Skip to content

Instantly share code, notes, and snippets.

View shortstack's full-sized avatar
🍪

Whitney Champion shortstack

🍪
View GitHub Profile

Keybase proof

I hereby claim:

  • I am shortstack on github.
  • I am shortstack (https://keybase.io/shortstack) on keybase.
  • I have a public key whose fingerprint is D02E 8221 6BFD BD73 4F72 CD78 2B4D 49BF 46E0 59DB

To claim this, I am signing this object:

@shortstack
shortstack / advent_of_code.py
Last active December 7, 2015 20:58
advent of code
"""
whitney champion
advent of code
"""
import sys
import re
import hashlib
# day 1: not quite lisp
@shortstack
shortstack / deactivate_dead_nodes.sh
Last active May 26, 2016 18:33
Deactivate old Puppet nodes
#!/bin/sh
nodes=`curl --silent -G 'http://localhost:8080/v4/nodes' --data-urlencode "query=[\"<\", \"report-timestamp\", \"$(date -d '-1 day' -Isec)\"]" | jq '.[].certname'`
for node in $nodes; do
puppet cert clean $node
puppet node deactivate $node
done
cmd.exe /c winrm quickconfig -q
cmd.exe /c winrm quickconfig -transport:http
cmd.exe /c winrm set winrm/config @{MaxTimeoutms="1800000"}
cmd.exe /c winrm set winrm/config/winrs @{MaxMemoryPerShellMB="800"}
cmd.exe /c winrm set winrm/config/service @{AllowUnencrypted="true"}
cmd.exe /c winrm set winrm/config/service/auth @{Basic="true"}
cmd.exe /c winrm set winrm/config/client/auth @{Basic="true"}
cmd.exe /c winrm set winrm/config/listener?Address=*+Transport=HTTP @{Port="5985"}
cmd.exe /c net stop winrm
cmd.exe /c sc config winrm start= auto
@shortstack
shortstack / create-users.yml
Last active October 30, 2019 23:16
AWS Cognito Test Users
#############################################
# USAGE: ansible-playbook create-users.yml #
#############################################
---
- name: Set up Cognito test users
hosts: localhost
vars:
user_pool_id:
client_id:
@shortstack
shortstack / enroll-kolide-agent.yml
Created May 24, 2018 14:06
Enroll Linux osquery agent with Kolide Fleet server
---
- hosts: localhost
vars:
kolide_url_cmd: "{{ kolide_url }}"
kolide_user_cmd: "{{ kolide_user }}"
kolide_pw_cmd: "{{ kolide_pw }}"
tasks:
- name: Login and get bearer token
uri:
@shortstack
shortstack / rawr.py
Created December 16, 2020 01:29
rawr.py
import os
import sys
import requests
import time
import json
from multiprocessing import Process
def follow(thefile):
thefile.seek(0,2)
@shortstack
shortstack / cloudwatch_to_logstash.py
Created January 13, 2021 18:08
Python lambda to ship logs from Cloudwatch to Logstash
#!/usr/bin/env python3
import socket
import sys
import json
import zlib
import copy
import base64
import re
import ssl
import logging
@shortstack
shortstack / watch_s3.py
Created March 16, 2021 13:01
watch_s3.py
import os
import sys
import boto3
import pytz
from datetime import datetime,timedelta
from os import path
s3 = boto3.resource('s3')
s3_client = boto3.client('s3')
@shortstack
shortstack / sigma_to_limacharlie.py
Created September 21, 2022 13:29
Convert Sigma rule to LimaCharlie rule
import json
import yaml
import requests
url = "https://sigma.limacharlie.io/convert/rule"
files = {'rule': open('sigma_rule.yml', 'rb').read()}
headers = {
"Content-Type": "application/x-www-form-urlencoded"