Austin Songer, CISSP austinsonger

Filebeat modules are all either open source, or provided via the Elastic License. You can look at them all, to understand how the parsing, the conversion and the mapping to ECS are done.

Looking for the modules

All Filebeat modules are listed here: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules.html
The code for Apache 2 open source modules is here: https://github.com/elastic/beats/tree/master/filebeat
The code for Elastic Licensed modules is here: https://github.com/elastic/beats/tree/master/x-pack/filebeat/module

	Connect-MsolService
	$people = "<sam1>,<sam2>"
	$domain = "<@website.com>"
	foreach($person in $people){
	$tmpPass = Set-MsolUserPassword -UserPrincipalName $($person + $domain)
	Set-ADAccountPassword -Identity $person -Reset -NewPassword (ConvertTo-SecureString -AsPlainText $tmpPass -Force)
	Add-ADGroupMember -Identity "E2" -Members $person
	Write-Host $person "---Password---" $tmpPass
	}

	#Depending if you are already connected execute this first part
	Connect-AzureAD

	#Get the Service Principal that was created when you created a Managed Identity from your Web App
	$MyMI = Get-AzureADServicePrincipal -ObjectId <ID(GUID) of your managed identity shown in the Azure portal>

	#Get the Office 365 SharePoint Online API
	$SharePointAPI = Get-AzureADServicePrincipal -SearchString “Office 365 SharePoint”

	#Select the User.ReadWrite.All App-Only Permissions. If you want another App-Only permission then search for another value

	########## Connect to o365 ##########
	## Change $username and $pass to match your environment
	## See: https://blogs.technet.microsoft.com/robcost/2008/05/01/powershell-tip-storing-and-using-password-credentials/ for how to create a cred file.
	$username = "[email protected]"
	$pass = gc "F:\PSScripts\Office365-PowershellCreds.txt" \| convertto-securestring
	$creds = New-Object -typename System.Management.Automation.PSCredential `
	-argumentlist $username, $pass
	$MESession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $Creds -Authentication Basic -AllowRedirection
	Import-PSSession $MESession -AllowClobber
	Connect-MsolService -Credential $creds

	## There are oneliners that try to enable logging for all users but in a large environment you will run into a data cap for the session - that is why this is split up using a foreach loop

	$mailboxes = Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox" -or RecipientTypeDetails -eq "SharedMailbox" -or RecipientTypeDetails -eq "RoomMailbox" -or RecipientTypeDetails -eq "DiscoveryMailbox"}

	foreach($m in $mailboxes) {
	Set-Mailbox $m.Identity.ToString() -AuditEnabled $true -AuditLogAgeLimit 180 -AuditOwner Create,HardDelete,MailboxLogin,Move,MoveToDeletedItems,SoftDelete,Update,UpdateFolderPermissions -AuditDelegate Create,HardDelete,Move,MoveToDeletedItems,SendAs,SendOnBehalf,SoftDelete,Update,UpdateFolderPermissions -AuditAdmin Copy,Create ,HardDelete ,Move,MoveToDeletedItems,SendAs,SendOnBehalf,SoftDelete,Update,UpdateFolderPermissions
	Start-Sleep -Milliseconds 75
	}

	# WordPress multisite subdirectory rules.
	# Designed to be included in any server {} block.

	# This order might seem weird - this is attempted to match last if rules below fail.
	# http://wiki.nginx.org/HttpCoreModule
	location / {
	try_files $uri $uri/ /index.php?$args;
	}

	# Directives to send expires headers and turn off 404 error logging.

	# New repository
	mkdir <repo> && cd <repo>
	git init
	git remote add –f <name> <url>
	git config core.sparsecheckout true
	echo some/dir/ >> .git/info/sparse-checkout
	echo another/sub/tree >> .git/info/sparse-checkout
	git pull <remote> <branch>

	# Existing repository



	echo ""
	echo "********** Github Dork Links (must be logged in) *****************"
	echo ""
	echo " password"
	echo "https://github.com/search?q=%22$1%22+password&type=Code"
	echo "https://github.com/search?q=%22$without_suffix%22+password&type=Code"
	echo ""
	echo " npmrc _auth"

	terraform {
	required_version = ">=0.12, <0.13"
	}

Austin Songer, CISSP austinsonger

Looking for the modules

Looking at the code of the pipelines