Howard-Chang

#top10 protocol name
GET _search
  {
  "size" : 0,
  "query": {
    "bool": {
      "should": [
        {
            "term":{"IPV4_SRC_ADDR":"203.68.62.36"}
        },

Howard-Chang

#define _GNU_SOURCE

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <unistd.h>

Howard-Chang

#include<stdio.h>

int removeDuplicates(int* nums, int numsSize) {
 
    
}
int main()
{
	int i=0,j=0,k=0,count=0;
	int arr[]={1,2,2,3,3,4,5,5};

Howard-Chang

C:\Windows\system32>cd /d E:\ELK\elasticsearch-curator-5.2.0-amd64\curator-5.2.0-amd64\ 

E:\ELK\elasticsearch-curator-5.2.0-amd64\curator-5.2.0-amd64>curator --config curator.yml delete_indeces.yml 
2018-02-05 12:00:03,160 INFO      Preparing Action ID: 1, "delete_indices"
2018-02-05 12:00:03,254 INFO      Trying Action ID: 1, "delete_indices": Delete indices older than 1 days (based on index name), for logstash- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2018-02-05 12:00:03,317 INFO      Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
2018-02-05 12:00:03,317 INFO      Action ID: 1, "delete_indices" completed.
2018-02-05 12:00:03,317 INFO      Job completed.

Howard-Chang

basic authenticate (lab:苗網ES4)
nginx.conf:

user  nginx;
worker_processes  4;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

Howard-Chang

sh users useradd my_admin -p my_password -r superuser

curl -u my_admin -XPUT 'http://163.19.163.239:9200/_xpack/security/user/elastic/_password?pretty' -H 'Content-Type: application/json' -d'
{
  "password" : "9ol./;p0"
}'
Enter host password for user 'my_admin':

Howard-Chang

netstat -tulpn   //查看有哪些port被哪些程序所佔用
firewall-cmd --zone=public --list-all  //查看哪些port是public的
firewall-cmd --zone=public --add-port=5510/tcp //把tcp 5510加到public
firewall-cmd --zone=public --remove-port=5510/tcp //把tcp 5510從public中移除

LS server: 
firewall-cmd --zone=public --add-port=5556/udp //把udp 5556加到public

ES server:
firewall-cmd --zone=public --add-port=9300/tcp //把tcp 9300加到public

Howard-Chang

1.把type是anomaly的syslog抓出來，包含其IPV4_SRC_ADDR、IPV4_DST_ADDR、time.

GET _search
{  
  "_source": { 
        "includes": [ "IPV4_SRC_ADDR","IPV4_DST_ADDR","msg","time","attack"] 
    }, 
    "query":{ 
       "bool": { 
          "must":[ 

Howard-Chang

建立一個sh檔案，加入以下指令:
sh /home/es3/Downloads/elasticsearch-5.6.6/bin/elasticsearch &
sh /home/es3/Downloads/kibana-5.6.6-linux-x86_64/bin/kibana

cd /home/logstash/Downloads/logstash-5.6.6/bin
sh logstash -f /home/logstash/Downloads/logstash-5.6.6/bin/flow.conf

logstash server:
#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin

Howard-Chang

cd /d D:\nProbe
start nprobe /c --zmq "tcp://*:2055" -i none -n none --collector-port 5556
cd /d D:\ntopng
start ntopng /c -i tcp://127.0.0.1:2055 -F "logstash;120.127.160.91;tcp;5510" --local-networks "120.127.0.0/16"

cd /d D:\elasticsearch-5.6.5\bin
echo "starting elasticsearch"
start elasticsearch

cd /d D:\kibana-5.6.5-windows-x86\bin