Vaclav Adamec VAdamec
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| input { | |
| zeromq { | |
| type => 'zmq' | |
| topology => 'pushpull' | |
| address => 'tcp://*:5556' | |
| mode => 'server' | |
| } | |
| } | |
| output { |
VAdamec
/ ossec_kibana3.dashboard
Created
January 21, 2014 21:29
Kibana3 dashboard for OSSEC (using fields from logstash basic parsing)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "title": "OSSEC", | |
| "services": { | |
| "query": { | |
| "idQueue": [ | |
| 0, | |
| 1 | |
| ], | |
| "list": { | |
| "2": { |
VAdamec
/ ossec_elasticsearch_index
Created
January 21, 2014 21:33
Set @fields to not analyzed (to get full alert description not exploded parts)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| curl -XPUT http://localhost:9200/_template/logstash_ossec -d '{ | |
| "template" : "*ossec*", | |
| "settings": { | |
| "number_of_shards": 12, | |
| "number_of_replicas": 1 | |
| }, | |
| "mappings": { | |
| "ossec": { | |
| "_all": { | |
| "enabled": false |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [beaver] | |
| transport: redis | |
| redis_url: redis://localhost:6380/0 | |
| redis_namespace: logstash:cache:ossec | |
| ssh_key_file: /etc/beaver/id_rsa | |
| ssh_tunnel: beaver@<dc_server_redis> | |
| ssh_tunnel_port: 6380 | |
| ssh_remote_host: <dc_server_redis> | |
| ssh_remote_port: 6379 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| curl -XGET 'http://localhost:9200/ossec-logstash-2014.02.07,ossec-logstash-2014.02.06,ossec-logstash-2014.02.05,ossec-logstash-2014.02.04,ossec-logstash-2014.02.03,ossec-logstash-2014.02.02,ossec-logstash-2014.02.01,ossec-logstash-2014.01.31/deploy/_search?pretty' '{ | |
| "facets": { | |
| "0": { | |
| "date_histogram": { | |
| "field": "@timestamp", | |
| "interval": "1h" | |
| }, | |
| "global": true, | |
| "facet_filter": { | |
| "fquery": { |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # https://github.com/xme/toolbox/blob/master/getawslog.py | |
| # | |
| # */5 * * * * aws ~aws/bin/s3backup_cloudtrail.sh /var/log/aws_backup.log | |
| # | |
| #!/bin/bash | |
| trap control_c SIGINT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Cloudtrail | |
| # | |
| grep { | |
| tags => ["awsaudit"] | |
| add_tag => ["awsauditproc"] | |
| } | |
| grok { |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "title": "CloudTrail", | |
| "services": { | |
| "query": { | |
| "list": { | |
| "0": { | |
| "query": "@message:*UnauthorizedOperation*", | |
| "alias": "", | |
| "color": "#E0752D", | |
| "id": 0, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /etc/nslcd.conf | |
| # Connect to IPA | |
| binddn uid=sudo,cn=sysaccounts,cn=etc,dc=test | |
| bindpw XXXX | |
| ssl start_tls | |
| tls_cacertfile /etc/ipa/ca.crt | |
| tls_checkpeer yes |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| input { | |
| zeromq { | |
| type => 'zmq' | |
| topology => 'pushpull' | |
| address => 'tcp://*:5556' | |
| mode => 'server' | |
| } | |
| } | |
| output { |
OlderNewer