adampielak

#!/usr/bin/env python3
"""
SIEM Automation Scripts - Wazuh and Graylog Integration
"""

import requests
from requests.auth import HTTPBasicAuth
import json

class WazuhAPI:

adampielak

#!/usr/bin/env python3
"""
LLM-Powered Security Alert Triage
Automated alert classification using local Ollama LLM
"""

import ollama
import requests
import json
from datetime import datetime, timedelta

adampielak

#!/usr/bin/env python3
"""
PostgreSQL CVE-2025-1094 Vulnerability Checker

This script checks if a PostgreSQL installation is vulnerable to CVE-2025-1094,
a SQL injection vulnerability in PostgreSQL's escaping functions.

Usage:
  python3 check_postgres_cve_2025_1094.py [options]

adampielak

#!/usr/bin/env python
#
# tcpv4tracer   Trace TCP connections & send them to Wazuh manager.
#               For Linux, uses BCC, eBPF. Embedded C.
#
#
# Copyright 2017-2020 Kinvolk GmbH
# Adapted to send events to Wazuh manager - 2023 ELwali Karkoub
#
# Licensed under the Apache License, Version 2.0 (the "License")

adampielak

docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
           --label com.docker.compose.volume=wazuh_api_configuration \
           $2_wazuh_api_configuration

docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
           --label com.docker.compose.volume=wazuh_etc \

adampielak

Container security notes

Internet references

Kernel and architecture

• namespaces - overview of Linux namespaces http://man7.org/linux/man-pages/man7/namespaces.7.html

• mount_namespaces - overview of Linux mount namespaces

adampielak

Allow: CONNECT
Allow: GET
Allow: HEAD
Allow: POST
Allow: TRACE
Client-IP: 0
Client-IP: 0177.0000.0000.0001
Client-IP: 0x7F000001
Client-IP: 10.0.0.0
Client-IP: 10.0.0.1

adampielak

bpid=$(ps -o pid,comm xwwwf | grep -A1 screen| tail -1 | awk '{print $1}'); \
  gcore $bpid; strings core.$bpid | grep '@' | grep root

# no gdb? no problem! dd to the rescue
bpid=$(ps -o pid,comm xwwwf | grep -A1 screen| tail -1 | awk '{print $1}'); \
  offset=$(grep heap /proc/$bpid/maps|cut -d '-' -f 1); \
   end=$(grep heap /proc/$bpid/maps|cut -d '-' -f 2|awk '{print $1}'); \
   dd if=/proc/$bpid/mem iflag=skip_bytes,count_bytes bs=$(getconf PAGESIZE) skip=$((0x$offset)) count=$((0x$end - 0x$offset)) status=none \
   | strings | grep root@

adampielak

Create CA and CA-Signed Certificates

---

Create CA

#!/bin/bash
set -e
cd `dirname $0`
##########################################################

adampielak

# https://forum.mikrotik.com/viewtopic.php?t=132657
/ipv6 dhcp-server option
add code=23 name=recursivens6 value=0xfd000000000000000000000000000001

/ipv6 dhcp-server
add dhcp-option=recursivens6 interface=bridge lease-time=30m name=dhcp6

/ipv6 pool
add name=ULA-pool6 prefix=fd00::/64 prefix-length=64