cyhook

#!/bin/bash
#
# OpenVAS automation script.
# Mariusz B. / mgeeky, '17
#	v0.1
#

trap ctrl_c INT

# --- CONFIGURATION ---

cyhook

# Bro-IDS Logstash parser
# Parts of this taken from http://www.appliednsm.com/wp-content/uploads/logstash-SObro22-parse.conf_.txt

#Logs being parsed:
#app_stats.log
#conn.log
#dns.log
#dpd.log
#files.log
#http.log

cyhook

Ubuntu 14.04 Request Tracker RT rt-4.2.14 RT for Incident Response RTIR 4.0.0

Request Tracker Installation

export http_proxy="http://10.x.x.x:3128"
export https_proxy="http://10.x.x.x.x:3128"

cyhook

Request Tracker Installation on Ubuntu 14.04 with Assets and REST API module

export http_proxy="http://10.x.x.x:3128"
export https_proxy="http://10.x.x.x.x:3128"

Setup the database

cyhook

GLPI SETUP FUSION INVENTORY PLUGIN

apt -y install dmidecode hwdata ucf hdparm
apt -y install perl libuniversal-require-perl libwww-perl libparse-edid-perl
apt -y install libproc-daemon-perl  libproc-pid-file-perl libfile-which-perl
apt -y install libxml-treepp-perl libyaml-perl libnet-cups-perl libnet-ip-perl
apt -y install libdigest-sha-perl libsocket-getaddrinfo-perl
apt -y install nmap libnet-snmp-perl libcrypt-des-perl libnet-nbname-perl

cyhook

1. Failed to create Monitoring events errors

[2017-10-03T20:21:09,732][ERROR][logstash.inputs.metrics ] Failed to create monitoring event {:message=>"For path: events", :error=>"LogStash::Instrument::MetricStortricNotFound"}

Add the following line to /etc/elasticsearch/elasticsearch.yml and restart elasticsearch

nano /etc/elasticsearch/elasticsearch.yml 
paste: action.auto_create_index: .security,.security-6,.monitoring*,.watches,.triggered_watches,.watcher-history*
ctrl x --> y --> Enter
service elasticsearch restart

cyhook

User not registered

Delete ocsweb database and run http://localhost/ocsreports/install.php

cyhook

STEP 1: Add a static IP Address

Log into the server add configure the static IP address username: user password: P@$$w0rd123

nano /etc/network/interfaces
iface eth0 inet dhcp              #Replace with: iface eth0 inet static

   address 10.253.0.50
   netmask 255.255.255.0

cyhook

Tcpdump usage examples

https://www.howtouselinux.com/post/10-useful-tcpdump-command-examples

tcpdump -D See the list of interfaces on which tcpdump can listen

tcpdump -i eth0 Listen on interface eth0:

tcpdump -i any Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater):

cyhook

SO

• https://github.com/Security-Onion-Solutions/security-onion/wiki/Bro

Grafana

• wget https://s3-us-west-2.amazonaws.com/grafana-releases/release/grafana_4.6.1_amd64.deb
• sudo apt-get install -y adduser libfontconfig
• sudo dpkg -i grafana_4.6.1_amd64.deb

Change Timezone