isaqueprofeta

#LOGIN
curl -i -X POST -H 'Content-type:application/json' -d '{"jsonrpc":"2.0","method":"user.login","params":{ "user":"myUserName","password":"myPassword"},"auth":null,"id":0}' https://zabbix.server/api_jsonrpc.php

#GET ALL HOSTS WITH NAME
curl -i -X POST -H 'Content-type:application/json' -d '{"jsonrpc":"2.0","method":"host.get","params":{"output": ["hostid", "name"]},"auth":"<AUTH_KEY>","id":0}' https://zabbix.server/api_jsonrpc.php

#GET ALL HOSTS WITH NAME, HOSTNAME AND IP ADDRESS
curl -i -X POST -H 'Content-type:application/json' -d '{"jsonrpc":"2.0","method":"host.get","params":{"output":["hostid", "host", "name"], "selectInterfaces":["ip"]},"auth":"<AUTH_KEY>","id":0}' https://zabbix.server/api_jsonrpc.php

isaqueprofeta

#!/bin/bash

DATABASE_PASSWORD=${1:-Z4bb1xD4t4b4s3}

echo "######################################################################"
echo "                        INSTALACAO DO ZABBIX                          "
echo "           SISTEMAS OPERACIONAIS RHEL-LIKE ROCKY/ALMA LINUX           "
echo "######################################################################"
echo "                          FONTE DO SCRIPT:                            "
echo "           https://github.com/isaqueprofeta/zabbix-pipe2bash          "

isaqueprofeta

SIEM Training

ATTENTION, THIS GIST ISN'T FREQUENTLY UPDATED

MAIN SOURCE: https://github.com/isaqueprofeta/cybersec-path

General

• Jose Bravo - What is a SIEM? (5 Vídeos): https://www.youtube.com/watch?v=MtqFMe4zSpQ&list=PLHh9jhztlMyp8lyKXt9orVM57ygW_ihPS
• IPPSec - PowerSIEM Analyzing Sysmon Events with PowerShell: https://www.youtube.com/watch?v=MvfhIydxFmw

isaqueprofeta

function login() {
    try {
        var parameters = JSON.parse(value);
        var req = new CurlHttpRequest();
        var jsonZabbix = {
            "jsonrpc": "2.0",
            "method": "user.login",
            "params": {
                "user": parameters.user,
                "password": parameters.password

isaqueprofeta

# Entrar na pasta de certificados do sistema:
# Ubuntu anterior ao 18:
sudo mkdir /usr/share/ca-certificates/serpro/
sudo cd /usr/share/ca-certificates/serpro/
# Ubuntu 18:
sudo mkdir /usr/local/share/ca-certificates/serpro/
cd /usr/local/share/ca-certificates/serpro/

# Baixar os certificados do repositorio:
wget -r --no-check-certificate https://ccd.serpro.gov.br/serproacf/docs/

isaqueprofeta

#!/bin/bash

DATABASE_PASSWORD=${1:-Z4bb1xD4t4b4s3}

echo "######################################################################"
echo "                        INSTALACAO DO ZABBIX                          "
echo "                     SISTEMA OPERACIONAL DEBIAN                       "
echo "######################################################################"
echo "                          FONTE DO SCRIPT:                            "
echo "           https://github.com/isaqueprofeta/zabbix-pipe2bash          "

isaqueprofeta

#!/bin/bash

DATABASE_PASSWORD=${1:-Z4bb1xD4t4b4s3}

echo "######################################################################"
echo "                        INSTALACAO DO ZABBIX                          "
echo "                     SISTEMA OPERACIONAL UBUNTU                       "
echo "######################################################################"
echo "                          FONTE DO SCRIPT:                            "
echo "           https://github.com/isaqueprofeta/zabbix-pipe2bash/         "

isaqueprofeta

#!/bin/bash

# DEFINA AS CREDENCIAIS E CUSTOMIZACOES AQUI
export OPENCTI_BASE_URL="http://localhost:8080"
export OPENCTI_ADMIN_EMAIL="admin@opencti.io"
export OPENCTI_ADMIN_PASSWORD="ChangeMePlease"
export RABBITMQ_DEFAULT_USER="guest"
export RABBITMQ_DEFAULT_PASS="guest"
export SMTP_HOSTNAME="localhost"
export ELASTIC_MEMORY_SIZE="4G"

isaqueprofeta

Elastic Trial Docker

Como usar

• Copiar ambos os arquivos desde gist (Os arquivos abaixo, chamados .env e docker-compose.yml) dentro de um diretório e acessar esse diret
• Editar o .env com as opções de credencial
  • Para usar sem o trial, trocar no .env o LICENSE para basic: LICENSE=basic
• Ligando o ambiente
  • Rodar o docker-compose up -d
  • Rodar o docker-compose logs -f kibana
• Aguardar o Kibana parar de carregar mensagens por mais de 30 segundos (quer dizer que ele terminou de carregar)

isaqueprofeta

#!/bin/bash

# Desabilitar selinux
sudo sed -i "s/SELINUX=enforcing/SELINUX=disabled/" /etc/selinux/config
sudo setenforce 0

# Configurar o firewall
sudo firewall-cmd --add-port=3000/tcp --permanent
sudo firewall-cmd --reload