FrankHassanabad

## Generic links from ML back to SIEM Application

#
# Several tests runs with each and adding/removing
# them to see which ones were effective
#

Network Overview Links
---
# Network Overview By User Name (KQL Query: user.name $user.name$)

FrankHassanabad

processors:
  - add_host_metadata:
      netinfo.enabled: true
  - add_cloud_metadata: ~
  - add_fields:
      when.network.source.ip: 10.128.0.21/32
      fields:
        source.geo.location:
          lat: 42
          lon: -93

FrankHassanabad

processors:
  - add_host_metadata:
      netinfo.enabled: true
  - add_cloud_metadata: ~
  - add_fields:
      when.network.source.ip: 10.128.0.21/32
      fields:
        source.geo.location:
          lat: 42
          lon: -93

FrankHassanabad

processors:
  - add_host_metadata:
      netinfo.enabled: true
  - add_cloud_metadata: ~
  - add_fields:
      when.network.source.ip: 10.128.0.21/32
      fields:
        source.geo.location:
          lat: 42
          lon: -93

FrankHassanabad

#!/bin/sh

# Download yj from:
# https://github.com/sclevine/yj/releases
# such as wget https://github.com/sclevine/yj/releases/download/v4.0.0/yj-macos
#
# Then chmod 755 ./yj-wrapper
# Go to your pre-packaged rules and run this:
# yj-wrapper.sh

FrankHassanabad

#!/bin/sh

mkdir sorted

for f in ~/projects/kibana/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/*.json ; do
  echo $f
  cat $f | jq . -S > sorted/$(basename -- "$f" .json).json
done

FrankHassanabad

#!/bin/sh

# Download yj from:
# https://github.com/sclevine/yj/releases
# such as wget https://github.com/sclevine/yj/releases/download/v4.0.0/yj-macos
#
# Then chmod 755 ./yj-macos and chmod 755 toml_to_json.sh
# Go to your toml and run this
# toml_to_json.sh

FrankHassanabad

#!/bin/sh

# Download yj from:
# https://github.com/sclevine/yj/releases
# such as wget https://github.com/sclevine/yj/releases/download/v4.0.0/yj-macos
#
# Then chmod 755 ./yj-macos and chmod 755 toml_to_json.sh
# Go to your toml and run this
# toml_to_json.sh

FrankHassanabad

for f in *.json ; do
  echo "checking $f"
  cat $f | jq .max_signals 
done

FrankHassanabad

#!/bin/sh

#
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
# or more contributor license agreements. Licensed under the Elastic License;
# you may not use this file except in compliance with the Elastic License.
#

set -e
./check_env_variables.sh