Skip to content

Instantly share code, notes, and snippets.

@ryanbarrett

ryanbarrett/show-me-rita.sh

Last active September 21, 2023 19:01
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ryanbarrett/66386f31543ebc6ca88fc76ff702e50a to your computer and use it in GitHub Desktop.
Save ryanbarrett/66386f31543ebc6ca88fc76ff702e50a to your computer and use it in GitHub Desktop.
Download ZIP
Active Countermeasures - Rita Notes
Raw
show-me-rita.sh
# ./show-me-rita.sh $DB
DB=$1
COMMANDS="beacons beacons-fqdn exploded-dns long-connections strobes useragents"
for SHOWCOMMAND in $COMMANDS
do
echo "exporting show-$SHOWCOMMAND to $SHOWCOMMAND-$DB.txt"
docker-compose run --rm rita show-$SHOWCOMMAND $DB > $SHOWCOMMAND-$DB.txt
done
# https://github.com/activecm/rita/blob/master/docs/Docker%20Usage.md#running-rita-with-docker-compose
# docker-compose run --rm rita import /logs 2022-09-20
# or
# export LOGS=2022-09-19 && docker-compose run --rm rita import /logs $LOGS && ../show-me-rita.sh $LOGS
# cat exploded-dns-2022-09-20.txt | (head -n 1 - && tail -n +2 - | sort -rt , -nk 3) | column -ts, | less
# column -ts, beacons-2022-09-20.txt | less
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment