From 7d77f40e44c42f96c2b560a36f535ac8b4e92b1c Mon Sep 17 00:00:00 2001 From: Chris Long Date: Sun, 6 Jun 2021 17:01:16 -0700 Subject: [PATCH 1/2] Update Vagrantfile --- Vagrant/Exchange/Vagrantfile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Vagrant/Exchange/Vagrantfile b/Vagrant/Exchange/Vagrantfile index ff79204..3bb44e5 100644 --- a/Vagrant/Exchange/Vagrantfile +++ b/Vagrant/Exchange/Vagrantfile @@ -23,10 +23,9 @@ Vagrant.configure("2") do |config| cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: false cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: false cfg.vm.provision "shell", path: "scripts/install-velociraptor.ps1", privileged: false - cfg.vm.provision "shell", path: "scripts/install-exchange.ps1", privileged: false + cfg.vm.provision "shell", path: "scripts/install-exchange.ps1", privileged: true cfg.vm.provision "reload" - # Uncomment the line below once the commands in install-exchange.ps1 have been properly worked out - #cfg.vm.provision "shell", path: "scripts/install-exchange.ps1", privileged: false + cfg.vm.provision "shell", path: "scripts/install-exchange.ps1", privileged: false cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: false cfg.vm.provision "shell", inline: 'cscript c:\windows\system32\slmgr.vbs /dlv', privileged: false From 7368b6c805ee90de6764fe762adf511bf87efbb8 Mon Sep 17 00:00:00 2001 From: Ben Reardon <45679313+benjeems@users.noreply.github.com> Date: Tue, 8 Jun 2021 16:48:35 +1000 Subject: [PATCH 2/2] ignoring checksums in Zeek as per https://github.com/clong/DetectionLab/issues/661 --- Vagrant/logger_bootstrap.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Vagrant/logger_bootstrap.sh b/Vagrant/logger_bootstrap.sh index fe425cb..b0a0ab5 100644 --- a/Vagrant/logger_bootstrap.sh +++ b/Vagrant/logger_bootstrap.sh @@ -372,6 +372,9 @@ install_zeek() { redef Intel::read_files += { "/opt/zeek/etc/intel.dat" }; + + redef ignore_checksums = T; + ' >>/opt/zeek/share/zeek/site/local.zeek # Configure Zeek