox and reinstalling it again, then try the "vagrant up" command. - There maybe multiple versions of virtualbox installed on your machine, try checking the versions running on you VM. - Not sure what operating system your virtualbox is installed on but you can check this link I added below, multiple people faced the same problems on multiple operating systems with virtual box using the "vagrant up" command and they also added what resolved the problem "github.com/hashicorp/vagrant/issues/8687" Let me know if this helps. Thank you.