Skip to content

Instantly share code, notes, and snippets.

View andrewkroh's full-sized avatar

Andrew Kroh andrewkroh

115 followers · 7 following
View GitHub Profile
@andrewkroh
andrewkroh / symantec-endpoint-pipeline.json
Last active April 21, 2021 16:15
Symantec Endpoint Elasticsearch Ingest Node Pipeline (POC)
{
"description": "Pipeline for parsing Symantec Endpoint logs",
"processors": [
{
"set": {
"field": "event.original",
"value": "{{{message}}}"
}
},
{
@andrewkroh
andrewkroh / citrix-netscaler-pipeline.json
Last active December 15, 2020 14:12
Citrix Netscaler Elasticsearch Ingest Node Pipeline
{
"description": "Pipeline for parsing Citrix Netscaler logs",
"processors": [
{
"script": {
"description": "set event.original",
"lang": "painless",
"source": "def event = ctx.event;\nif (event == null) {\n event = [:];\n ctx['event'] = event;\n}\nevent['original'] = ctx.message;\n"
}
},
@andrewkroh
andrewkroh / instructions.md
Last active March 6, 2023 19:09
Adding event.ingested and lag calculations to Winlogbeat events

Adding event.ingested and lag calculations to Winlogbeat events

Create an Ingest Pipeline that will add four fields:

  • event.ingested - Time when the event was processed by Elasticsearch.
  • event.lag.read - Time difference in milliseconds between @timestamp and event.created. This measures how long it took for Winlogbeat read the event from the event log (for WEC this includes the delivery time from forwarder to collector).
  • event.lag.ingest - Time difference in milliseconds between event.created and event.ingested. This measures the time between Winlogbeat reading the event (time when it "created" the document) to when it was written to Elasticsearch.
@andrewkroh
andrewkroh / functions
Created September 22, 2020 16:46
RHEL 6 /etc/rc.d/init.d/functions from initscripts-9.03.61-1.el6.centos.x86_64
# -*-Shell-script-*-
#
# functions This file contains functions to be used by most or all
# shell scripts in the /etc/init.d directory.
#
TEXTDOMAIN=initscripts
# Make sure umask is sane
umask 022
@andrewkroh
andrewkroh / howto.txt
Last active May 5, 2023 10:07
Microsoft-Windows-Windows Defender Event Log Message Resources
800, AntiVirus
801, AntiSpyware
802, Antimalware
803, Full
804, Delta
805, Full Scan
806, Quick Scan
807, Custom Scan
808, Remove
809, Quarantine
@andrewkroh
andrewkroh / vault.hcl
Created September 3, 2020 12:48
Journalbeat and Hashicorp Vault
journalbeat.inputs:
id: vault.service
include_matches:
- systemd.unit=vault.service
processors:
- add_fields:
target: event
fields:
module: vault
dataset: vault.log
@andrewkroh
andrewkroh / access.log
Created May 5, 2020 19:07
Filebeat Squid Proxy Access Log Parsing
1348870236.160 0 192.168.0.35 TCP_DENIED/403 3293 GET http://armdl.adobe.com/pub/adobe/acrobat/win/9.x/9.5.2/misc/AcrobatUpd952_all_incr.msp - NONE/- text/html
1348870236.273 0 192.168.0.35 TCP_DENIED/403 3274 GET http://armdl.adobe.com/pub/adobe/acrobat/win/9.x/9.5.2/misc/AcrobatUpd952_all_incr.msp - NONE/- text/html
1348870236.386 0 192.168.0.35 TCP_DENIED/403 3274 GET http://armdl.adobe.com/pub/adobe/acrobat/win/9.x/9.5.2/misc/AcrobatUpd952_all_incr.msp - NONE/- text/html
1348870236.499 0 192.168.0.35 TCP_DENIED/403 3274 GET http://armdl.adobe.com/pub/adobe/acrobat/win/9.x/9.5.2/misc/AcrobatUpd952_all_incr.msp - NONE/- text/html
1348870237.550 0 192.168.0.35 TCP_DENIED/403 3269 GET http://armdl.adobe.com/pub/adobe/acrobat/win/9.x/9.4.6/misc/AcrobatUpd946_all_incr.msp - NONE/- text/html
1348870274.248 59875 192.168.0.35 TCP_MISS/503 0 CONNECT client84.dropbox.com:443 - DIRECT/- -
1348870284.249 59872 192.168.0.35 TCP_MISS/503 0 CONNECT client62.dropbox.com:443 - DIRECT/- -
1348870
@andrewkroh
andrewkroh / domain_rank_enrichment_pipeline.json
Last active October 11, 2019 14:54
Elasticsearch Ingest Node Enrich Processor Example - Top 1M Domain Ranks
PUT /_ingest/pipeline/domain_rank_enrichment
{
"description" : "Enriching domains with rank.",
"processors" : [
{
"enrich" : {
"policy_name": "dns-domain-top1m-rank",
"field" : "dns.question.name",
"target_field": "_temp"
}
@andrewkroh
andrewkroh / msobjs.c
Created July 23, 2019 20:26
Extact the msobjs.dll message table
#include <windows.h>
#include <stdio.h>
int ProcessBlock(MESSAGE_RESOURCE_DATA* data, MESSAGE_RESOURCE_BLOCK* block)
{
MESSAGE_RESOURCE_ENTRY* entry = (MESSAGE_RESOURCE_ENTRY*) ((unsigned char*)data + block->OffsetToEntries);
for (DWORD id = block->LowId; id <= block->HighId; id++)
{
if (entry->Flags == 0x0001) // wide char
printf("%d, %ls", id, entry->Text);
@andrewkroh
andrewkroh / filebeat-cisco-ios.js
Created February 26, 2019 23:35
Javascript Processor Example
var processor = require("processor");
var filebeatCisco = (function() {
var parseCiscoHeader = new processor.Dissect({
"tokenizer": "%{}%%{cisco.log.facility}-%{cisco.log.severity}-%{event.code}: %{message}",
"field": "log.original",
"target_prefix": "",
}).Run;
var coerceDataTypes = new processor.Transform([