A fiery horse with a speed of light, a cloud of dust, and a hearty hyo silver, the Lone Ranger. With his faithful Indian companion, Toto, the daring and resourceful masked writer of the plains led the fight for law and order in the early western United States. Nowhere in the pages of history can one find the greater champion of justice. Return with us now to those thrilling days of yesteryear. From out of the past come the thundering hoof beats of the great horse, Silver. The Lone Ranger rides again. The Tennessee kid was young and gentle in appearance with an innocent expression and ready smile that belied his true character. People accepted him at face value and even hard suspicious natured veteran pioneers of the West were surprised and shocked when they became his victims and they never forgot the mirthless laughter that signaled the departure of the Tennessee kid and his gang with their loot. The shock was always greater because the Tennessee kid with his easy friendly drawl always laid the ground work alone before his gang moved in.  I reckon someday I'll go back to Tennessee with my pockets bulging with drool. Yes sir, I'll buy the best coaching for in Nashville and have all the ladies fighting for my attention. Well, yes me, a handsome young fellow like you don't need a coaching for to attract the young ladies, huh? But for your sake, I hope you do make your fortune. Well, now that's mighty nice of you to say sir. The train's stopping. Must be something wrong. Hold up!  Reach all of you! The first one to make some move gets a bullet. The young fellow has guns on us.  I see you got them under control, Tennessee. I reckon I have. You and Dave go through the car and gather up the valuables. I'll keep them covered. I can't believe it.  All of you look plenty surprised all right. I'm on the way to getting that fortune I told you about, mister. Hurry up, Sam. Others will be waiting. This won't take long. I won't let you take my wallet. Sorry, you asked for this, mister. The Tennessee kid, that's me. And two weeks later, much farther south, a stagecoach rolled along the trail between Benton and Colton. You were a lucky young fellow to get on this stage. It turned down a couple of other men who wanted to make the trip. Gosh, did they? I guess I am lucky then. But how come the others were turned down, Sam? It couldn't take any chances, son. As you know, I'm a deputy sheriff. Riding this stage is an extra guard for an express shipment they got up top. I gave orders not to sell seats to anyone. But when you come in asking, I could see right away you was all right. Charlie, I'm sure glad you think so, sir. You look mighty young and inexperienced to be traveling around alone. Just how old are you? I'm 21, but folks always think I'm younger than that. You sure look younger. I reckon you find the West pretty rough for a nice friendly young chap like you. But then you have an easy way of getting along with people and maybe...  Hold it, mister. I've got a gun on it for you. You mean that you're... Tennessee kid, that's me. Sure surprised you did not. It was many miles to the southwest in Goldville that the Tennessee kid was again laying the way for another holdup as he gained the attention of the men in the cafe. I'd sure like to settle in a town like this where folks are so friendly and all. I've seen them when they weren't inclined to be friendly, son. But you just naturally got away making folks like him. I reckon you get along fine here if you do settle in Goldville. Most young bucks come here trying to act tough. They swagger and boast like all get out.  Gosh, y'all make me feel right at home. Great day outlaws. Give me a lift, boys. Reach all here. Reach us, head. Hey, the boy drove on a stretch. He don't mean what he said. I mean it all right. Line up over there so as my gang can get your wallet. What's the meaning of this? Who are you anyway? Just a friendly young hombre trying to make a living, mister. And I'll let all my friends call me the Tennessee Kid. A week later, far to the south, the lone ranger and his Indian companion Tuttle rode the trail toward the town of Redgap. There's been a rumor of unrest among the Indians down this way, Tuttle. Ah, we go to the mission visit the Padre. He can tell us if there's anything to the rumor. A Padre good friend to Indians. They'll tell truth to him. Yes, I know. We'll soon be close to Redgap. We'll pitch camp for the night and lay in a few more supplies. The morning we'll push on to the mission. Ah, we help make camp in Hills and we ride to town for supplies. Good enough. Let's hurry a bit so we can pitch camp before dark. Come on, Tuttle. The lone ranger and Tuttle picked out a suitable spot for a camp. Then, while they made the necessary camping preparations, a pair of evil BDIs watched them from a nearby hiding place. It was shortly after Tuttle left the camp for town that a renegade Indian rode his pony into an arroyo about a quarter of a mile away, where several men were waiting. Well, read what you find out. Them camp for night in clear, short way down trail near Crick. Indian leave. Ride trail, let go to town. Mask man, him stay in camp. Me come tell him Tennessee kid pronto. You're certainly didn't get wise that you were watching. Ah, me careful. Go on site where wind blow from them to me, then horses not give sign. The rest of the boys are wondering why we had to go out our way to trail them too. After Bre told you they were riding down this way, Tennessee. Tennessee knows what he's doing, Dave. Maybe so. You know what it's all about, Sam. The rest of us don't. Well, I reckon I can tell you, Dave, so as you and the others won't be fretting. Ever hear of an hombre called the loan ranger? Yeah, sure. He's on the side of the law. Where's the mask? Can he write? Holy mackerel. Is that who it is? Yeah. I'll figure he doesn't know about me and the gang yet. But Bre found out that the sheriff of Goldville sent a message to the mission south of here. Asking the pod red to get word to the mask man about me and the gang. We better get away from here then. The father of the bed. Nope. I aim to meet that hombre before he gets to hear about me. So as I can catch him off God like I do everybody else. Holy smoke. You sure got plenty of nerve, Tennessee. Well, now that's downright nice of you to think so, Dave. But I don't need nerve. I just look at him with my boyish grin. They think I'm a quiver. Look, uh, how and when are you figuring on meeting that mask, Comrade? I reckon there's no time like the present. Let's join others and I'll tell you just what we're going to do. Come on. Half an hour later, the lone ranger was busy fixing part of his riding gear while it was still light enough to see. At the sound of approaching hopes, he stood quickly with drawn gun. Hold it. Mister, I wonder if you... Holy smoke and outlaw. Look, mister, you got the drop on me. I know I... I'll be on my way. I'm not an outlaw. Yeah, but that mask... Forget the mask. Why did you come here? Well, I wanted to find out if I was on the right trail of Red Gap. I saw the smoke from your campfire, so I rode over here to ask. Gosh, I'm sorry if I... Well, that's all right. Guess I won't need this gun. I reckon I can relax now that you put it away. Yes, of course. Well, to get to Red Gap, turn left when you go out from here to the trail. Town isn't very far. Thanks a lot, mister. Say, you don't seem to have much experience in the West. The way you ride into a strange camp without being alert for possible gunplay, it's a risky thing to do, my friend. Gosh, I... I reckon I just didn't think much about it. Easy, Silver. See, that's your mighty fine-looking stallion, mister. Why do you reckon he's acting up like that? I don't know yet. For a moment, the masked man stared at Silver, who was ground hitched off to one side. The great horse stood with ears pointed, looking at the woods that bordered the back of the campsite. Silver had heard stealthy sounds, too faint for human hearing, and at the same time, he caught the scent of men. He knew danger lurked in the woods and was warning his master. Once more, he tossed his head and whinnied.  Could be. The lone ranger had partly turned from Tennessee and thinking he saw a slight movement behind one of the trees, he moved his head to go for one of his guns when Tennessee spoke sharply behind him. Don't move, mister. Just reach. If you think you might pull a fast one, I'll tell you there's a couple of tough armors behind the trees back there covering you. Yes, I can see they're glint at their guns now. I was taken in by that innocent-looking face of yours. Yeah, everyone is. Breed, Dave, come on, close in on them. A couple of your gang, huh? Easy. That's right, mister. And four more waiting close by. I kind of figured you were heading for the mission. The Padre has a message telling about us. The Tennessee kid in his gang. The Tennessee kid, huh? I'll remember the name and the face. Listen to him, boys, saying he'll remember. It won't do him any good if it does.  Ah, not have so much talk. I'll take it easy, both of you. I've got other plans. What do you got on your mind, Tennessee? We'll tie him up and take him to the royal where the others are waiting. What for? Get it over with now. I'll figure his Indian Frontal Trailers there and then we'll jump him too. Then we'll have them both. Then what? Then you and the others can use them for target practice. Breed, go back into woods and bring your horse and Dave's here. Ah, may not be going long.  I reckon it's safe enough for me to take his guns away from him, huh? Walk up alongside of him, Tennessee. Pull that mask off. Want to see his face. Yeah, but be careful. From what I've heard, he's plenty clever and tricky. Maybe so. But it wasn't clever enough to keep me from tricking him a while ago. And don't forget, Dave, the Tennessee kid has a reputation for being mighty clever too. Yeah, I gotta admit things worked out like you expected there were, Tennessee.  Go ahead, get his gun. I'm even to Dave, but first I'm going to take that mask off the famous Lone Ranger. The curtain falls on the first act of our Lone Ranger story. Before the next exciting scenes, please permit us to pause for just a few moments to continue our story. As the young outlaw chief brazenly strode to his side, the Lone Ranger who stood holding his hands over his head, tensed inwardly, then as the Tennessee kid reached up to yank the mask away, the masked man with a lightning move went into action. No, you don't! One hand descended on the back of Tennessee's neck, while the other grabbed the outlaw's arm, twisting it behind his back. At the same time, the Lone Ranger swung the outlaw in front of him and dropping the hand from Tennessee's neck. He planted a gun in the outlaw's back. No, no, let go! Hey, pull the fast one. I'll hit you if I shoot Tennessee. Tell your friend to toss his gun at that aroy over there. Throw your gun into the aroy. He's got a gun at my back. Ah, I guess I have to. There it goes. Here's silver. I'll show you a gun over there to Tennessee. I'll walk toward your friend. I'll tie you both with my lariat, then I'm taking you to the sheriff. Come along, silver. Momentarily, the Lone Ranger had forgotten about the breed who had gone to get the outlaw's horses in the woods. As he walked Tennessee toward Dave with silver walking just behind him, the Lone Ranger caught a glimpse of the half-breed coming through the trees. He knew he could handle the breed, but at the same moment, he heard the beat of many hoofs. Justice Silver gave a loud whinny of warning. The others are coming. They got tired waiting. The Lone Ranger realized that the situation would soon become more than he could handle, swinging around to silver just behind him. He hurriedly mounted, and as Tennessee and Dave shouted to the other outlaw, the Lone Ranger urged silver at a gallop toward the nearby aroy. The outlaws came into view, Justice Silver carried the Lone Ranger into the aroy. After escaping from the Tennessee kids' gang, the Lone Ranger rolled at a fast pace toward town. Soon, he realized that they were not following, and pulled silver into a slower pace. Twilight was falling as he rounded the bend and saw a cloud of dust coming up the trail that indicated a horseman riding fast. The Lone Ranger turned off the trail behind a group of boulders. Oh, Silver, oh, must be Toto. Yes, it is Toto. Toto, wait! Come on, Silver. Oh, Silver, oh. King was happy. Why you not waited camp? The gang of outlaws headed by a fellow call the Tennessee kid came to the camp, Toto. They got the drop on me, but I managed to trick them and got away. It was a close call. Oh, and what we do, King was happy. They leave our campsite and try to cover their trail. I'll go back and follow them alone, Toto, but this time I'll be on guard. And what me do? Go back to Red Gap.   Make it as fast as you can, Toto. You be careful, King was happy. Adios. Adios. Get him up, scoundrel! Oh, Silver! After the Lone Ranger escaped from the gang, Tennessee called them together for a conference. It's no use following a mass man. He headed toward town. He's got a fast stallion. For a minute, I thought we were done for. He moves quicker than any hombre I ever saw. I was counting on Breed coming back with the horses. Now I reckon the mass man sort of forgot about Breed while he was trying to think what to do with us. Hey, what are we going to do now, Tennessee? Yeah, he's in the size of the law, you know. Best thing for us to do is to head away from here, pronto, and keep traveling, covering our trail every chance we get. Maybe if we go far enough away from here, we'll throw that Indian and the mass comrade off our tracks for good. That's it.  Now listen to me. Why do you think I showed our hand and tried to get that Indian in the Lone Ranger? I'll tell you why. Because I knew that once they heard about this gang, they wouldn't give up until they got every last one of us. Mass man never give up. Now we'll fix him without wasting any time. We'll ride directly to the hideout. We'll cross the gorge over the Red Gap Bridge. That's where the stagecoach crossed, and it's strong and wide enough for a body of horsemen to ride on. Then what? We've got plenty of blast and powder at the shack. We'll fasten a keg of that powder under the bridge. Attach your fuse long enough to reach the big boulder just on the other side. Do you mean blow up the bridge to delay him from getting across? No, that wouldn't stop him for long. We'll wait until the Lone Ranger comes along with the Indian, or with any others he might bring. As they start under the bridge, I'll light the fuse. The explosion should take place when they're about halfway over. All right, let's get going, fellas. The Lone Ranger rode back toward the camp to take up the trail of the outlaw gang. He held Silver to an easy gate so that he could be on the alert for an ambush. He found the campsite deserted and had no difficulty picking up the trail. As he followed the outlaws trail, the Lone Ranger noticed that they made no effort to cover their tracks, but had openly ridden along the stage trail. In about half an hour, he approached the bridge across the gorge. Pulling off the trail into a clump of cottonwoods, he reigned to a halt. All right, wait here, big fella. I'll be back before tunnel comes along with the posse. The Lone Ranger moved on foot to the edge of the clump of trees, to a point from which he could inspect the gorge. His suspicion had been aroused by the open trail left by the outlaws, and he decided that they expected to be followed, and would perhaps wait somewhere in ambush. The twilight had deepened, and in the gorge itself, the shadows were spread like a dark cloak, so that it wasn't possible to see anything or anyone down there. For a few moments, the masked man stared keenly at the big boulders beyond the bridge. Then silently deciding to be on guard when approaching them, he turned and went back to Silver. As he reached Silver's side, he heard approaching hoofbeats. That must be the posse coming with Tonto. I'll mount be ready to meet them easy, big fella. Yes, that's Tonto all right. Come on, Silver. A hymn friend who sent for posse. Howdy, mister. Howdy. Tonto told me about that, man, so we'll forget about it. He says you had a run-in with the Tennessee Kid and his gang. That's right. They've left a plain trail along here, too plain. I expect them to wait somewhere in ambush. Then you think the Tennessee Kid is smart enough to know they'll be trailed? Yes, of course. Now, there are some big boulders just across the bridge ahead. After approaching them cautiously, they might be waiting there. We'll have our guns ready. I reckon they figured it'll soon be dark and they can ride all night. Maybe, but there'll be a full moon. They continue to leave an open trail. We can still go after them. That's right. We'll keep that along with you, miss man. Let's get going. Yes, and after we cross the bridge, watch those big boulders. Come on, Silver. In a few moments, the lone ranger and Tonto with the posse rode onto the bridge and started across. The lone ranger once more eyed the boulders beyond. Suddenly, his quick eye caught something the others didn't seem to notice. A slight flare of a lighted match near the ground at the end of one of the boulders. Then a small faint whisp of smoke moved from the boulder along the ground toward the bridge. Even as the masked man realized what it was, a lone horseman galloped from behind the distant boulders and headed around a bend in the trail beyond. Look, man going horse behind boulder. Look, look, look, look at the hole. Oh, it's been a look at. That means you're ready. Oh, forget that. Hurry right off the bridge. Get off as fast as you can. Well, what's the reason? Don't ask questions. Oh, no, get them off this bridge. Easy city, big fella. Get going or you'll all be killed. Go, Silver. Go with them. Hey, he's gone local. Yeah, he climbed over the side of the bridge. You go do as him say. Hurry. Get him out of the house. Come on. As the posse galloped toward the end of the bridge, the lone ranger who had climbed under onto the heavy supporting timbers of the bridge swung himself forward, grasping and clinging for dear life. While he screamed his eyes to find the object in you must be under there. Got to find it. Oh, I see the light of the fuse creeping along. Finally, he saw the small keg tied to one of the timbers. Clinging with one hand and tightly hugging a crossbeam with his knees, he reached out and tugged at the keg. Got to get it loose. Maybe if I can pull out the fuse. Won't loosen. I'll yank at that keg again. Hell, no use. Maybe if I hang from that beam above, I can use my feet to kick it loose. Grasping the beam above, the lone ranger swung free. Perspiration broke out in his forehead as he realized that a slip meant his body would hurtle to the gorge below. Then as he saw the glowing end of the fuse moving close, he forgot his own danger. He swung his foot forward in a superhuman effort, kicking at the small keg until finally it came loose. Got it. Lighted in with the fuse is almost here. This will do it, I hope. The small keg swung out and fell in a wide arc into the gorge and away from the bridge. Then the masked man began scrambling up the beams in hopes of reaching the roadway of the bridge before the explosion. But even before he could do so, it happened. In the hideout shack a short way up the trail, the outlaws waited for Tennessee to return. Yeah, we heard the explosion. Wrecking Tennessee's plan worked out like it figured, huh?  And if things went wrong, we could have gunned down the men trailing us. Tennessee knows what he's doing. He wanted to do this job by himself. Folks will be a long time figuring out what caused that explosion, I reckon. You know, we gotta admit that with Tennessee's innocent face and smart brain, this gang is going blank. Maybe Tennessee couldn't get to grab off that ombre's mask, but I reckon he sure found a way to blow it off, huh, fellas? Imagine the kid outsmarting the lone ranger when many of big, tough ombres is giving up too much. Hey, something went wrong. We've got to get out of here, Pronto. Hey, what do you mean? Masked man and engine came with a posse. I watched from the trail until the explosion. But they still rode on. The bridge didn't blow up.  Hey, boy, a man calling for life. Well, I'll fix that. Oh, you won't. Oh, got him down, man. Get him. I'll get him right now. Get to the train. Hey. I mean, they're coming here for the windows. Oh, they're shells for the mask ombre in the doorway. Yeah, and guns at the windows, like he says. All right, the rest of me come in here and round up these dirty coyotes. All right, all right.  All right, we'll attend to them. But the explosion, how did you all escape? You were right in the middle of the bridge.   You ought to know better than to try to outsmart that masked man. Now, somehow, he got wise to what was happening and ordered us off the bridge. He went down and loosened the blast and partied. Bridges still standing on damage. Say, the masked man's gone. So is the Indian. You haven't said who he is, chef. You know? Yep, I know, and I reckon Tennessee knew too. That's why he was anxious to get him. You see, he's the Lone Ranger. This is a feature of the Lone Ranger Incorporated, created and produced by George W. Trendle, directed by Charles D. Livingston, and edited by Fran Stryker. The part of the Lone Ranger is played by Brace Beamer.


So we're going to talk today about PF Sense and Sericata. Now Sericata is a free and open source, well-developed intrusion prevention, intrusion protection system, and it also offers network security monitoring through the offline PCAP file. If you're not favorite PCAP file, a lot of different systems can post-analyze that. It's basically like a full downloading capture of your network traffic. We're going to really just cover setting up Sericata, tuning Sericata, and some of the features in it, getting a little bit more in-depth, especially the tuning part because that's really important to security. If you have too many false positives, you're not really doing any good. You just have a bunch of noise and you didn't improve your situation any in terms of security. Now the difference between a security prevention system or IDS or IPS systems or whether or not they're active. So you can have an intrusion detection system that basically just creates alerts and reports, but does not actively act on it. This can go a step further and do inline prevention, which means alert created blocked IP address that was sending the packet so you can just drop them. Where this really comes in and where any IDS or IPS system comes in is when you do have ports open because the firewall simply says, can port ADB open, for example? Can traffic pass through there? It does not make any assessments of the traffic other than it doesn't port ADB forward through the firewall to where it goes. That's it. Now, Suricada or any intrusion detection system like Snort or Suricada, they go a step further and look at the arrangement of packets and see if they match certain patterns. For example, a SQL injection attack or some other mail formed header information or mail formed packets that are coming through the firewall and that need to be broken up and go, okay, this is not the pattern. This is not a standard get or post web request. This is asking for something that matches this known threat pattern. Now, that is where these intrusion detection systems really shine. So if you put them to protect your mail server that's behind the firewall, whatever the services are behind the firewall when you have open ports, this gives you insight into there. Now, in addition to that, you can use this on your internal network interfaces. So the internal facing ones, you can use it to also help determine what's going on inside your network. And you can then find a machine that's doing something else that it can identify the traffic and go, that machine's doing something that matches these patterns. So you may have a computer, a bad actor on your network internally and start the tracing process from there. So Suricada lets you do that so you both can look at the external threats and the internal threats. Now, of course, even if you're not blocking any ports, the internal threats can be an important reason to do this. And there's facilities in here by which you can block these things. So let's start taking a look at the system. I've already got it installed. That's not why you came here. That's the basic stuff. It's a really slick system, but it's really easy in PF Sense to install it. You go over to the system package manager, you'll see it's the only package I have installed right now. When I set up my demo systems, I usually just do a complete reset, fully load it and load just the things we're going to talk about unless I'm stacking something together. So here it is. Do the one click install. Then you go over here to services where it shows up, go to Suricada. There's no interfaces set up already. Go to the global settings and turn on a couple rules and then go to updates and hit update. And we're going to force it to update right this minute. So we have all the rules. Now, the rules I have in here, I have the ET open source Suricada rules for coverage, which is a little bit more limited than the ET pro. When we have the ET pro over here, yeah, right here, I don't like the fact that you receive a complimentary trial or demo. I don't know, please give me some pricing without me, you know, signing up for your newsletter snorts a little more open. They have, you know, rules and they have prices for these rules that you get. You know, Suricada is an open source product, but the real feet, it's just a framework. All the workhorse is the rules. The rules are the sauce that make this thing work. And these rules are put together by groups of security researchers and they're non-arbitrary. This is a lot of work keeping up with these rules. So they have, you know, you can get the rules 30 days faster here with the personal $3.99 for business and a per-sensor basis. And you do have to call for pricing for some of their larger packages. But it's a good system and you're funding not just the product, but the security researchers have put together the sauce that makes this thing understand vulnerabilities because there's a lot of time that goes into understanding packet rules and looking for threats and understanding what these mail form packets do. So this can then follow through and understand that as well. So I'm just using the free rules for demonstration. I imagine a lot of you are doing this at home, but if you're doing it for business, it's not hard to do. If you have the paid subscriber rules, you simply can throw in the file name. You can throw in the, your oink master code. Same with the E.T. Pro, just there's your subscription configuration. So you sign up for account. They give you a subscription number and a way you're in. Now update interval. I have it set to 12 hours. You can set this to shorter is a little six as long as every 30 days. You want to get new rules. Kind of leave it up to you.  I mean, six hours, maybe. I mean, this is just another layer of protection on here. I mean, if you're running production environment, you want it set faster, but for the most part, this seems to be fine. Now I leave this off by default, but this is the live rule swap on update. That's the default settings on there. It's just so you can push them in without doing a restart of the services, not the server, just the service itself. Remove blocked host interval. Now they say in here recommend an hour. It just depends on kind of your preferences. But what you do is if the IDS system says, I'm going to block this IP address. This is how long before it just falls out of the block list.  An hour is not bad. The downside is if you're doing some testing from home against your firewall or your outside your firewall doing testing, you can end up on a block list. So how long do you want to wait, especially when you're testing? At first, you really want this to be never, not never block, but you want it to be a low number and then you can increase it later to make sure that you don't lock yourself out. So we're going to go ahead and hit save here. First thing we got to do is add an interface. Now, it has the option to send alerts to system logs. You don't really need this because there's an entire logging system in Sericot itself under logs view that you can dig into this. So I don't send anything extra alerts over to there. I keep them all consolidated here. There's enough noise in my log files. We're going to turn on DNS log, stats log. It's up to you. The statistics can be appended when you're restarting it. You can default, not check that personal preference. HTTP log, append HTTP log, extended HTTP info, TLS log. Now, this is not being able to see into the TLS encrypted traffic. This is just creating the TLS log. So you can start looking at the details of the certificates that may have been accepted. This is nice to turn on. Something to make sure you have some hard drive space and a decent computer. Actually, a decent system to run this is important because as the traffic starts stacking up, it starts sucking up processing power. So if you have a really, you're like, hey, I grabbed this 10-year-old box to build my PF sense with, you're going to have a hard time running this. If the box isn't fast enough or doesn't have some memory, it's going to have issues. For example, with our production box, it's got four gigs of RAM to be able to run this just on three interfaces without running out of memory. It does consume a decent amount of memory whenever there's a high amount of traffic. And if you don't want to compromise speed, you got to have a reasonable multi-core processor. Now this supports multi-core processing too. So if you have like a six-core, eight-core CPU running this, great, it will take advantage of it. Now you can store and log the actual certificates so you can go deeper, start taking up a lot of room. Tracked files log. That's also a couple of things you can do. You can enable a file store and a packet log and a JSON log. And what these allow you to do is if you're going to start exporting to other devices, like I think LogStash is one of the ones that people recommended, I haven't really looked into it, but you can then use the data feed from this and bring it in, which is really cool. So for better visuals and analysis, we're just going to leave these things at default here. Plus we're not going to just try and grab every file. This is one of the things it can do. It can start grabbing all the files it sees that are not encrypted and start pulling them in logging stuff. So really cool features, especially if you're doing some security analysis where you go just turn everything on because I want to watch all the things. Now this is where you, especially when you're starting out, don't do this. This is where you can block offenders and you can just drop them right away as they produce alerts. Back to that false positives thing.  Yeah, I'd seen some type of mail form packet and perceived it as a threat because you didn't fine tune it. We're going to get to the fine tuning part, but when you're starting out, don't do that. Detect engine profile, I do keep this on high because I care about performance and I have four gigs of RAM. It will work if you set this to low and a lower memory machine that will consume less memory. Memory is not expensive. Now four gigs of RAM just doesn't cost that much. So put this in with a four gig of RAM machine. Then we have increase recursion limit. I don't really mess with these much. I've list all these at default and I've not really had any problems. This figures out your home net, external net. Well, it kind of figures that out automatically based on the interfaces we create and we'll show you what we're doing here. So we're going to click save. So now the interface is created. Go ahead and look over here. It's not started, but we still have more things to do. All right, so let's start looking at the categories and rules. This is the WAN category and WAN rules. This is more the category summary and this is the fine grain detail of the rule. So the first thing we do is resolve the flow bits and then we're going to go down here and I'm just going to hit select all that way we have everything. Now, what flow bits are is, for example, a packet may come through, but there's multiple pieces. They can't just take one packet. So one packet kicked off one thing and there's a couple packets behind it that are hoping that the first packet would trip something to put the other things in motion. For example, when they stack threats together. So the latest WannaCry was a stacked threat where first we're going to attack the Samba and then we start delivering the payload. So flow bits does is look through and follows through the multiple rules that a packet stream would turn on. And it's kind of slick because what you're seeing is the whole stream of it and says, okay, it hits this rule, this rule, and this rule. So now we can perceive this as a stacked alert and do that. So this is a great thing to have turned on is the flow bits. So we're going to save. Oh, and I selected all for the other rules. This is that findering control I was talking about where you can start seeing here and then you can actually click it and it jumps to that segment of the rules under the WAN rules. Now let's look at the categories real quick. You may or may not want all these categories. This is kind of self preference. I mean, some people are like, I just want all the things because it'll protect me from everything. It'll actually drive you crazy. It will not just protect you, but it'll also cause all kinds of tuning. It's harder to tune a system that has everything enabled because you may say, you know, I don't mind some of the chat rules because for example, I notice it flags any of the chat things going across the network. Same thing goes with PDP rules. You're like, hold on, I use torrent for things, but if you have all the PDP rules on there, it's going to start flagging them and it'll even tell you things like policy rules. Then we have game rules. You may have a problem with games being on your network or you go, wait a minute, you know, I don't care that a user has had a flag. This is flagging like battle net, received whisper message. I mean, it's just great if you have a corporate network and you go, I don't want anything on this network and you can start just blocking everything. You know when playing games, but especially for home users, if you check all of these and then turn on blocking, you're going to find out that your network is really secure because it won't do anything. It'll just like, wait, I can't play my games and I can't watch my Netflix. So you do have to kind of fine tune all these rules and I'll show you later the rules that I'm using in my network that seem to be pretty good about blocking things without, you know, overdoing it because well, I do use Torrent here. This is how we download even the latest ISOs for different things. So you don't want to go crazy with all these rules sets, but hey, for fun in getting this started, we're going to go ahead and do this. So like I said, this is your fine grain one and the custom rules and the auto flow book rules. These will start showing up as we're when we turn the interface on. There's more fine tuning you can do for bind to addresses. Everything's fine for me. I've not had a problem running it all stock, but if you have some special use case, you can go through and start doing this. Maybe if you get into a very large corporate environment with gigabit speeds and a fiber connection, there might be some tuning that needs to be done. That goes beyond the scope of this talk here. This is also different UDP parsers. You can turn off functionality. I mean, they give you a lot without dropping to adding anything custom pass through to the settings. You can tune a lot of different things in here.  You can also add different variables to these in case you want to really get specific on a few things. Now it does support the Barnier too. As in you can send this to, I'm gonna turn to show you what to unblocks these and enable my SQL logging. You can take all the data and then push it to another system. Now there's plenty of systems out there that support capture, a lot of paid ones that can create help dashboards. And especially if you're in a multi firewall environment or you're managing a series of sites, you can then consolidate all your threats across those sites or across those firewalls and endpoints to kind of build a picture of what's going on in your network. And use IP reputation list default does not check which is actually wrong because the default is checked. I noticed that it says that, but anyways, this is just more, you can assign categories and IP reputation lists. So let's get back to turning on the interface. Go ahead and click start. All right, now all the settings that we put in for there, we didn't get too detailed, we pretty much hit select all, but one of the really cool things is if you're configuring multiple LAN, multiple LAN interfaces, and you do a lot of customization, easy way to duplicate that customization is just to go here and what it did, it found the next interface. The only interface I have here is LAN and literally all the same options I checked are now applied to this interface. Kind of a nice feature when you have multiple because I configured my LANs slightly differently than I configured my LAN. I have more rules turned on, but no blocking on my LAN, it's more for analysis. So once I configured one of my LANs, we have more than one, I just duplicated it over to the other one. And start the interface. One nice thing to note is if you don't have enough memory, and I didn't at first when I was playing with this in the demo, you start loading it up, it kills it gracefully. It just says, wow, you ran out of memory. So we're just gonna stop this service from running. So it's kind of interesting that it does that. It's nice because it doesn't crash or lock up the firewall. It goes, whoop, you just kind of ran out of memory. So we're gonna turn it off. I've got four gigs allocated to this in a virtual box to alleviate those problems. All right, so let's see what it's doing. And we've right away started creating alerts. And what it's doing is looking at different things that are going across the network and saying, hey, this looks like a bit torrent paying, even right here, potential corporate privacy violation. This is just different things that's seen running on the network and calls that are going out. So let's go ahead and make some noise on a network. And I'm downloading a new copy of the tails. I might do another new demo next. They have a new release. And let's go ahead and let it turn this on and see what kind of noise this makes on a network that causes the system to start bugging me. All right, now we're generating some traffic. And this will also make the CPU jump up because it's got a lot of packets to sort through. Torrents are kind of good for load testing on servers because the volume of packets they generate, not just the speed at which you may be downloading really fast, but they also generate generally a lot of noise on the network for the system to take a look at. So we'll look at the LAN side and it's seeing all kinds of fun stuff going on. So it sees mine going to here. Apparently this is any threat intelligence, poor reputation out of window. You just start getting all kinds and out of the decode series of commands. Apparently there's some things in here that Seracata finds suspicious, but after doing some reading, it turns out are within the rights of the protocol, but maybe uncommonly use, and maybe things like P2P software uses that. So because of that, it starts creating even more false positives. And I'll show you how we start mitigating these here in just a second. So here's the LAN side and it's filling up pretty fast with all kinds of things. Now, right now we've got so much noise just on this Seracata UDPv4 invalid checksum, and we want to eliminate that. So this is where the fine tuning comes in. So we're on the LAN side and you can tune it the same way, LAN or LAN or any interface side. And what we have here is this little X. And this is the forced disable this rule and remove it from the cool current rule set. This is pretty slick because there's a couple options here. We can suppress this rule, add to suppress list, which means don't tell me about it anymore, or turn the rule off that's flagging it. So the suppress list is gonna add it by IP address so we can ignore something. Also, this right here is to resolve the host. So we can figure out where it is. So ns1.pfmechanics.com, wherever that's going, invalid checksum. So we're gonna go ahead and do this and we're gonna get rid of all the invalid checksums. It was refreshing at the same time. So we click this. All right, now the state for rule and it's got the rules, it's been modified, lively rule, and we'll see it wait 15 seconds before toggling additional rules. This is really slick because what it's doing is live reloading rules, you don't have to restart the service and it can then push them in and now we're gonna look at what that rule looks like now. They're yellow. What that means is you've already done it.  And this allows you to quit and start fine tuning and making sure that this doesn't come through anymore. So now it won't generate any more alerts for that particular rule. And this is the fine tuning process. I've heard some people say it takes a week. I guess it really depends on your network. If you have the regular things running, let's say on a Monday through Friday network with your office, you could probably quickly within only a day or two determine what's the noisy things that people are doing unless they have certain things you're doing certain days that may flag this. But this is that fine tuning process is turning off all the alerts that don't matter. Now, how do you know if they don't matter? That's always a common question. That's actually pretty easy because Google, you right click and do a search for Google. Yeah, it's that simple. And you can start run through the forums. You can start going, drop all going traffic, taming the beast, a blueprint. This is cool. Someone wrote some of these here of things you can do. It's a lot of reading and this is really what separates your paid UTM IDS systems from maybe a corporate company where it's all kind of magical and automatic. You say, I want these things blocked. What you're paying for and the reason those are so expensive isn't just the rule sets, which it's actually a deal getting rule sets for like 300 a year from Snort. You're talking about a team that works on this at some of these firewall companies, you know, Barakota, Sophos or any of them and they are applying this in real time. I mean, you still have some control on the UTM devices, but that's part of the expense of those devices is they're taking care of this and figuring out what needs to or not be done to keep these things going without driving a crazy and just blocking all the traffic.  You want to actually have a working internet connection and firewall, but depending on if you're in a corporate environment you probably don't want people torrenting things behind there. So you can leave this as an alert and you can go through start blocking it, but it also can serve as an order on the LAN side. We're gonna switch over to LAN here real quick, because that allows you to start looking at it internally and going, who's using it? And my IP address is here, this dot nine. So let's sort of how you trace some of this out. So if you notice, there's a little plus right here and we can see source, port, source, that's an H address. And this is how you can start filtering the traffic going, all right, who's the person generally alerted? Notice this dot nine and then you can filter for just the traffic related to that. Now I'm the only one on this little subnet so I'm the only one here, but this becomes very careful, very, I was very quick to go through and nail down, okay, I need this IP address, or I just wanna know things on this port. So let's look at everything that's coming across source port 443. We're gonna, you can stack filters and have multiple things in here. We're just gonna filter just for 443 though. And we can look at any 443 traffic and we can see that it's constantly generating a stream close weight out of window. And then we can see, it's gonna go and Google search it real quick. I'm not afraid to say I Google search a lot of things, but this starts letting you find recovering. This is sounds fun. Tower security, digital security, and it's recovering from suricata gone wild. It sounds like there's some troubleshooting here for probably a lot of false positives. And that's something, like I said, especially in the beginning, you're gonna get a lot of false positives in here. And that's where you go, okay, is this something I care to have in my alert? And you can't just say yes to all of it or you have so much digital noise, you'll never find it, it's needle in the haystack. You wanna figure out, these are the things that I wanna allow on my network. I'm gonna go ahead and suppress them. And then that way when something is in the alerts, it's something you should be concerned with. This is the most important thing for an IDS. This is also why at the beginning I said, don't just block everything, you're gonna have a bad time if you do that because you'll end up shutting down all your services. So that's kind of the overview for a lot of that functionality. Now let's look at the log view for each one. So land, this is what I talk about, you don't need to push things over to the logging inside of here because this is the logs facility for it. So here's the actual alerts log kind of in the raw and it has the file path for it. So you can start looking at the raw logs here, DNS resolve log here. So you can see what was looked up and it's kind of fun. I mean, you can start dumping these into different tools and start parsing them and go, okay, what's being looked up on here? We don't have the files log HTTP log, which nothing, I guess we didn't do anything HTTP. So stats log. So you can start looking at statistics for what was gone through in here. So it's pretty cool. What was checked, flow cues, the Sericata engine itself log. So you can find out what was done with Sericata as you reloaded or error codes that come in here. So you can kind of start going through here. Something else I'm gonna point out though. Now we're just gonna run an apt-get update. Oh, details. So we did this and then we're gonna go ahead and see if there's any other upgrades to the system. Okay, nothing new, nothing to install. So we did that real quick. Let me see, that should have showed up and we'll look in the LAN side real quick and we'll look into HTTP logs. And you can see what it just did. Went to the HTTP get protocols were because that went over a standard, not an SSL connection. So you can see into what was actually grabbed there. So now we have something in HTTP log. This also, if I'm not mistaken, generates an alert. Yes, it even alerts the fact that I did a user agent outbound likely related to package management. Once again, not suspicious traffic but still generated alerts and it generated a lot of alerts. All those alerts is just from one single computer. So obviously with even my own network when I turned this Sericata on and was fine tuning it this is why I just didn't turn everything on because I have several Linux servers that are checking for daily security updates and applying them, I can't have that blocked. I mean, if you're not thinking about it and you have it on the block list, next thing you know, I've literally insecure my network by stopping updates to my servers because this decided to flag it. So if you're not watching this and you turned on blocking right away, like I said, you can actually end up in securing your own networks that's something to think about. And of course, I would then go, well, let's add this to the don't bother it. Now the other side of this, so let's go over to the LAN side and something else you can do going, you know, I'm fine if it goes to this server. So let's see where this server is. This is nine one servers, we'll click this and it's a canonical server. So, you know, I like canonical. Let's go ahead and add them to the suppress list. So we click this and it's an entry, suppress gen ID, say blah, blah, blah. Well, let's look at what that actually looks like. What these are is this is the LAN suppress list. It'll also generate one automatically for the LAN, for the WAN. And then you can edit these rules and they're plain text, so to speak. My auto spell thinks things are spelled wrong or not grammatically correct. That's my grammar really plug in. Anyways, ET policy, GNU Linux app user upon likely suppress gen and what this does is means just don't put these in the alerts anymore. So it starts going, okay, this is your suppression list as in you want them to flag this activity. So it's still a rule, but don't flag it for this IP address. So that's another way to look at it where that's the difference between suppress and changing a rule set. Changing rule means don't enable this rule anymore versus suppress means don't annoy me because I know it goes to this IP address and that's perfectly fine. So kind of give you an idea how that works. So back to the interface list and look at the WAN categories and rules. Like I said, here's all the rules that are enabled that are generating that. And let's see, let's turn on blocking. Just to show you what it looks like. Automatically blocked. Now that actually has a couple different modes of inline mode and it has to do with whether or not there's a functionality. I believe some of the high end networks have it. I don't even gonna bother trying it because I'm running this in a virtual box session that it'll work, but it's basically how it does that on there. So we're gonna go ahead and hit save. And so we can start blocking things and showing you how the block list works. Here's a quick look at the block list on our production machine. You can see the IPs that are being blocked. They fell into threat reputation problems or whatever. And oh look, it's somewhere in, I think it's Denmark. So you can quickly look up where the IPs, it works much the same. And you can see what got blocked. If you wanna remove them from the block list, you can just click this and remove them. Save, refresh, download the block list. And it's a really straightforward and simple, not too big of a deal. I don't think it's really easy to do to manage a block list on here. And like I said, you can also suppress to keep them in a white list because maybe something you really like keeps getting blocked for one reason or another, but you wanna keep the rule on. And these fall off based on those rules we talked about earlier for how long before they automatically just fall off the block list. And having it tuned means only things on here for the most part, I don't worry about.  I want them blocked. So back to the other machine. It's hard to show you what the block list looks like on a demo machine. So this is my actual production facing the outside network. All right, and we'll go ahead and do this, ycar.org, so we'll do this. And what these are is ycar.org is just for testing. But you can see what it logged right away. So that's me going to the ycar website. And here's your shellcode comment heap spray sting. So you can look at what these are, but these are each simulated attacks that I was just doing. And you can see it right away generated. So here's the shell execute function, ET current events, CT exploit possible, Internet Explorer, VB, that's one of the ones I did click on. You can see how it generated all these. Let's look on the LAN side. And we kind of have the same thing. It sees it on the LAN side. So we can, you know, start tracing it down and where all this data was going back and forth. So let's close all this wonderful stuff that I got open and show you my production environment and how I'm fine tuning it a little bit differently there and what rules I have turned on. So here's our firewall and some of the things that we have turned on for our, in our WAN categories. Now, because we, you know, our retail store for one and business MSP, if we turn all these on, I learned that every sensor we have just flags it and causes some problems. I didn't feel like tuning everything. So I turned it down a little bit and came up with the ones that I feel generate alerts that are very valid. And we're also, by the way, using PF Blocker. So that actually keeps this down quite a bit. But this adds IPs that are on bad lists to like known attack sources to this list. So things that are coming in because we do have some ports open our firewall. For example, we use Screen Connect locally hosted. So when things are hitting my web server, it helps take and add another layer of shielding, so to speak on there. So the rules that we're using is emerging attack response to bot CC, bot CC rules, CI Army, emerging compromise, current event rules, denial of service, DShield, exploit, mailware, mailvertizers, Trojan rules and worm rules. I found these to be good enough to kind of view what's going on. And I also am still using the flow bits like I talked to you before. Now, generally speaking, there's very few alerts or blocks that I'm running into in our system. And it only took me, I don't know, a couple days of tuning for our network during normal business usage. Started in like a Monday, by Wednesday or Thursday, I feel as though I had it pretty well tuned without too many things getting blocked. It also has noticed some different attacks from different places, but most of the time it's reputation management stuff that's in there. Let's see if there's anything in the logs right now. A couple of things. So DShield Block listed source group. And it almost always, if I look at these IP addresses, apparently this one is scan11kshaddleserver.org and I can look up what shadowserver.org is maybe later, but I kind of like this little DNS lookup you can do to maybe if they have listed something that is. I'm kind of curious, what is shadow server? So apparently shadow server is a place that gathers intelligence. Now, this is where it gets kind of fuzzy, should I let them on there? But they're saying basically they were scanning miscellaneous attack, and they're actually probing for attacks. So you can see with these things in here, listed source group one, source group one, and active threat intelligence, poor reputation, group 14. What these generally are is this place is to start probing and scanning. And you can see what ports they're looking at. Sorry I had to blur some of this out, but you can see what ports they're looking at on each one of my public facing IP addresses. That way you can kind of determine what they're trying to do, what they're trying to look for, and things that are open. So kind of cool the way that works, but these are like I said, this keeps me sane because I don't mind blocking these guys. I'm not compromised, at least I hope I'm not. It's always a good question. So far there's nothing in here that tells me I am. But this is where, like I said, doing this narrower list of services helps you quite a bit in doing this. So you're not going insane trying to sort everything out. So that's it for intrusion detection with Sericata. I'm sure there's things that maybe I didn't uncover. There's so much more to it. Like maybe I will get into some of the how to export to third parties and set that up. That's maybe, it's on my to-do list because I'd like to have a cool dashboard for all this rather than looking at it from just a log standpoint. But it works really well. I've been happy with it. The performance of it's good. RPF sets box in case you're wondering. Spec wise, we're running the, this was an AMD X4, so four core 840 processor. People ask sometimes why I built it that way. I'm like, I had it. We had one of these laying around with four gigs of ram in it. And that is able, we have a 50 meg circuit. We host behind it. We occasionally torn it behind it for different downloads and things. And we also have in here several other services running. For example, open VPM and end top. And it handles this fine with four gigs of ram. So it's not like it's a super high end machine, but it's good. It's definitely good enough and fast enough to do this with four gigs of ram. We do run it all on a solid state because I like things booting up instantly. And we are using that Intel network carbon. But it works really well. Cercada doesn't seem to bog down the system. Actually end top is more demanding on the system than Cercada, which there's another video I did. You can find in my PF sense list here for that. But thank you again for watching. If you like the content here, like and subscribe. If there's some questions or maybe I need to do a follow up video on a specific function in here or something maybe I was wrong about.   Cause someone seems to always have an opinion and security is a really tough topic. I try to do my best to edit, but I won't lie. There's no way to know everything. Actually the more you learn about it, you're like, wow, I thought I knew a lot. And anyways, so if you liked the content here, like and subscribe and thanks for watching.


All right, I love those long introductions. They give me a chance to get really nervous. So I appreciate that, Pat. And anybody who tells you they don't get nervous in front of, when speaking in front of a crowd, obviously isn't really thinking about what they're speaking about. I certainly do. So forgive me when I start off with that. And yeah, that introduction did go in there. Let me tell you about Don't Bang on the Bomb, because that's something I love. It's something I've been working on for a few years, I think since 2013. And it does a bunch of different things. So I'll tell you a little bit about what it does. And I need you to help me. I get excited. I talk fast. And it's not great for people. If I do that, I'll like this. Slow me down a bit, OK? And I'll try to do my best. So Don't Bang the Bomb, what do we do? We look at the companies that are connected to the nuclear weapons industry. And in our latest report, we profile 27 of them. I was amazed earlier when I heard about this list of 200 companies, like, oh my god, that's so much work. The touch to the fossil fuel industry. And I was thinking, gosh, we spend several months profiling these 27, where we can put up information about the contracts and the specific components that they make to make nuclear weapons possible, to contribute to the lethality of nuclear weapons. And we do this, there's some companies that are some financial institutions that make their own lists. And we look at those and we share notes with one another whenever we can. We're really excited because this issue is getting more attention. It's getting more attraction. And the global compact, which was mentioned earlier, is, as of last week, now excluding nuclear weapon producers. There's a couple of companies that are on that global compact list that are getting kicked off. That's awesome. And it's a little win. But wins help us. Every little win builds our energy, builds our campaign. And I like to win. I'm one of four kids. Winning is important. I like to win. I used to play sports. I believe in winning. And so that's why I like to work on divestment. Because, yes, it is a long-term commitment. But you can have really powerful short-term wins. And then we celebrate. And celebration is awesome. So I like to win. And it's funny because sometimes we think we're winning. And then we actually realize we didn't win. And I'll give you an example. There's this company that used to be called FinMechanica. It's an Italian company. And it works on missile components for nuclear-armed missiles. FinMechanica ended its contracts for nuclear-armed missiles. We're like, this is great. Fantastic. But actually, it just changed its name. And it did that because it was on so many exclusion lists of financial institutions. So they tried to get past that. So they changed it to Leonardo FinMechanica. And earlier this year, they changed it just to Leonardo. It's an Italian company. You can understand why it's called Leonardo. So we thought we had to win. And we were excited. Because in our research, we are very careful. If somebody, if their contracts are over, we don't include them in our blacklist of producers anymore, because we don't punish people for stuff they did if they've changed their behavior going forward. And that's important. It helps us build relationships with some of these weapons manufacturers. Sometimes that's good. Sometimes it's not. A couple of years ago, we had Textron come to our office because Textron was very angry. Because we kept talking about how Textron makes cluster bombs. And we do this similar research on cluster bombs. Textron was upset that we were identifying them. So they wanted us to stop. And we said, well, we'll be very happy to stop. But stop making cluster bombs. Earlier this year, Textron announced it was stopping making cluster bombs. So win. Now, Textron didn't cite us. They should have, but no, they didn't. And Lockheed Martin also didn't cite us when they stopped making cluster bombs. Lockheed Martin cited the pressure from the financial sector. They said, we want to make ourselves available to European investors again. So they stopped making cluster bombs. Now, granted, Lockheed Martin makes a whole lot of horrible stuff.  But it's a tiny piece that they stopped doing because of our collective work. And it shows that we have this great deal of power that we underestimate. And I'm amazed at this one penny figure. And I'm so good to use. That's awesome. And think about the power of the penny when we think about the power of the purse. And we try very hard in our, when we talk about producers and we talk about we're not to invest, we like to give people thoughts of where they could invest. But we can't provide financial advice. So we don't because that's out of my baliwick. However, I did find out that you can make more money. And I apologize to those who've heard me say this before. A couple of years ago, you could make more money investing in condoms than you could investing in the French nuclear missile program. And I don't know about you, but I have preferences for what I want to see more of in the world. So we can't specifically say, take the money out of bombs and put them into condoms because that's not quite how it works. But take from it what you will. And with Don't Hang in the Bomb, we look for lots of ways to help people engage in this issue. And we focus on nuclear weapons. And we do that because we're part of this international campaign to abolish nuclear weapons. We do it because we've found nuclear weapons are, people don't want to be associated with nuclear weapons at all when we tell them that they are and freaks them out. And it's part of our strategy. I'll tell you something. The companies that we target are the same companies that are listed in this that Haley talked about this morning. These five companies are efforts. Whatever resonates with your folks is going to help us all. So if it helps to talk about nuclear weapons and the connection to nuclear weapons, do that. If it helps to talk about the boycott divestment sanctions, do that. If it helps to talk about prisons, do that. Because these companies are profiting from our willingness and complicity in their inhumane actions. But we provide a lot of or try to do our best to provide lots of ways and for people to engage. And so we talk about how individuals can do things. And in addition to what we heard about the different things that Richard was talking about before, I wanted to throw a couple of other things out there that I like very much. One is to just ask the question. I love it when people come to me and say, I went into my local bank branch and I just asked them. And the bank freaks out. Because they go, oh my God, this client with their $212 is asking me these really hard questions about what the bank is doing. And it goes up the chain. And that's really helpful. Ask questions. And then I have a personal preference for selfies and taking selfies in certain moments and using cool hashtags. I like the divest for more hashtag. And I encourage people to take selfies at ATMs. Point to the ATM, selfie, divest for more hashtag. Simple thing. But it's something that can also, if you tag the financial institution, tag your bank, gets them freaking out. Your communications department goes, why are they tagging us? What do we have to do? What did we do? And that can be a lot of fun. It can. They ask questions. It leads to making it a lot easier for some of the behind the scenes work that we're doing. And we talk to financial institutions constantly. And we talk to banks. We talk to pension funds. Asset management companies don't always want to get back to us, but they will take a meeting after a few insistent emails or phone calls. And we encourage them to make policies. Because we don't want to see just the action right now of divestment. We want to see that, of course. But we want to make sure that no future money can be invested in these types of companies. And we make it a point to tell people when there's a good policy. When we know about it, we don't always caveat. But when we do, we publish it. We have a hall of fame for those financial institutions that exclude the whole company. Not just project finance, but a whole company that exclude the company regardless of where it's located. Couple of big banks say, well, well, well, no, we don't invest in nuclear weapon producers in India. France is fine, but not India. And we say regardless of location, exclude the whole company. And it has to apply to all of their financial services. So we look and it's not just the shareholding. It's not just the bond holding. But also do they do, do they provide other financial services to these companies? Because there's quite a few out there that do. And so we check all of that. And then of course, we don't tell people that they're in a hall of fame until we do an implementation check. We found some really amazing policies that just weren't implemented. And we found great policy didn't actually divest from anything. And so that's slightly problematic. And we make sure to tell them that we find it problematic. So it's this kind of behind the scenes activity. And we try very hard to keep it quiet at the beginning, right? And then if they don't respond, if they don't engage, if they're not willing to work with us, then we take it to the streets. And that's, I think, something that's really important. The naming and shaming. Commerce Bank in Germany is now working on their policy. Why? Because they had hundreds of activists outside of Commerce Bank branches all through the country doing dynes, holding up signs saying this bank is an atomic weapons bank. And so Commerce Bank is like, oh, okay, we've got to do something now. So we've been working with them to do something. We take to the press whenever the press can. Corporate media doesn't always want to cover worn piece issues. But the financial press is an interesting angle to go at. And we've had more luck with the financial sector press. And so we take to the media whenever and where we can. And of course, social media. And one of my favorite stories is the three people in Sweden who started tagging their bank on Facebook and saying, what's your problem? How can you connect us to nuclear weapons? And that bank came back and said, oh, this is very unsweetish. We have to change this right now. And they did. And they put in a really good policy. And they worked with us to make sure that policy does look good. I don't have too much time to go into other things. And I know there's, we want to have some time for Q and A. And I don't want to repeat what was already said, but I want to reinforce what Jared was saying about the power of following up on nuclear weapon free zone with local authorities. Sometimes we can't move things on the big way, but we can move things in a small way. And I'm personally going to walk out of here today thinking about the power of the penny in my community. And let's keep winning stuff because winning is fun. And I'll stop there. Thank you.