jorritfolmer

Installing Windows Server 2016 on Ovirt v4 qemu/kvm

The install fails with BSOD and "Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you."

After reboot it returns with the following message: "The computer restarted unexpectedly or encountered an unexpected error. Windows installation cannot proceed. To install Windows, click OK to restart the computer, and then restart the installation.":

jorritfolmer

Mounting Defender for Endpoint Telemetry data on Linux

Defender Telemetry data can be persisted in Azure Blob Storage. This results in datetimestamped directories containing JSON files.

Why?

So you can easily Splunk, gzip or jq some of your telemetry data

How?

jorritfolmer

Securonix RIN installation

Prerequisites

You need at least 8 GB of RAM for the installation to succeed. If not, the installer will give you weird errors. See below for the difference in output between a successful and unsuccessful installation.

Replace a1redacted-abcd` with your own tenant name and code.

Preparation

jorritfolmer

Offline Windows lab from scratch

1. Windows 2019 domain controller
2. Windows 10 Pro domain joined workstation
3. Creating Microsoft Office offline DVD image
4. Installing ISO on Windows 10 Pro

1. Installing a Windows 2019 domain controller

This is a condensed version of https://petri.com/how-to-install-active-directory-in-windows-server-2019-using-powershell

jorritfolmer

MITRE EDR evaluations round 3

For easier Splunking use the steps and Python script below.

Download MITRE EDR json files

wget https://attackevals.mitre-engenuity.org/downloadable_JSON/AhnLab_Results.json
wget https://attackevals.mitre-engenuity.org/downloadable_JSON/Bitdefender_Results.json
wget https://attackevals.mitre-engenuity.org/downloadable_JSON/CheckPoint_Results.json

jorritfolmer

Comparing MITRE ATTACK evaluations of EDR software in Splunk, APT3

The JSON results of the APT3 evaluations can be found here: Round 1, APT3. For easier Splunking you have to transpose the JSON files from MITRE with the script below. This allows you to perform searches to compare detection results from each EDR vendor.

Usage

$ python transpose_mitre_eval.py file_from_mitre.json > better_file_for_splunking.json

jorritfolmer

Generic syslog building block

The rsyslog config below realises a reusable building block to onboard syslog data, for example into Splunk. It assumes an on-prem enterprise environment and uses the file system as a buffer/queue to decouple syslog senders from a receiver like Splunk Universal Forwarder (UF). This way you can restart Splunk UF without any data loss.

The following four configuration files ensure:

• Reception of syslog into one log file for every source IP address.
• Fitness for a high volume syslog setup by having rsyslog NOT throttle
• Least privilege for Splunk UF by having rsyslog create files with appropriate umask and group
• Retention of all log files for 1 day to prevent availability issues from "disk full" scenarios

jorritfolmer

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.example.tmpwatch</string>
    <key>ProgramArguments</key>
    <array>
        <string>/opt/homebrew/sbin/tmpwatch</string>
        <string>--mtime</string>

jorritfolmer

How to use Tailwind CSS with Pelican

These steps show how to install Tailwind CSS in a Pelican project, purge and minify it so you don't have to reference a 3+ MB CSS file but only several kB.

1. virtualenv venv
2. . venv/bin/activate
3. pip install nodeenv
4. nodeenv env
5. . env/bin/activate
6. npm install postcss postcss-cli autoprefixer tailwindcss purgecss cssnano

jorritfolmer

How to add memtest86+ to the UEFI grub2 boot menu in Red Hat Enterprise Linux 9

The two methods below can be used to boot Memtest86+ from the grub2 boot loader on Red Hat Enterprise Linux 9. This is convenient when a system is located in a datacenter instead of on your desk, and has a remote console like e.g. iLO. Unfortunately the most recent Memtest86+ v7 cannot currently detect correctable ECC errors, so the only hint is very low performance in the memtest interface like the elapsed timer not updating every second. In that case EDAC errors filling up /var/log/messages are a more reliable indicator.

Using the EFI filesystem and a /etc/grub.d config file

1. Download the Binary Files (.bin/.efi) from https://www.memtest.org
2. Create a new directory /boot/efi/EFI/tools/