Austin Songer, CISSP austinsonger

Change Log

Change Java to java-11-openjdk-amd64
Added sleep 10 under logstash
Added transport.host: localhost and transport.tcp.port: 9300 and xpack.security.enabled: true and setup.ilm.overwrite: true

	r 0/tcp # Reserved<BR>
	r 0/udp # Reserved<BR>
	tcpmux 1/tcp # TCP Port Service Multiplexer One of original portmappers. SGI/IRIX is still using it, thus scans for it are probable attempts to locate IRIX targets. A "HELP" request to it returns Irix host's service listings.
	tcpmux 1/udp # TCP Port Service Multiplexer One of original portmappers. SGI/IRIX is still using it, thus scans for it are probable attempts to locate IRIX targets. A "HELP" request to it returns Irix host's service listings.
	compressnet 2/tcp # Management Utility<BR>
	compressnet 2/udp # Management Utility<BR>
	compressnet 3/tcp # Compression Process<BR>
	compressnet 3/udp # Compression Process<BR>
	rje 5/tcp # Remote Job Entry<BR>
	rje 5/udp # Remote Job Entry<BR>

	#!/bin/bash

	read -p "[*]Please enter your username, this will help me fix permissions:" myname
	clear
	echo "[*]what would be your prefered directory name for the tools? the tools will be installed in /opt/nameyouchose"
	clear
	read -p "[*]Please enter the directory name you would like:" mydirectory
	clear

	## Ubuntu Install 18+

	# Ask for the user password
	# Script only works if sudo caches the password for a few minutes
	sudo true

	# Install kernel extra's to enable docker aufs support
	# sudo apt-get -y install linux-image-extra-$(uname -r)

	# Add Docker PPA and install latest version
	# sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9
	# sudo sh -c "echo deb https://get.docker.io/ubuntu docker main > /etc/apt/sources.list.d/docker.list"

	AuditLogRecordType

	Value Member name Description
	1 ExchangeAdmin Events from the Exchange admin audit log.
	2 ExchangeItem Events from an Exchange mailbox audit log for actions that are performed on a single item, such as creating or receiving an email message.
	3 ExchangeItemGroup Events from an Exchange mailbox audit log for actions that can be performed on multiple items, such as moving or deleted one or more email messages.
	4 SharePoint SharePoint events.
	6 SharePointFileOperation SharePoint file operation events.
	7 OneDrive OneDrive for Business events.
	8 AzureActiveDirectory Azure Active Directory events.

	# install pre-requisites
	sudo yum install -y amazon-linux-extras
	sudo yum -y update
	sudo yum -y groupinstall "Development Tools"
	sudo yum -y install openssl-devel bzip2-devel libffi-devel
	sudo amazon-linux-extras enable python3.8


	# Installing openssl-devel alone seems to result in SSL errors in pip (see https://medium.com/@moreless/pip-complains-there-is-no-ssl-support-in-python-edbdce548852)
	# Need to install OpenSSL also to avoid these errors

	# Requirements
	sudo apt install curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release -y
	sudo apt install gpgv gpgsm gnupg-l10n gnupg dirmngr -y
	add-apt-repository ppa:openjdk-r/ppa
	sudo apt update -y
	sudo curl -so /etc/profile.d/myenvvars.sh https://gist.githubusercontent.com/austinsonger/2385ff1ef5ccb014aaed4d8684dd6e54/raw/e1d9b85b3383d1a50a54eac68ab7ad7c3e0c2797/myenvvars.sh
	export JAVA_HOME=/usr/
	sudo apt install openjdk-11-jdk -y

	# Wazuh Prep