Kali Purple Essential Training

Course details

Kali Purple is the latest addition to the Kali Linux ecosystem. Designed specifically for cybersecurity professionals and ethical hackers tasked with implementing defensive security strategies, the innovative extension to the renowned Kali Linux platform helps to address the needs of a diverse user audience by leveraging the principles of the NIST Cybersecurity Framework.

In this course, join instructor Malcolm Shore as he provides an introduction to the range of open-source tools supported on the Kali Purple cyber defense platform. Explore the tools provided in the application menu aligning to the five NIST Cybersecurity Framework categories: Identify, Protect, Detect, Respond, and Recover. Malcolm shows you how to install and use some of the additional tools, and covers the deployment of the Kali Purple software as a cyber range tool on a mini-PC (NUC).

Concepts

0. Introduction

01 - Learning how to use Kali Purple
02 - What you should know
03 - Disclaimer

1. Building a Cyber Range

04 - Introduction to Kali Purple
05 - Introduction to virtualization
06 - Virtualization using Proxmox
07 - A first look at Proxmox
08 - Installing Kali Linux
09 - A quick tour of Kali Linux
10 - Installing the Kali Purple workstation
11 - A quick tour of Kali Purple
12 - A first look at the Kali Purple servers
13 - Creating a Kali Purple server template

2. Proxy IDS

14 - Setting up NGINX as a proxy server
15 - Adding Suricata IDS to the proxy
16 - Setting up a public web server
17 - Creating a Linux application server
18 - Creating a Windows application server
19 - Installing the juice shop
20 - Installing virtual machines in the lab
21 - Using kali-autopilot to generate attack scripts
22 - Running an attack on autopilot

3. Vulnerabilty Scanning

23 - Web scanning with ZAP
24 - Installing GVM
25 - Running a vulnerabilitty scan with GVM

4. Security Monitoring with ELK

26 - Installing the ELKStack SIEM
27 - Upgrading Kibana to HTTPS
28 - Configuring log integrations
29 - Installing the Fleet server
30 - Enrolling hosts into the Fleet server
31 - Enhancing our logs
32 - Detecting reconnaissance with ELKStack
33 - Detecting exploitation with ELKStack
34 - Monitoring alerts with ELKStack

5. Security Monitoring with Wazuh

35 - Installing the Wazuh SIEM
36 - Installing a Wazuh Linux agent
37 - Installing a Wazuh Windows agent
38 - Collecting NGINX logs in Wazuh
39 - Monitoring an attack with Wazuh
40 - Detecting webshells with Wazuh
41 - Activating vulnerability scanning

6. Threat Hunting

42 - Understanding Malcolm for threat hunting
43 - Installing Malcolm
44 - A tour of Cyberville with Malcolm
45 - Threat hunting with Malcolm
46 - Deep diving with Malcolm's Arkime

7. Threat Intelligence

47 - Exchanging threat intelligence
48 - Installing OpenTaxii
49 - Working with the cabby client library
50 - Installing the OpenCTI threat intelligence system
51 - Working with the OpenCTI threat intelligence system

8. Incident Response

52 - Installing Velociraptor
53 - Connecting Linux hosts to Velociraptor
54 - Connecting Windows hosts to Velociraptor
55 - Running commands remotely from Velociraptor
56 - Accessing client files with VFS
57 - Hunting with Velociraptor

Conclusion

58 - Next steps