1. On the ControlCenter2 open a new tab in Google Chrome and navigate to your Workspace ONE UEM Console ( https://cn-livefire.awmdm.com )

2. Navigate to Apps & Books > Application > Native and click ADD APPLICATION

3. Click Upload
   1. Then click Choose File and a new window will open, navigate to the Download Folder in the left navigation bar and click on the msi you downloaded in the previous lab.
   2. Click on the you will find the installer.....msi and click Open.
   3. Click SAVE on the final Add page this will upload the application.

4. Click CONTINUEto verify the application file and that it is not a dependency
   1. On the Details tab change the Supported Processor Architecture  to 64-bit
   2. Click on the deployment Options tab of the next page and paste the install parameter from below into the Install Command Field (Replace the existing install command in that field already. Ensure the version of Sensor is correct) (USE THE SEND TOOL ON YOUR HOL CONSOLE TO PASTE THIS AS IS)

msiexec /q /i "installer_vista_win7_win8-64-3.6.0.1719.msi" /L*vx Log.txt COMPANY_CODE=S17NA79RWX!K8OJLXA3

c. Change the Device Restart to "Restart If Required"

d. Click SAVE & ASSIGN

5. On the Update Assignment page click ADD ASSIGNMENT
   1. Now select the your organisation group symbolized by the world icon in the Select Assignment Groups field
   2. Change the App Delivery Method to AUTO
   3. And click ADD at the bottom of the page

6. On the next page click SAVE AND PUBLISH
   1. On the final page click PUBLISH

1. On the ControlCenter2 desktop open the Remote Desktops folder and double click on w10client01.RDP
   1. Type the password: VMware1! when prompted and click OK

2. On the w10client01 VM right click the Windows Icon and click System

3. In the About Page in Settings click Rename this PC

4. Change the Computer name to the unique identifier given by the Instructor - for example Attendee102
   1. Click Next,

5. Click on the Network icon in the task tray in the bottom right.
   1. Click Network & Internet settings in the pop up window

6. On the Settings Page click Change Connection properties.

7. Click Edit to change the IPv4 Address.

8. On the Edit IP settings,
   1. edit the IP address to 192.168.110.XXX example if you Assignment is Attendee101 the IP should end in 101.
   2. Click Save and you will be disconnected from the Remote Session

9. Navigate back to the Remote Desktops folder on the desktop of the ControlCenter2 VM
   1. Right-Click on the W10Client01.RDP and click Edit

10. Change the Computer name in the RDP Connection to your unique ip Address 192.168.110.xxx (Example 192.168.110.102)
    1. Click Connect on the page

11. Once connected again, right click Start > Shut down or sign out >  click Restart which will change the hostname to AttendeeXXX.euc-livefire.com

12. Click Back into the Remote Desktop Folder on the Desktop and edit the W10Client01.RDP.
    1. Change it to the new hostname you have assigned the vm. (Example: attendee102.euc-livefire.com)
    2. Click Save and then Connect. Check if RDP to the AttendeeXXX.euc-livefire.com VM from the ControlCenter2 is working

1. On the ControlCenter2 machine,

1. Sign in to cn-livefire.awmdm.com if you aren't already signed into the UEM console and navigate Devices > List View and select your device and browse to the Apps Tab.
2. Make sure the Carbon Black Cloud Sensor 64-bit has a green Check box next to it.

2. On the ControlCenter2 open the Carbon Black Cloud console.
   1. Open a browser and navigate to https://defense-prod05.conferdeploy.net/
   2. Sign in with your e-mail address and password set in the previous exercise.

3. In the Carbon Black Cloud console navigate to ENDPOINTS in the left hand navigation and identify your Device with the computer name that you set. (i.e. AttendeeXXX)
   1. Click on the Check Box next to the Status
   2. Click Take Action and click Change policy

4. Now select Zero Trust LiveFire from the dopdown and click Change. (NOTE: Ensure you have the selection set to 'Update the 1 selected devices'.
5. This will change the Endpoint policy to Zero Trust Livefire Policy. Lets look at what exactly this policy is enforcing on our endpoints.

6. From the left navigation panel, Navigate to ENFORCE > Policies

7. Under the list of available policies, click on Zero Trust Livefire Policy.

8. Click on the Prevention tab.

9. Under Permissions, you will notice, an application C:\Program Files\dfndr.exe is set to bypass for any operation. (You can expand it by Expand Permissions by clicking on the + Sign. )

10. Next, under the Blocking and Isolation Rule,

Notice it list down all the processes, their operation attempt and the actions this policy will take to prevent any attack. In our policy example, we have added NOTEPAD++.exe as an blacklisted application we want to TERMINATE if it is running or attempts to run.

You have successfully completed this section. Please proceed to the next section.

1. Add an API Key
   1. Navigate to Settings and API Keys (API  Access) on the left hand navigation pane.
   2. Click Add API Key at the top right hand

2. Enter the below information,
   1. Name the API key your unique attendee Identifier. EXAMPLE: Attendee101
   2. Select SIEM in the Access Level
   3. Click Save at the bottom of the window.

3. You will now be shown the API Credentials.
   1. Copy both the API ID and the API Secret Key to Notepad.
   2. Close out of the API Credentials windows by clicking X

4. In the left hand navigation panel,
   1. Navigate to Settings > Notifications
   2. Click + Add Notification

5. Enter the below information,
   1. Give the Notification policy your unique identifier as a name, for example: Attendee101
   2. Then put a check in the Threat and Observed tick boxes and lower the alert severity to 1
   3. At the bottom under API Keys find the SIEM Api key you just created. It should be your unique identifier. (example: Attendee101)
   4. Click Add to create the notification end point

1. Open the Workspace ONE UEM console,
   1. Open the Chrome browser on the ControlCenter2 VM and navigate to https://cn-livefire.awmdm.com. (if not already open)
   2. Sign in using your admin credentials (E-mail used to attend the course)
   3. In the top right corner click on the 9 squares forming a square and click Workspace ONE Intelligence

2. On the landing page for Workspace ONE Intelligence click Integrations from the top navigation bar.

3. Click on SET UP in the Carbon Black connector

4. Expand the Provide Credentials dropdown. Fill in the following information

Base URL: https://api-prod05.conferdeploy.net

API Key: ULRWHUK27YECTWV5497WVGS6

SIEM Key: paste SIEM Key from Notepad. (This is the same API Credentials you the key you created in Carbon Black console.)

API Connector ID: EMDZ52ZLL3

SIEM Connector ID: paste SIEM Connector ID from Notepad. (This is the same API Credentials you the key you created in Carbon Black console.)

Click AUTHORIZE to authorize the Carbon Black Connector

1. In the WorkspaceONE Intelligence Console navigate to Dashboard > My Dashboards
   1. Click ADD DASHBOARD

2. Name the Dashboard Carbon Black and click SAVE

3. Click ADD WIDGET

4. In the first "Add Widget" screen select Custom Widget and click START
   1. From the Select widget template select Carbon Black > Carbon Black Threats

5. In the Add Widget screen,
   1. Set a name for the Widget such as Low & Medium Severity
   2. Under Data Visualization > Chart Type, Select TABLE.
   3. Fill in the following fields:

Measure: Count of Carbon Black Device ID. (Choose from drop down)

Group by: Carbon Black Device Email, Carbon Black External IP Address, Carbon Black Incident ID (ADD SUBGROUP and then choose from drop down)

6. Under Filter,

In the first field select Threat > Threat Attribute > Threat Severity

In the second drop down set Equals

In the third drop down write Medium.  

Click SAVE at the bottom of the page. 

You will have to SAVE your My Dashboards from top right again for the widget to show up in your dashboard.

We now will create an automation from the widget we have just created.

1. In the Carbon Black Dashboard, find the widget you have just created and select the more options icon (three horizontal dots).

a. Then click Automate

2. Give the automation the title: Tag Malware Device & Notify Admin

3. Scroll down the Action (Then)
   1. Click the + icon
   2. Click Workspace ONE UEM from the Available Connectors
   3. Click Add Tag to Device

4. Type 10003 as the Tag - Which sets the Tag  "Quarantine" on the device

5. Now customize your email action using the following information,

To Address: your e-mail address

Subject: Malware detected

Message : (USE THE LOOKUP OPTION TO POPULATE THE BELOW INFORMATION OR MANUALLY TYPE IT IN)

DEVICE ID - ${deviceinfo_uemid}

DEVICE NAME - ${deviceinfo_devicename}

Threat - ${_threat_family}

Threat Severity - ${_threat_severity}

Threat Time - ${eventtime}

Platform - ${_device_platform}

6. Click Enable workflow
   1. and click SAVE at the bottom right corner.

7. On the pop-up windows click SAVE & ENABLE

We will now create an incident. As we don't have the means to infect this vm with malware we will use Notepad++ as an example of a malicious application.

1. On the ControlCenter2 open the Remote Desktop folder and connect to your W10client01 virtual machine with your new hostname.

2. On the Desktop double click on Notepad++

3. Windows will not allow this application to run with following message above.

Additionally you might get a pop-up from the Carbon Black Cloud Sensor to notify you of this incident.

1. Log into the Carbon Black Cloud Admin console. 
   1. Navigate to Alerts from the left menu bar.
   2. Under FILTERS menu, expand DEVICE and select your endpoint i.e. AttendeeXXX. 
   3. Observe the Status of  Alert as a Deny Policy Action and it has an Alert Severity 3. 

2. Switch to the Workspace ONE intelligence console. If you have not logged in or are signed out. Login to cn-livefire.awmdm.com with your admin credentials.
   1. Navigate to Monitoring > Intelligence.
   2. Click Launch.  

3. In the WorkspaceONE Intelligence Console,
   1. click Automations
   2. Then select your VIEW on your CarbonBlack automation
   3. Then navigate the Activity tab you should see the events, the tag being assigned and the e-mail being sent to the admin.

4. Inside the WorkspaceONE UEM console,
   1. Navigate to Devices > List View
   2. You will notice the enrolled device has the QUARANTINE tag assigned to it

5. Now navigate to your e-mail and notice you have an e-mail from AirWatch that has the information for the device that has been compromised.