manasmbellani

# Replace with the Workspace Customer ID and Primary Key from Log Analytics Workspace already created in Azure
# where logs should be forwarded under Settings > Agents > Log Analytics Agent Instructions
$customerId = "1.....3"
$sharedKey = "c.....="

# Change this to define the table name in Azure Log Analytics workspace. Table name is
# CustomLog_CL
$logType = "CustomLog"

# Change this to change the log to send to Azure Log Analytics workspace

manasmbellani

README

This gist contains information about various splunk apps pertaining to detection engineering that have been released on Splunkbase.

Usage

Review the files on gist.github.com OR consider cloning this and opening it in a Markdown editor such as Typora to obtain a navigational outline

manasmbellani

Steps to build new alerts in Splunk

To build new alerts, perform the following steps:

• Ensure that the correct app is selected via the Apps menu option in Splunk UI
• Leverage an existing search macro that has been recently built and update it to meet the search query for detection
• Test if the alert works
• Use MITRE Attack Framework to add relevant fields from the Matrix here if applicable
• Create a new search macro with updated permissions. Search macro should be prefixed with appropriate keyword e.g. gcp_detect_ or sysmon_detect
• Update the search macro permissions to be publicly readable, and admin writable

manasmbellani

#   Version 9.0.1
# these here just override and disable stuff that in system/default.

################################
# Data thru parsingQueue always
################################

[splunktcp]
route=has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue

manasmbellani

#!/usr/bin/env python3
import json

dictionary = {
    'duration': 720, 
    'language': 'sv',
    'link': 'https://vimeo.com/neweuropefilmsale/incidentbyabank',
    'name': 'INCIDENT BY A BANK',
    'test': {
        'test2': {

manasmbellani

Please review the `README.md` file.

manasmbellani

#!/bin/bash
USAGE="[-] $0 <hostname>"
if [ $# -lt 1 ]; then
    echo "$USAGE"
    exit 1
fi
hostname="$1"
echo | openssl s_client -connect $hostname:443 2>&1 | grep -iE "0 s:.*CN = "  | grep -ioE "CN = .*" | cut -d "=" -f2

manasmbellani

#!/bin/bash
DELIM="|"
OUT_FILE="out-hibp-breach-details.txt"
USER_AGENT="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36"
HIBP_ENDPOINT="https://haveibeenpwned.com/api/v3"
SLEEP_INTERVAL=3
CURL_TIMEOUT=6
USAGE="[-] 
Syntax:
    $0 <breaches_list/breaches_file>  [hibp_api_key=$HIBP_KEY] [sleep_interval=$SLEEP_INTERVAL] [out_file=$OUT_FILE]

manasmbellani

# Directories to exclude
exclude-dirs:
  - SOMETHING

# Files to exclude
exclude-files:
  - README.md
  - .gitignore
  - .pre-commit-config.yaml
  - LICENSE

manasmbellani

VISIBILITY="public"
SLEEP_TIMEOUT=10
USAGE="[-] 
Usage:
    $0 <url> <apikey> [visibility=]

Summary:
    Scan URL in urlscan.io and open it with default browser
    
Args: