azurekid

1Password - Microsoft Sentinel solution

Introduction

The 1Password Content Hub solution for Microsoft Sentinel is a community-developed project that enables organizations to ingest data from 1Password into their target SIEM/SOAR solution. Given that password managers inherently store highly sensitive information, monitoring and responding to any unexpected events is critically important.

By ingesting audit logs, sign-in events, and usage information into Microsoft Sentinel, this solution allows for the automation of incident responses, promptly notifying security analysts of potential issues.

azurekid

git clone https://github.com/projectdiscovery/alterx.git
git clone https://github.com/projectdiscovery/owasp-amass/oam-tools

cd alterx/cmd/alterx; \
go build; \
mv alterx /usr/local/bin/; \
alterx -version;

azurekid

<#
.SYNOPSIS
    Generates a GUID from a given string value using MD5 hashing.

.PARAMETER Value
    The string value to generate a GUID from.

.EXAMPLE
    Get-Guid -Value "example string"
    Returns a GUID generated from the string "example string".

azurekid

jobs:
- job: get_token
  displayName: Collecting AccessToken
  steps:
    - powershell: |     
        $accessToken = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("azdo:$(System.AccessToken)"))

        # auth headers
        $headers = @{Authorization = 'Basic ' + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("azdo:$(System.AccessToken)")) }
        write-output $($headers.value)

azurekid

KQL Snippets

This file contains useful snippets that can be used for the development of ASIM Parsers for Microsoft Sentinel

DstHostname

| extend DstHostname = case(DstHostname != "", DstHostname, DestinationIP)

azurekid

[CmdletBinding()]
param (
    [Parameter(Mandatory = $true)]
    [string]$GitBranch,

    [Parameter(Mandatory = $false)]
    [string]$CommitMessage = 'rebuild repository',

    [Parameter(Mandatory = $false)]
    [switch]$Force

azurekid

function Invoke-SplitJWT {
        Param
        (
            [Parameter(Mandatory = $true,
                ValueFromPipeline = $true,
                Position = 0)]
            $String
        )
    
        Process {

azurekid

function Get-GraphToken {
        [cmdletbinding()]
        Param(
            [Parameter(Mandatory = $True)]
            [String[]]
            [ValidateSet("MSGraph", "Azure", "Monitor", "MSPIM")]
            $Client,    
            
            [Parameter(Mandatory = $False)]
            [String]$Resource = "https://graph.microsoft.com"   

azurekid

KQL Coding standards

This document helps to create clean and readable KQL code for parsing and detection rules.
All views are my own based on writing lots of code in PowerShell and other languages.
This is a living document that helps to create a common baseline.

Allign your code

• Place a spaces before and after the '=' character for readability.
  
• allign the code using instead of spaces. Keep the '=' character and default values alligned.

azurekid

[CmdletBinding()]
param (
    [Parameter()]
    [switch]$IDPS,

    [Parameter()]
    [switch]$ThreatIntel,

    [Parameter()]
    [switch]$WebCategories,