Andrew Kroh andrewkroh

## domain_rank_enrichment_pipeline.json
PUT /_ingest/pipeline/domain_rank_enrichment
{
  "description" : "Enriching domains with rank.",
  "processors" : [
    {
      "enrich" : {
        "policy_name": "dns-domain-top1m-rank",
        "field" : "dns.question.name",
        "target_field": "_temp"
      }

## msobjs.c
#include <windows.h>
#include <stdio.h>

int ProcessBlock(MESSAGE_RESOURCE_DATA* data, MESSAGE_RESOURCE_BLOCK* block)
{
    MESSAGE_RESOURCE_ENTRY* entry = (MESSAGE_RESOURCE_ENTRY*) ((unsigned char*)data + block->OffsetToEntries);
    for (DWORD id = block->LowId; id <= block->HighId; id++)
    {
        if (entry->Flags == 0x0001) // wide char
            printf("%d, %ls", id, entry->Text);

## filebeat-cisco-ios.js
var processor = require("processor");

var filebeatCisco = (function() {
    var parseCiscoHeader = new processor.Dissect({
        "tokenizer": "%{}%%{cisco.log.facility}-%{cisco.log.severity}-%{event.code}: %{message}",
        "field": "log.original",
        "target_prefix": "",
    }).Run;

    var coerceDataTypes = new processor.Transform([

## geoip-asn-pipeline.json
{
    "description": "Add Geo and ASN to event",
    "processors": [
      {
        "geoip": {
          "if": "ctx.source?.geo == null",
          "field": "source.ip",
          "target_field": "source.geo",
          "ignore_missing": true
        }

## event1.json
{
  "@timestamp": "2019-01-29T19:10:47.538Z",
  "beat": {
    "hostname": "DESKTOP",
    "name": "DESKTOP",
    "version": "6.3.2"
  },
  "event": {
    "kind": "event"
  },

## winlogbeat_testing.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                andrewkroh
                / winlogbeat_testing.md
            
            
              Last active Jan 25, 2019
            
              
                Winlogbeat Development
              
          
      View winlogbeat_testing.md
  
      
    Winlogbeat Development
Start a Windows VM
vagrant up win2012

Login Options
You can connect to the VM in multiple ways.

  
## elastic-beat-development-101.md

      
              1 file
            
          
              1 fork
            
          
              2 comments
            
          
              1 star
            
          
                andrewkroh
                / elastic-beat-development-101.md
            
            
              Last active Mar 17, 2022
            
              
                Elastic Beat Development 101
              
          
      View elastic-beat-development-101.md
  
      
    Elastic Beats Development 101
This is a short guide to get up and building Elastic Beats on a new Linux host.
Start a VM
This uses Google Compute Engine (GCE) to start an Ubuntu 20.04 virtual machine. You can use other versions of Linux or different virtualization platforms (or no virtualization), but those are not guaranteed to work with the commands here.
 gcloud auth login


## packetbeat-tls-event.json
{
  "@metadata": {
    "beat": "packetbeat",
    "type": "doc",
    "version": "7.0.0-alpha1"
  },
  "@timestamp": "2018-08-01T18:10:48.311Z",
  "beat": {
    "hostname": "macbook",
    "name": "macbook",

## packetbeat-dhcpv4-nak-decline.json
POST _xpack/watcher/watch/packetbeat-dhcpv4-nak-decline
{
  "metadata": {
    "window_period": "1m",
    "index_pattern": "packetbeat-*"
  },
  "trigger": {
    "schedule": {
      "interval": "1m"
    }

## Slack Notification
https://twitter.com/Krohbird/status/849749788920877056
	PUT /_ingest/pipeline/domain_rank_enrichment
	{
	"description" : "Enriching domains with rank.",
	"processors" : [
	{
	"enrich" : {
	"policy_name": "dns-domain-top1m-rank",
	"field" : "dns.question.name",
	"target_field": "_temp"
	}
	#include <windows.h>
	#include <stdio.h>

	int ProcessBlock(MESSAGE_RESOURCE_DATA* data, MESSAGE_RESOURCE_BLOCK* block)
	{
	MESSAGE_RESOURCE_ENTRY* entry = (MESSAGE_RESOURCE_ENTRY) ((unsigned char)data + block->OffsetToEntries);
	for (DWORD id = block->LowId; id <= block->HighId; id++)
	{
	if (entry->Flags == 0x0001) // wide char
	printf("%d, %ls", id, entry->Text);
	var processor = require("processor");

	var filebeatCisco = (function() {
	var parseCiscoHeader = new processor.Dissect({
	"tokenizer": "%{}%%{cisco.log.facility}-%{cisco.log.severity}-%{event.code}: %{message}",
	"field": "log.original",
	"target_prefix": "",
	}).Run;

	var coerceDataTypes = new processor.Transform([
	{
	"description": "Add Geo and ASN to event",
	"processors": [
	{
	"geoip": {
	"if": "ctx.source?.geo == null",
	"field": "source.ip",
	"target_field": "source.geo",
	"ignore_missing": true
	}
	{
	"@timestamp": "2019-01-29T19:10:47.538Z",
	"beat": {
	"hostname": "DESKTOP",
	"name": "DESKTOP",
	"version": "6.3.2"
	},
	"event": {
	"kind": "event"
	},
	{
	"@metadata": {
	"beat": "packetbeat",
	"type": "doc",
	"version": "7.0.0-alpha1"
	},
	"@timestamp": "2018-08-01T18:10:48.311Z",
	"beat": {
	"hostname": "macbook",
	"name": "macbook",
	POST _xpack/watcher/watch/packetbeat-dhcpv4-nak-decline
	{
	"metadata": {
	"window_period": "1m",
	"index_pattern": "packetbeat-*"
	},
	"trigger": {
	"schedule": {
	"interval": "1m"
	}