Shiyayo cyhook

Ubuntu 14.04 Request Tracker RT rt-4.2.14 RT for Incident Response RTIR 4.0.0

Request Tracker Installation

export http_proxy="http://10.x.x.x:3128"
export https_proxy="http://10.x.x.x.x:3128"

Request Tracker Installation on Ubuntu 14.04 with Assets and REST API module

export http_proxy="http://10.x.x.x:3128"
export https_proxy="http://10.x.x.x.x:3128"

Setup the database

GLPI SETUP FUSION INVENTORY PLUGIN

apt -y install dmidecode hwdata ucf hdparm
apt -y install perl libuniversal-require-perl libwww-perl libparse-edid-perl
apt -y install libproc-daemon-perl  libproc-pid-file-perl libfile-which-perl
apt -y install libxml-treepp-perl libyaml-perl libnet-cups-perl libnet-ip-perl
apt -y install libdigest-sha-perl libsocket-getaddrinfo-perl
apt -y install nmap libnet-snmp-perl libcrypt-des-perl libnet-nbname-perl

1. Failed to create Monitoring events errors

[2017-10-03T20:21:09,732][ERROR][logstash.inputs.metrics ] Failed to create monitoring event {:message=>"For path: events", :error=>"LogStash::Instrument::MetricStortricNotFound"}

Add the following line to /etc/elasticsearch/elasticsearch.yml and restart elasticsearch

nano /etc/elasticsearch/elasticsearch.yml 
paste: action.auto_create_index: .security,.security-6,.monitoring*,.watches,.triggered_watches,.watcher-history*
ctrl x --> y --> Enter
service elasticsearch restart

User not registered

Delete ocsweb database and run http://localhost/ocsreports/install.php

STEP 1: Add a static IP Address

Log into the server add configure the static IP address username: user password: P@$$w0rd123

nano /etc/network/interfaces
iface eth0 inet dhcp              #Replace with: iface eth0 inet static

   address 10.253.0.50
   netmask 255.255.255.0

Tcpdump usage examples

https://www.howtouselinux.com/post/10-useful-tcpdump-command-examples

tcpdump -D See the list of interfaces on which tcpdump can listen

tcpdump -i eth0 Listen on interface eth0:

tcpdump -i any Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater):

SO

https://github.com/Security-Onion-Solutions/security-onion/wiki/Bro

Grafana

wget https://s3-us-west-2.amazonaws.com/grafana-releases/release/grafana_4.6.1_amd64.deb
sudo apt-get install -y adduser libfontconfig
sudo dpkg -i grafana_4.6.1_amd64.deb

	#!/bin/bash
	#
	# OpenVAS automation script.
	# Mariusz B. / mgeeky, '17
	# v0.1
	#

	trap ctrl_c INT

	# --- CONFIGURATION ---

	# Bro-IDS Logstash parser
	# Parts of this taken from http://www.appliednsm.com/wp-content/uploads/logstash-SObro22-parse.conf_.txt

	#Logs being parsed:
	#app_stats.log
	#conn.log
	#dns.log
	#dpd.log
	#files.log
	#http.log