Bradford Dabbs bndabbs

Grab the main page with all the links:
curl https://slackmojis.com/ > emoji

Open file in vim and run the following commands:

v/src=/d
%s/^.*https:/https:/g"
%s/?.*$//g

Keybase proof

I hereby claim:

I am bndabbs on github.
I am bndabbs (https://keybase.io/bndabbs) on keybase.
I have a public key ASCCB-pWJPHNj6uACXlEechVxQDr45ajl_6Hq7jsY4CXfAo

To claim this, I am signing this object:

Compute

Dell precision T7400
2x Xeon E5430 Quad Core
64GB RAM (Upgradeable to 128GB)
2x 500GB 7200RPM SATA
1x 1TB 7200RPM SATA
Intel Gigabit VT Quad Port Server Adapter

https://kansascity.craigslist.org/sys/d/dell-t7400-precision/6238490010.html

If all of these files are in the same directory, you can run the following steps to deploy

Download the roles

ansible-galaxy install -r requirements.yml

Run the deploy playbook

ansible-playbook deploy.yml

I recently ran into an issue while replaying some network traffic that was captured as pcap-ng and I wanted to share what I had to do to get things working.

The issue is that the packet capture contained traffic from two NICs, which is supported by pcap-ng, but not pcap. The commands here filter by interface and then convert the individual interface captures into regular pcap.

	event bro_init()
	{
	for (stream in Log::active_streams)
	{
	local filter = Log::get_filter(stream, "default");
	filter$path = fmt("bro_%s", filter$path);
	Log::add_filter(stream, filter);
	}
	}

	input {
	kafka {
	topics => ["bro-raw"]
	add_field => { "[@metadata][stage]" => "broraw_kafka" }
	# Set this to one per kafka partition to scale up
	#consumer_threads => 4
	group_id => "bro_logstash"
	bootstrap_servers =>
	codec => json
	auto_offset_reset => "earliest"

	Import-Module ActiveDirectory

	$password = (Read-Host -AsSecureString "AccountPassword")
	$users = import-csv ".\users.csv"

	foreach ($user in $users){
	New-ADUser `
	-SamAccountName ($user.GivenName + "." + $user.Surname).ToLower() `
	-UserPrincipalName (($user.GivenName + "." + $user.Surname).ToLower() + "@" + $env:USERDNSDOMAIN) `
	-DisplayName ($user.GivenName + " " + $user.Surname) `

	{
	"order": 10,
	"index_patterns": [
	"bro-diag-*"
	],
	"mappings": {
	"_doc": {
	"properties": {
	"acks": {
	"type": "long"

	#ASA-1-113039
	%{CISCO_TAGGED_SYSLOG} Group <%{DATA:group.name}> User <%{USER:user.name}> IP <%{IP:source.ip}> %{GREEDYDATA:cisco_message}