ryanfaircloth

#Install what we need
sudo apt-get install clevis clevis-luks clevis-systemd clevis-tpm2 clevis-initramfs

# bind 
echo <my password> | sudo clevis luks bind -d /dev/nvme0n1p3 tpm2 '{ "pcr_bank":"sha256", "pcr_ids": "7,11" }'
# confirm
sudo clevis luks list -d /dev/nvme0n1p3

ryanfaircloth

helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
helm upgrade --install --create-namespace --namespace otel-operator \
    -f .kind/otel-operator-values.yaml \
    --version ${V_OTEL_OPERATOR:-0.40.0} \
    opentelemetry-operator open-telemetry/opentelemetry-operator --wait
helm upgrade --install --namespace otel-operator -f agent-values.yaml agent  open-telemetry/opentelemetry-collector
helm upgrade --install --namespace otel-operator -f gateway-values.yaml gateway  open-telemetry/opentelemetry-collector
helm upgrade --install --namespace otel-operator -f cluster-values.yaml cluster  open-telemetry/opentelemetry-collector

ryanfaircloth

sources:
  journal:
    # Example for reading journald log data (linux only)
    type: journald
    sink: logscale
sinks:
  logscale:
    type: humio
    token:  <token to infra-os-linux>
    url: 

ryanfaircloth

sources:
  infra_os_windows_security:
    type: wineventlog
    ## Add other channels by simple adding additional "name" lines.
    ## The following command can be used to find other channels:
    ## Get-WinEvent -ListLog * -EA silentlycontinue | sort-object -Property Recordcount -desc
    channels:
      - name: Security
      - name: Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational
      - name: Microsoft-Windows-TerminalServices-Gateway/Operational

ryanfaircloth

helm repo add segway https://seg-way.github.io/charts
helm upgrade —install -f values-logscale-azure.yaml logscale segway/segway-sys-dest-logscale

helm upgrade —install -f values-azure-ad.yaml logscale segway/segway-sys-source-ms-azure-eventhub

ryanfaircloth

### Creating a clean gh-pages branch

This is the sequence of steps to follow to create a root `gh-pages` branch. It is based on a question at [SO]

``` {shell}
git symbolic-ref HEAD refs/heads/gh-pages
rm .git/index
git clean -fdx
echo "apiVersion: v1
entries:" > index.yaml

ryanfaircloth

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "eventHubNamespaceName": {
      "type": "string",
      "metadata": {
        "description": "Name of the EventHub namespace"
      }
    },

ryanfaircloth

{"0": 0, "1": 0, "2": 0, "3": 0, "4": 0, "5": 0, "6": 0, "7": 0, "8": 0, "9": 0, "10": 0, "11": 0, "12": 0, "13": 0, "14": 0, "15": 0, "16": 0, "17": 0, "18": 0, "19": 0, "20": 0, "21": 0, "22": 0, "23": 0, "24": 0, "25": 0, "26": 0, "27": 0, "28": 0, "29": 0, "30": 0, "31": 0}

ryanfaircloth

sudo apt-get update
sudo apt -y install php7.2 php7.2-cli php7.2-common php7.2-dom php7.2-curl php7.2-mbstring php7.2-zip zlib1g zlib1g-dev libzip4 libzip-dev

ryanfaircloth

#Because audit trail is protected and we can't transform it we can not use default we must use tcp_routing
[tcpout]
defaultGroup = NoForwarding

[tcpout:nexthop]
server = localhost:9000
sendCookedData = false