topic Re: Threat Emulation VM Access in Firewall and Security Management

Threat Emulation VM Access

G_W_Albrecht — Mon, 28 May 2018 10:08:59 GMT

When i attended the CP Advanced Troubleshooting for Threat Prevention training i did learn a couple of details that at the time were not yet documented. The situation has changed, but still there is material missing from documentation.

As sometimes only one special VM seems not able to finish emulation, it may be valuable to have a look at the emulation process in the VM itself. This can easily be accomplished, as for debugging issues with Virtual Machines it is possible to connect via VNC to the machines while running. First we have to enable VNC access with:

# tecli d e e

You then can see the VNC port of the relevant machine in the synopsis view:

# tecli s e v s

And now you can connect to all (running) VMs ! This is not something you would do on a regular basis, as mostly TE does not take long, but as a troubleshooting procedure it does coma very handy...

Re: Threat Emulation VM Access

Thomas_Werner — Mon, 18 Jun 2018 12:10:57 GMT

Be sure that the port number you connect to is 590x.

Where x is the number shown in tecli s e v s.

Also keep in mind to open relevant firewall ports in between.

So from the example above you would connect to the second running VM with TightVNC to:

192.168.200.10:5901

Be sure to use TightVNC.

Also remember that clicking/typing or doing any other action inside the VM will count as "behaviour". So you might alter the result by accidently clicking things 🙂

Regards Thomas

Re: Threat Emulation VM Access

Mlinko — Wed, 25 Oct 2023 12:52:49 GMT

Hi all,

is there a possibility to "connect" the "tecli d e e" or "tecli s s e" commands with grafana so we can show it virtualy?

Any lead would be great!

KR
Rok

Re: Threat Emulation VM Access

G_W_Albrecht — Wed, 25 Oct 2023 13:30:05 GMT

What is the use here ? To look inside, you need a SSH connection to the TE GW. Otherwise, these commands are useless, especially the first one which does enable VNC access 8)