Skip to content

Instantly share code, notes, and snippets.

View linuxmalaysia's full-sized avatar
🏠
Working from home

Harisfazillah Jamel linuxmalaysia

🏠
Working from home
52 followers · 16 following
View GitHub Profile
@linuxmalaysia
linuxmalaysia / keybase.md
Created April 3, 2014 14:51

Keybase proof

I hereby claim:

  • I am linuxmalaysia on github.
  • I am linuxmalaysia (https://keybase.io/linuxmalaysia) on keybase.
  • I have a public key whose fingerprint is D10A 7BC3 6E37 4688 3025 F23A E674 713A 5CA7 60C8

To claim this, I am signing this object:

@linuxmalaysia
linuxmalaysia / data.gov.my.md
Last active August 29, 2015 14:26
A list of data provided by http://data.gov.my
@linuxmalaysia
linuxmalaysia / code-review-checklist.md
Created May 7, 2018 23:44 — forked from nerandell/code-review-checklist.md
PHP Code Review Guidelines

Make sure these boxes are checked before submitting/approving the PR

General

  • The code works
  • The code is easy to understand
  • Follows coding conventions
  • Names are simple and if possible short
  • Names are spelt correctly
  • Names contain units where applicable
  • There are no usages of magic numbers
@linuxmalaysia
linuxmalaysia / logstash-inputfile.conf
Created July 3, 2018 06:40
input {
file {
path => "/data/ujian/fortigate*.txt"
start_position => beginning
sincedb_path => "/dev/null"
type => "fortigate"
}
}
filter {
@linuxmalaysia
linuxmalaysia / listbot-logstash.txt
Last active August 30, 2018 00:25
Config Untuk Listbot
Contoh diambil dari
https://github.com/dtag-dev-sec/listbot
1) Git clone masukkan dalam /etc/logstash
@linuxmalaysia
linuxmalaysia / logstash-syslog.conf
Last active March 18, 2019 13:32
Logstash Conf Filter For Syslog Input
## https://github.com/minyk/morphline-mr/wiki/DictionariesOfGrok
## https://serverfault.com/questions/735230/why-cant-the-logstash-syslog-pri-filter-see-the-priority-in-syslog-messages
filter {
if "syslog" in [tags] {
grok {
match => {
"message" => [ "%{SYSLOG5424PRI}%{SYSLOGBASE2}", "%{SYSLOGBASE2}", "%{SYSLOGPAMSESSION}", "%{CRONLOG}", "%{SYSLOGLINE}" ]
}
tag_on_failure => [ "failedPattern_syslog" ]
@linuxmalaysia
linuxmalaysia / logstash-grok-uri.txt
Last active March 18, 2019 15:02
logstash grok uri. Find URL or URI in field data.
# %{URI:uri}
#
# %{URIPROTO:uriproto}://(?:%{USER:user}(?::[^@]*)?@)?(?:%{URIHOST:urihost})?(?:%{URIPATHPARAM:uripathparam})?
#
# %{EMAILLOCALPART:emaillocalpart}@%{HOSTNAME:emailhostname}
#
# %{EMAILADDRESS:emailaddress}
### URI / URL
@linuxmalaysia
linuxmalaysia / rsyslog-logstash.conf
Created March 25, 2019 01:54
Config for rsyslog in /etc/rsyslog.d or rsyslog.conf and named it rsyslog-logstash.conf
# Setup disk assisted queues
# Disable rate limit
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName fwdRule21 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 10g # 10gb space limit (use as much as possible)
@linuxmalaysia
linuxmalaysia / logstash-bind9.txt
Created March 25, 2019 23:31
Logstash Grok Pattern for Bind9 input using Filebeat
### Logstash Grok Pattern for Bind9 input using Filebeat
%{BIND9_TIMESTAMP:timestamp}%{SPACE}%{LOGLEVEL:loglevel}:%{SPACE}client%{SPACE}%{IP:clientip}#%{POSINT:clientport}%{SPACE}\(%{DATA:query}\):%{SPACE}view%{SPACE}internal:%{SPACE}query:%{SPACE}%{DATA:query2} %{DATA:queryclass} %{DATA:querytype} %{DATA:queryflag} \(%{IP:dnsip}\)
####
grok {
match => {
"message" => [ "%{BIND9_TIMESTAMP:timestamp}%{SPACE}%{LOGLEVEL:loglevel}:%{SPACE}client%{SPACE}%{IP:clientip}#%{POSINT:clientport}%{SPACE}\(%{DATA:query}\):%{SPACE}view%{SPACE}internal:%{SPACE}query:%{SPACE}%{DATA:query2} %{DATA:queryclass} %{DATA:querytype} %{DATA:queryflag} \(%{IP:dnsip}\)" ]
}
@linuxmalaysia
linuxmalaysia / convert-to-yaml-logstash.sh
Last active March 29, 2019 12:12
Blacklist from Steven Black and others convert to yml to be used with logstash translate field must contain URI / URL
#!/bin/sh
# origin https://gist.github.com/erlepereira/c11f4f7a3f60cd2071e79018e895fc8a
# logstash yaml "www.google.com": "known search engine"
# Choose from here https://github.com/StevenBlack/hosts
#HOSTS_RAW=https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
##### https://raw.githubusercontent.com/StevenBlack/hosts/master/data/malwaredomainlist.com/hosts
### first must using > and others using >> for pipe
##### first file