manasmbellani

Please review the `README.md` file.

manasmbellani

<!--
  sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
  Source version:	74 | Date: 2021-07-08
  Source project:	https://github.com/SwiftOnSecurity/sysmon-config
  Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.

  Fork version:	<N/A>
  Fork author:	<N/A>
  Fork project:	<N/A>
  Fork license:	<N/A>

manasmbellani

<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:vb="urn:the-xml-files:xslt-vb" xmlns:user="placeholder" version="1.0">
<!-- Copyright (c) Microsoft Corporation.  All rights reserved. -->

<xsl:output method="text" omit-xml-declaration="yes" indent="no"/>
<xsl:strip-space elements="*" />

<ms:script implements-prefix="user" language="JScript">
<![CDATA[

	

manasmbellani

README

This gist contains information about various splunk apps pertaining to detection engineering that have been released on Splunkbase.

Usage

Review the files on gist.github.com OR consider cloning this and opening it in a Markdown editor such as Typora to obtain a navigational outline

manasmbellani

# Directories to exclude
exclude-dirs:
  - SOMETHING

# Files to exclude
exclude-files:
  - README.md
  - .gitignore
  - .pre-commit-config.yaml
  - LICENSE

manasmbellani

#   Version 9.0.1
# these here just override and disable stuff that in system/default.

################################
# Data thru parsingQueue always
################################

[splunktcp]
route=has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue

manasmbellani

Steps to build new alerts in Splunk

To build new alerts, perform the following steps:

• Ensure that the correct app is selected via the Apps menu option in Splunk UI
• Leverage an existing search macro that has been recently built and update it to meet the search query for detection
• Test if the alert works
• Use MITRE Attack Framework to add relevant fields from the Matrix here if applicable
• Create a new search macro with updated permissions. Search macro should be prefixed with appropriate keyword e.g. gcp_detect_ or sysmon_detect
• Update the search macro permissions to be publicly readable, and admin writable

manasmbellani

#!/usr/bin/env python3
import json

dictionary = {
    'duration': 720, 
    'language': 'sv',
    'link': 'https://vimeo.com/neweuropefilmsale/incidentbyabank',
    'name': 'INCIDENT BY A BANK',
    'test': {
        'test2': {

manasmbellani

#!/bin/bash
if [ $# -lt 3 ]; then
    echo "[-] $0 $action <in-video-audio-file> <start-time-as-HH:MM:SS> <end-time-as-HH:MM:SS/num_seconds> [out-file]"
    exit
fi
in_audio_file="$1"
start_time="$2"
end_time_num_seconds="$3"

if [ -z "$out_file" ]; then

manasmbellani

#!/usr/bin/python

from argparse import ArgumentParser, RawTextHelpFormatter
import subprocess
import shlex
import requests


USER_AGENT_STR = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0"