Matt Franz mdfranz

Prompt

Generate CloudFormation Resources in YAML to create VPC that has AWS Client VPN endpoints

Models from Macbook Air M1/16GB

llama3.1:latest

I followed https://marketplace.upbound.io/providers/upbound/provider-family-aws/v1.10.0 but they were too lazy to actually update their documentation for the version but why not let's see what happens

cat <<EOF | kubectl apply -f -
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-aws-s3
spec:

Prompt

what are the limitations of the Mitre ATT&CK framework for practioners

Gemma2:9B (Nvidia 3060/12GB)

While the MITRE ATT&CK framework is a powerful tool for cybersecurity practitioners, it does have some limitations:

1. Focus on adversarial tactics, not business impacts:

helm install falco falcosecurity/falco \
    --version 4.11.1 \
    --namespace falco \
    --create-namespace \
    --set falcosidekick.enabled=true --set falcosidekick.webui.enabled=true \
    --set collectors.kubernetes.enabled=true \
    --set tty=true \
 --set-json 'falco.append_output=[{"match": {"source": "syscall"},"extra_output": "pod_uid=%k8smeta.pod.uid, pod_name=%k8smeta.pod.name, namespace_name=%k8smeta.ns.name"}]'

The Data

Records from https://ja4db.com/

D describe jadb;
┌────────────────────────┬─────────────┬─────────┬─────────┬─────────┬─────────┐
│      column_name       │ column_type │  null   │   key   │ default │  extra  │
│        varchar         │   varchar   │ varchar │ varchar │ varchar │ varchar │
├────────────────────────┼─────────────┼─────────┼─────────┼─────────┼─────────┤

Refs

See https://clickhouse.com/docs/en/operations/utilities/clickhouse-local

Conn.log

mfranz@opti3070:~/zeek/2024-12-14$ clickhouse local -q "select count(*) as cnt, id.orig_h from 'conn.*.log' group by id.orig_h order by cnt desc limit 50"
111901  192.168.2.167
40425   192.168.3.109
35433   192.168.3.135

	import os
	import wmill
	import boto3

	# see https://windmill.dev

	def main(): # Specify the parameter type as a dictionary
	aws_accounts = []
	aws_accounts.append(wmill.get_resource("u/mdfranz/aws_9431"))
	aws_accounts.append(wmill.get_resource("u/mdfranz/aws_6473"))

	hub:
	revisionHistoryLimit:
	config:
	Authenticator:
	enable_auth_state: true
	allowed_users:
	- user1
	- user2
	- user3
	- notadmin

	#!/usr/bin/env python3

	import sys, pyshark

	cap = pyshark.FileCapture(sys.argv[1])

	for e in cap:
	if 'IP' in e:
	if 'TCP' in e:
	print (e['eth'].src,e['ip'].src,e['eth'].dst,e['ip'].dst)

	#!/bin/bash

	# Get Credentials from Resources
	AWS_9431=$(curl -s -H "Authorization: Bearer $WM_TOKEN" \
	"$BASE_INTERNAL_URL/api/w/$WM_WORKSPACE/resources/get_value_interpolated/u/mdfranz/aws_9431" \| jq)

	export ACCESS_KEY=`echo $AWS_9431 \| jq .awsAccessKeyId`
	export SECRET_KEY=`echo $AWS_9431 \| jq .awsSecretAccessKey`

	# Download S3M