Andrew Kroh andrewkroh

andrewkroh / Microsoft-Windows-FileInfoMinifilter.txt

Last active January 7, 2022 11:08

Microsoft-Windows-FileInfoMinifilter Messages from Windows 2012 Server



	Id : 1
	Version : 0
	LogLink : System.Diagnostics.Eventing.Reader.EventLogLink
	Level : System.Diagnostics.Eventing.Reader.EventLevel
	Opcode : System.Diagnostics.Eventing.Reader.EventOpcode
	Task : System.Diagnostics.Eventing.Reader.EventTask
	Keywords : {, fi:FileNameCreate}
	Template : <template xmlns="http://schemas.microsoft.com/win/2004/08/events">

andrewkroh / elasticsearch.groovy

Created March 23, 2017 16:02

Elasticsearch Output for SmartThings Events

	/**
	* Elasticsearch Event Publisher
	*
	* Copyright 2017 Andrew Kroh
	*/

	import java.text.DateFormat;
	import java.text.SimpleDateFormat;

	definition(

andrewkroh / aws-sns.groovy

Created March 23, 2017 16:06

AWS SNS Output for SmartThings

andrewkroh / main.go

Created September 20, 2017 20:09

Go seccomp-bpf example using Google Kafel to generate BPF filter

andrewkroh / gist:f49a0f4d5df4396a38007f067c0a4e86

Created January 4, 2018 22:56

keybase.md

	### Keybase proof

	I hereby claim:

	* I am andrewkroh on github.
	* I am andrewkroh (https://keybase.io/andrewkroh) on keybase.
	* I have a public key whose fingerprint is 3244 3ADF 2BE8 47C2 B49D 729B 0558 8481 AB5B 6468

	To claim this, I am signing this object:

andrewkroh / socket.c

Last active April 11, 2019 15:19

Socket info on BSD

	#include <stdio.h>
	#include <stdlib.h>
	#include <libproc.h>
	#include <sys/proc_info.h>


	static const char* USAGE = "Usage: %s pid\n";
	static const char* INVALID_PID = "Invalid pid: %s\n";
	static const char* UNABLE_TO_GET_PROC_FDS = "Unable to get open file handles for %d\n";
	static const char* OUT_OF_MEMORY = "Out of memory. Unable to allocate buffer with %d bytes\n";

andrewkroh / seccomp-violation.json

Created April 8, 2018 19:34

Auditbeat Event for a Seccomp Violation

	{
	"@timestamp": "2018-04-08T19:29:14.461Z",
	"@metadata": {
	"beat": "auditbeat",
	"type": "doc",
	"version": "6.2.2"
	},
	"event": {
	"action": "violated-seccomp-policy",
	"module": "auditd",

andrewkroh / analyzing-bpf.md

Created April 9, 2018 16:29

Seccomp BPF Filter Analysis in Go

Generating Seccomp BPF Filters with libbseccomp in Go

// +build linux

package main

import (
	"log"
	"os"

andrewkroh / auditbeat-seccom-x86_64.yml

Last active April 23, 2018 12:55

Elastic Beat Seccomp Profiles

andrewkroh / Slack Notification

Last active July 8, 2018 12:54

Heartbeat ICMP Alerting with Elastic X-Pack Watcher

https://twitter.com/Krohbird/status/849749788920877056

	/**
	* Amazon SNS Event Publisher
	*
	* Copyright 2016 Andrew Kroh
	*/

	import java.text.DateFormat
	import java.text.SimpleDateFormat
	import javax.crypto.Mac
	import javax.crypto.spec.SecretKeySpec