Rath NiceRath

Graylog menu: Graylog - System - Pipelines - Manage rules

All rules will assume you pre-filter your logs on an application-basis. Else the matching will get horrible.

Use regex101.com for testing expressions. Make sure to escape all the backslashes \\ (and so on..) before adding it as Graylog rule.

GENERIC: Use lookup tables to translate IPs to Hostnames

/*

	#!/usr/bin/env python3

	from sys import argv as sys_argv
	from socket import socket, AF_INET, AF_INET6, SOCK_STREAM

	if len(sys_argv) < 3:
	raise ValueError("""
	You need to provide two arguments:
	1 > Target IP
	2 > Target port (only TCP)

	# this can be useful in CI environments if you need to process config or secrets and pipe them to the parent process in a secure manner

	# example file: secrets.yml
	> my_secret1: !vault \|
	> $ANSIBLE_VAULT;1.1;AES256
	> ...
	> service_xyz: !vault \|
	> $ANSIBLE_VAULT;1.1;AES256
	> ...

	#!/usr/bin/env python3

	# this can be useful in CI environments if you need to process config or secrets and pipe them to the parent process in a secure manner

	import io
	import os
	from time import sleep

	w = io.open(69, 'wb', 0)
	w.write(b'MY SECRE3T')

	from csv import DictWriter
	import xml.etree.ElementTree as ET

	# reads unencrypted OPNSense backup file and extracts its rules in CSV format

	FILE_IN = 'firewall.xml'
	FILE_OUT = 'firewall.csv'
	FIELDS = [
	'uuid', 'type', 'interface', 'ipprotocol', 'statetype', 'descr', 'direction', 'floating', 'log', 'quick',
	'protocol', 'source', 'destination', 'category', 'disabled', 'gateway', 'icmptype', 'associated-rule-id',

	# NOTES:
	# you need to install chocolatey first: https://community.chocolatey.org/install.ps1
	# source for ChocolateyInstallPackage: https://github.com/chocolatey/choco/blob/master/src/chocolatey.resources/helpers/functions/Install-ChocolateyInstallPackage.ps1
	# source for helper functions: https://github.com/chocolatey/choco/tree/master/src/chocolatey.resources/helpers/functions
	# this script need to be copied to your client; it may not work if executed through a network share
	# you also need to copy those helper-function (see HELPERS_INCLUDE below) to your clients (see HELPERS_PATH below)

	$LOGFILE = 'C:\gpo\logs\choco.log'
	$SCRIPT_PATH = 'C:\gpo\scripts\choco'
	$HELPERS_PATH = "$SCRIPT_PATH\helpers"

	/*
	NOTE:
	You need to at least modify the 'tagIdle', 'ticketQuery' and 'closeAction' variables
	*/

	const entities = require('@jetbrains/youtrack-scripting-api/entities');
	const week = 7 * 24 * 60 * 60 * 1000;
	const notifyTime1 = 2 * week;
	const notifyTime2 = 4 * week;
	const closeTime = 5 * week;

	#!/bin/bash

	# onc file format reference: https://chromium.googlesource.com/chromium/src/+/main/components/onc/docs/onc_spec.md#OpenVPN-connections-and-types
	# NOTE: it seems tls-crypt is not supported

	# TLSAuth
	tlsauth="$(cat tlsauth.key \| sed '1,3d' \| sed ':a;N;$!ba;s/\n/\\n/g')"

	# CA Certificate
	ca="$(cat ca.crt \| sed '1,1d' \| sed '$d' \| sed ':a;N;$!ba;s/\n//g')"

	#!/usr/bin/env bash

	# NOTES:
	# perfoms md5sum on all files in the directory, sorts them and creates an overall md5sum
	# WARNING: the sort order & checksum will change if you do not use the same LANG/LC_ALL!

	EXCLUDES=('dir1' 'dir2/*')

	set -eo pipefail

	$LOGFILE = 'C:\gpo\logs\choco.log'

	# NOTES:
	# you need to install chocolatey first: https://community.chocolatey.org/install.ps1
	# code source: https://octopus.com/blog/automate-developer-machine-setup-with-chocolatey (heavily modified)
	# packages COULD have problems installing since all of them are community-driven

	# packages to install/upgrade
	# KEY = Package Name ; Value = Install Flags
	$APPLIST = @{