Zawadidone

locals {
  environment = {
    VELOCIRAPTOR_TARGET_ARGS = jsonencode({
      bucket = var.gcp_source_bucket_name
      GCSKey = {
        type                        = var.gcp_source_bucket_service_account_key.type
        project_id                  = var.gcp_source_bucket_service_account_key.project_id
        private_key_id              = var.gcp_source_bucket_service_account_key.private_key_id
        private_key                 = var.gcp_source_bucket_service_account_key.private_key
        client_email                = var.gcp_source_bucket_service_account_key.client_email

Zawadidone

I've spent the day trying to get this setup working with GitHub and given the number of gotcha's I encountered, it seemed like a good idea to document how I finally got this working with as few hacks as possible. There's a lot of documentation out there (some of it old and misleading) and committing here for posterity will help me remember this when I inevitably need to do this again.

Rationale

Passwords are simply not enough these days. Regardless of the company, breaches (and the associated Personally Identifiable Information harvested) are a matter of not if, but when. There are a number of things you can do to protect yourself, but being on the tin-foil-hat side of paranoia, means there are a few Commandents that I adhere to (and recommend for other folks)[Insert link to Fight Club Rules for the Secure Internet].

That being said, if you use 2-factor authentication and have committed to using a hardware token such as the Yubikey, then you're already ahead of the curve. The problem is that wh

Zawadidone

mappings = jsonencode({
	properties = {
		__ts_timeline_id = { type = "long" }
		datetime         = { type = "date" }
		timestamp        = { type = "long" }
		timestamp_desc   = { type = "text", fields = { keyword = { type = "keyword" } } }
		message          = { type = "text" }
		data_type        = { type = "text", fields = { keyword = { type = "keyword" } } }
		timesketch_label = {
			type = "nested"

Zawadidone

# https://twitter.com/brsn76945860/status/1171233054951501824
pip install mmh3

-----------------------------
# python 2
import mmh3
import requests
 
response = requests.get('https://cybersecurity.wtf/favicon.ico')
favicon = response.content.encode('base64')

Zawadidone

# Rotate left. Set max_bits to 8.
rol = lambda val, r_bits, max_bits=8: \
    (val << r_bits%max_bits) & (2**max_bits-1) | \
    ((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))
 
# Rotate right. Set max_bits to 8.
ror = lambda val, r_bits, max_bits=8: \
    ((val & (2**max_bits-1)) >> r_bits%max_bits) | \
    (val << (max_bits-(r_bits%max_bits)) & (2**max_bits-1))

Zawadidone

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDcQiycS6q+4IHo6Snv3Hy7OSYaKDYLKsmWQWUqv3Tk hi@zawadidone.nl

Zawadidone

knmi.nl
rijksoverheid.nl
overheid.nl
duo.nl
politie.nl
koninklijkhuis.nl
defensie.nl
kadaster.nl
werkenbijdefensie.nl
cbs.nl