anthonygtellez

Fix for Splunk TA Bro to index gzipped data and have the sourcetype match current log

• disable input once historical data onboarding is completed.
• required on UF, HF, IDX, SH

Inputs.conf

[monitor:///usr/local/bro/logs/*/*.log.gz]
sourcetype = brogz
index = bro

anthonygtellez

anthonygtellez

Keybase proof

I hereby claim:

• I am anthonygtellez on github.
• I am anthonygtellez (https://keybase.io/anthonygtellez) on keybase.
• I have a public key ASCBPDuJGWCUjLpIFk2a5Rxi1_wJmTJrS3QYZMfnfmLaLQo

To claim this, I am signing this object:

anthonygtellez

anthonygtellez

#!/bin/bash
# Put all the domain names in domains.txt, one per line
# then run in the terminal: bash domains.sh
# this will print each domain in the terminal as it looks it up
# The result csv will contains the domain, IP & Nameservers in each column

# Give each column the relevant header titles
echo "Domain Name,IP Address,Nameserver,Nameserver,Nameserver,Nameserver,Nameserver" > domains.csv

while read domain

anthonygtellez

#!/bin/bash
# Put all the domain names in domains.txt, one per line
# then run in the terminal: bash domains.sh
# this will print each domain in the terminal as it looks it up
# The result csv will contains the domain, IP & Nameservers in each column

# Give each column the relevant header titles
echo "Domain Name,IP Address" > dig_cloud-bleed_domains.csv

while read domain

anthonygtellez

#!/bin/bash
#
# ===========================================================
# Purpose:	This script will install splunk and complete some initial setup steps
# Parameters:	None
# Example usage: $ bash rhel_yum_install_syslog-ng.sh
#
# Privileges:	Must be run as root
# Author:	Anthony Tellez
#

anthonygtellez

# found on the internet, not my creation
# - jsie

import re

total_logical_cpus = 0
total_physical_cpus = 0
total_cores = 0

logical_cpus = {}

anthonygtellez

#!/usr/bin/python

# All SSH libraries for Python are junk (2011-10-13).
# Too low-level (libssh2), too buggy (paramiko), too complicated
# (both), too poor in features (no use of the agent, for instance)

# Here is the right solution today:

import subprocess
import sys

anthonygtellez

#!/usr/bin/python
''' Not my script, found on the Internet, and rediscovered on my hard drive
'''
import sys

def cidr_to_regex(cidr):
    ip, prefix = cidr.split('/')

    base = 0
    for val in map(int, ip.split('.')):