leehinman

• Assumptions
• Create necessary temp dirs
• Build Custom Beat
• Download any other beats you need (filebeat & metricbeat are minimums)
• Build agent

Assumptions

yodermk

# The general procedure here is adapted from the 7->8 guide here. https://www.tecmint.com/upgrade-centos-7-to-centos-8/
#
# It is a curated list of my bash history. I entered other commands so hopefully I got the right ones here.

yum upgrade
reboot
dnf install epel-release
dnf install rpmconf
dnf install yum-utils
rpmconf -a  # answer "n" to both things

memoryleak

#!/usr/bin/env bash
sudo hdiutil create -o /tmp/Monterey -size 16g -volname Monterey -layout SPUD -fs HFS+J
sudo hdiutil attach /tmp/Monterey.dmg -noverify -mountpoint /Volumes/Monterey
sudo /Applications/Install\ macOS\ Monterey.app/Contents/Resources/createinstallmedia --volume /Volumes/Monterey --nointeraction
hdiutil eject -force  /Volumes/Install\ macOS\ Monterey
hdiutil convert /tmp/Monterey.dmg -format UDTO -o ~/Downloads/Monterey
mv -v ~/Downloads/Monterey.cdr ~/Downloads/Monterey.iso
sudo rm -fv /tmp/Monterey.dmg

leehinman

Intro

Filebeat's httpjson input can be used query Splunk's REST API and ingest the original data. This doesn't make use of any Splunk processing (CIM or apps). This doc covers 2 common use cases. The first is when you want to ingest from the current forward. For example if you want to compare how Splunk and Elastic differ in detections on the same data. The second use case is when you want to ingest historical data. For example if you want to pull in the last 6 months of data to compare how Splunk and Elastic differ. This method is good for comparing Elastic and Splunk, but shouldn't be considered a final ingest strategy for customers.

Limitations

This will only work for Filebeat modules where the raw message stored in splunk is the same as what the input provides. Modules that won't work are netflow and Winlogbeat because each of those does heavy processing on the raw data.

joariasl

Elastic does not provide Filebeat binaries for ARMv7. Luckily, Filebeat can easily be cross-compiled with:

# ----- Instantiate an immutable Go container for cross-compilation ----- #
mkdir build && cd $_
docker run -it --rm -v `pwd`:/build golang:latest /bin/bash

# ----- Inside Go container ----- #
go get github.com/elastic/beats
cd /go/src/github.com/elastic/beats/filebeat/

lvaylet

Elastic does not provide Filebeat binaries for ARMv7. Luckily, Filebeat can easily be cross-compiled with:

# ----- Instantiate an immutable Go container for cross-compilation ----- #
mkdir build && cd $_
docker run -it --rm -v `pwd`:/build golang:1.9 /bin/bash

# ----- Inside Go container ----- #
go get github.com/elastic/beats
cd /go/src/github.com/elastic/beats/filebeat/

publicarray

// https://developers.cloudflare.com/workers/about/ 
// https://tutorial.cloudflareworkers.com
//
// A Service Worker which adds Security Headers.
// Checks:
//     https://securityheaders.io/
//     https://observatory.mozilla.org/
//     https://csp-evaluator.withgoogle.com/
//     https://hstspreload.org/
//     https://www.ssllabs.com/ssltest/

deruke

if not exist "C:\windows\sysmon_config.xml" (
copy /z /y "\\lab.local\SYSVOL\lab.local\scripts\sysmon\sysmon_config.xml" "C:\windows\"
)
 
sc query "Sysmon" | Find "RUNNING"
If "%ERRORLEVEL%" EQU "1" (
goto startsysmon
)
:startsysmon
net start Sysmon

muff1nman

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>chromecast-ssdp</short>
  <port protocol="udp" port="1900"/>
  <destination ipv4="239.255.255.250/32"/>
</service>

julianxhokaxhiu

#!/bin/bash
#
# Credits to fuckbecauseican5 from https://www.reddit.com/r/hackintosh/comments/4s561a/macos_sierra_16a238m_install_success_and_guide/
# Adapted to work with the official image available into Mac App Store
#
# Enjoy!

hdiutil attach /Applications/Install\ macOS\ Sierra.app/Contents/SharedSupport/InstallESD.dmg -noverify -nobrowse -mountpoint /Volumes/install_app
hdiutil create -o /tmp/Sierra.cdr -size 7316m -layout SPUD -fs HFS+J
hdiutil attach /tmp/Sierra.cdr.dmg -noverify -nobrowse -mountpoint /Volumes/install_build