Skip to content

Instantly share code, notes, and snippets.

View timbutler's full-sized avatar
🤓
Busy coding!

Tim Butler timbutler

🤓
Busy coding!
View GitHub Profile
// DEBUG----------------------------------------------------------
for k, v := range c.Request.Header {
log.Infof("Key: %s, Value: %s", k, v)
}
@timbutler
timbutler / quickaudit.ps1
Created May 8, 2018 23:38
PowerShell - Windows Login Audit
Write-Host "Getting Login Events"
$Out = @()
$List = Get-EventLog Security -Computer localhost | Where-Object {$_.InstanceId -eq 4624}
ForEach($Entry in $List) {
If($Entry.ReplacementStrings[18] -notcontains "-"){
$Out += New-Object PSObject -Property @{
InstanceID = $Entry.InstanceId
User = $Entry.ReplacementStrings[5]
@timbutler
timbutler / gist:46e54e19efe19fea2faf
Created November 3, 2014 00:12
Work out the most commonly called URL's in an Apache logfile
awk '{print $7}' access_log|cut -d? -f1|sort|uniq -c|sort -nk1|tail -n10
@timbutler
timbutler / fortigate50.pattern
Created October 29, 2014 04:15
Fortigate FortiOS 5.0 Logstash Patterns
FORTIDATE %{YEAR:year}\-%{MONTHNUM:month}\-%{MONTHDAY:day}
FORTIGATE_LITEBASE <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} eventtype=%{WORD:eventtype} level=%{WORD:level} vd=\"%{WORD:vdom}\"
FORTIGATE_LITEBASE2 <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} level=%{WORD:level} vd=\"%{WORD:vdom}\"
# 185 - IPS
FORTIGATE_185 severity=%{WORD:severity} srcip=%{IP:srcip} dstip=%{IP:dstip} srcintf=\"%{HOST:srcintf}\" policyid=%{DATA:policyid} identidx=%{DATA:identidx} sessionid=%{NUMBER:sessionid} status=%{DATA:status} proto=%{NUMBER:proto} service=%{DATA:service} count=%{NUMBER:count} attackname=\"%{DATA:attackname}\" srcport=%{NUMBER:srcport} dstport=%{NUMBER:dstport} attackid=%{NUMBER:attackid} sensor=\"%{DATA:sensor}\" ref=\"%{DATA:ref}\";? msg=\"%{GREEDYDAT
@timbutler
timbutler / postfix
Created October 28, 2014 06:16
Logstash Postfix Patterns
# Postfix stuff based on https://gist.github.com/jbrownsc/4694374:
QUEUEID (?:[A-F0-9]+|NOQUEUE)
EMAILADDRESSPART [a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILADDRESSPART:local}@%{EMAILADDRESSPART:remote}
RELAY (?:%{HOSTNAME:relayhost}(?:\[%{IP:relayip}\](?::[0-9]+(.[0-9]+)?)?)?)
POSREAL [0-9]+(.[0-9]+)?
DELAYS (%{POSREAL}[/]*)+
DSN %{NONNEGINT}.%{NONNEGINT}.%{NONNEGINT}
STATUS sent|deferred|bounced|expired
@timbutler
timbutler / fortigate52.pattern
Last active April 29, 2024 13:01
Fortigate FortiOS 5.2 (and 5.2.2) Logstash Grok patterns
FORTIDATE %{YEAR:year}\-%{MONTHNUM:month}\-%{MONTHDAY:day}
FORTIGATE_52BASE <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} eventtype=%{WORD:eventtype} level=%{WORD:level} vd=\"%{WORD:vdom}\"
FORTIGATE_52BASEV2 <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} level=%{WORD:level} vd=\"%{WORD:vdom}\"
FORTIGATE_52IPS severity=%{WORD:severity} srcip=%{IP:srcip} dstip=%{IP:dstip} sessionid=%{NUMBER:sessionid} action=%{DATA:action} proto=%{NUMBER:proto} service=%{DATA:service} attack="%{DATA:attack}" srcport=%{NUMBER:srcport} dstport=%{NUMBER:dstport} direction=%{NUMBER:direction} attackid=%{NUMBER:attackid} profile=\"%{DATA:profile}\" ref=\"%{DATA:ref}\";? incidentserialno=%{NUMBER:incidentserialno} msg=\"%{GREEDYDATA:msg}\"
FORTIGATE_52DOS severity=%{WORD:severity} s