Skip to content

Instantly share code, notes, and snippets.

@marcusschiesser
marcusschiesser / mapper.js
Created December 9, 2021 10:29
Javascript type mapper - transforms properties of an object according to a type definition from string to float, int or boolean
export function mapTypes(map) {
return (obj) => {
const newObj = {};
// eslint-disable-next-line no-restricted-syntax
for (const key in obj) {
if (Object.hasOwnProperty.call(obj, key)) {
let value = obj[key];
const type = map[key];
switch (type) {
case 'float':
@automine
automine / inputs.conf
Last active September 7, 2023 11:18
Nice windows event blacklisting
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist3 = EventCode="4688" Message="New Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
blacklist4 = EventCode="4689" Message="Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
@automine
automine / props.conf
Last active January 12, 2023 15:02
Windows Event Clean Up in Splunk
[WinEventLog:Security]
#Returns most of the space savings XML would provide
SEDCMD-clean0-null_sids = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(\:)(\s+NULL SID)$/\1/g s/(?m)(ID\:)(\s+0x0)$/\1/g
SEDCMD-clean1-summary = s/This event is generated[\S\s\r\n]+$//g
SEDCMD-clean2-cert_summary = s/Certificate information is only[\S\s\r\n]+$//g
SEDCMD-clean3-blank_ipv6 = s/::ffff://g
SEDCMD-clean4-token_elevation_summary = s/Token Elevation Type indicates[\S\s\r\n]+$//g
SEDCMD-clean5-network_share_summary = s/(?ms)(A network share object was checked to see whether.*$)//g
SEDCMD-clean6-authentication_summary = s/(?ms)(The computer attempted to validate the credentials.*$)//g
SEDCMD-clean7-local_ipv6 = s/(?ms)(::1)//g
@danielestevez
danielestevez / gist:2044589
Last active October 7, 2024 15:24
GIT Commit to an existing Tag
1) Create a branch with the tag
git branch {tagname}-branch {tagname}
git checkout {tagname}-branch
2) Include the fix manually if it's just a change ....
git add .
git ci -m "Fix included"
or cherry-pick the commit, whatever is easier
git cherry-pick {num_commit}