fryguy04

// KQL Sysmon Event Parser - Customized for SnapAttack use
//
// Heavily based on: https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/Sysmon/Sysmon-AllVersions_Parser.txt
// Usage Instruction : 
// Paste below query in log analytics, click on Save button and select as Function from drop down by specifying function name and alias (e.g. Sysmon_Normalized).
// Function usually takes 10-15 minutes to activate. You can then use function alias from any other queries (e.g. Sysmon_Normalized | take 10).
// Reference :
// Using functions in Azure monitor log queries : https://docs.microsoft.com/azure/azure-monitor/log-query/functions
// Tech Community Blog on KQL Functions : https://techcommunity.microsoft.com/t5/Azure-Sentinel/Using-KQL-functions-to-speed-up-analysis-in-Azure-Sentinel/ba-p/712381
//

fryguy04

#!/usr/bin/env python
# Scrapes pfSense DHCP Leases into List of (IP, MAC, Hostname) format. 
# Change URL/Username/Password below ... pip install lxml ... then you are all set.
#
# Modified 6/23/2019 (FryGuy)
# Edits: Aligned IP/MAC/Hostname into struct accounting for blank lines
# Minor: Cleaned up spacing, created global url/user/password vars, removed write to file
# Original Code/Inspiration: https://gist.github.com/pletch/037a4a01c95688fff65752379534455f

import sys

fryguy04

#!/usr/bin/python

# File: vti_summarize.py
# Description: Given VirusTotal API Key & Malware Hash, summarize key words that AntiVirus companies used to describe it
# Author: Fred Frey
# Date: 3/10/2019

import requests
import json
import re