Pinned Loading

1. iptables Grok Pattern iptables Grok Pattern

   1

   # GROK Custom Patterns (add to patterns directory and reference in GROK filter for iptables events):

   2

   # GROK Patterns for iptables Logging Format

   3

   #

   4

   # Created 6 Aug 2016 by Brian Turek <brian.turek@gmail.com>

   5

   # Most of this was taken from another source but now I cannot find it for credit

2. Automating mysql_secure_installation Automating mysql_secure_installation

   1

   #!/bin/bash

   2

   3

   aptitude -y install expect

   4

   5

   // Not required in actual script

3. Delete unassigned shards from Elasti... Delete unassigned shards from Elasticsearch

   1

   #!/bin/bash

   2

   3

   curl -XDELETE `curl http://localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason | grep UNASS | awk '{print "http://localhost:9200/" $1}'`

4. LOGSTASH: syslog listener filtering ... LOGSTASH: syslog listener filtering with grok patterns and applying useful tags

   1

   # NOTE: These patterns take into account the additional log-line information passed to the logstash listener from rsyslog. YMMV.

   2

   3

   DHCPD ((%{SYSLOGTIMESTAMP:timestamp})\s*(%{HOSTNAME:hostname})\s*dhcpd\S+\s*(%{WORD:dhcp_action})?.*[for|on] (%{IPV4:dhcp_client_ip})?.*[from|to] (%{COMMONMAC:dhcp_client_mac})?.*via (%{USERNAME:interface}))

   4

   IPTABLES ((%{SYSLOGTIMESTAMP:nf_timestamp})\s*(%{HOSTNAME:nf_host})\s*kernel\S+\s*(%{WORD:nf_action})?.*IN=(%{USERNAME:nf_in_interface})?.*OUT=(%{USERNAME:nf_out_interface})?.*MAC=(%{COMMONMAC:nf_dst_mac}):(%{COMMONMAC:nf_src_mac})?.*SRC=(%{IPV4:nf_src_ip}).*DST=(%{IPV4:nf_dst_ip}).*PROTO=(%{WORD:nf_protocol}).?*SPT=(%{INT:nf_src_port}?.*DPT=%{INT:nf_dst_port}?.*))

   5

   DNS ((%{MONTHDAY:day})-(%{MONTH:month})-(%{YEAR:year}) (%{TIME:timestamp}) client (%{IPV4:dns_client_ip})#(%{NONNEGINT:dns_uuid})?.*query: (%{HOSTNAME:dns_dest}) (%{WORD:dns_type}) (%{WORD:dns_record})?.*(%{IPV4:dns_server}))