tuckner

{
  "schema_version": 4,
  "standard_lib_version": 3,
  "name": "Email to Slack",
  "description": null,
  "guid": "3a9a110fa1a7e843b9230c693ff72c01",
  "slug": "email_to_slack",
  "exported_at": "2022-10-05T18:20:33Z",
  "agents": [
    {

tuckner

{
  "schema_version": 4,
  "name": "Okta Logging",
  "description": "Grab logs from Okta for the past 90 days and upload to AWS S3\n\ntags: AWS, Okta, Logging\ncolor: orange\nicons: ☁️🕵️‍♂️📘\nvisibility: public",
  "guid": "2569d12e6207efe07398ab18b8fe4845",
  "exported_at": "2022-03-22T15:30:01Z",
  "agents": [
    {
      "type": "Agents::HTTPRequestAgent",
      "name": "Get Okta Logs",

tuckner

{"agents":[{"disabled":false,"name":"Search for Hosts in Crowdstrike Falcon","options":"{\"url\":\"https://api.{{RESOURCE.crowdstrike_domain}}/devices/combined/host-group-members/v1\",\"content_type\":\"json\",\"method\":\"get\",\"payload\":{},\"headers\":{\"Authorization\":\"Bearer {{.CREDENTIAL.crowdstrike}}\"}}","position":{"x":-900,"y":75},"type":"httpRequest"},{"disabled":false,"name":"Get Logins for Hosts in Crowdstrike Falcon","options":"{\"url\":\"https://api.{{RESOURCE.crowdstrike_domain}}/devices/combined/devices/login-history/v1\",\"content_type\":\"json\",\"method\":\"post\",\"payload\":{\"ids\":\"{{search_for_hosts_in_crowdstrike_falcon.body.resources | map: 'device_id' | as_object}}\"},\"headers\":{\"Authorization\":\"Bearer {{.CREDENTIAL.crowdstrike}}\"}}","position":{"x":-900,"y":165},"type":"httpRequest"},{"disabled":false,"name":"Find User Hostname Combos","options":"{\"mode\":\"message_only\",\"loop\":false,\"payload\":{\"data\":\"{{get_logins_for_hosts_in_crowdstrike_falcon.body | jsonpath

tuckner

# Deploy to S3
name: Deploy
on:
  push:
    branches:
      - master
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:

tuckner

input {
  kafka {
    bootstrap_servers => "" #configurable
    group_id => "" #configurable
    auto_offset_reset => "" #configurable
    security_protocol => "SASL_SSL"
    sasl_mechanism => "SCRAM-SHA-512"
    sasl_jaas_config => "org.apache.kafka.common.security.scram.ScramLoginModule required username='' password='';"
    ssl_endpoint_identification_algorithm => ""
    topics => [""] #configurable

tuckner

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import re

s = 'eventdataxml'
l = re.findall('(?<=Name=")\w+', s)
p = ''

for i in l:

tuckner

import re
from .base import SingleTextQueryBackend
from .exceptions import NotSupportedError

class AzureLogAnalyticsBackend(SingleTextQueryBackend):
    """Converts Sigma rule into Azure Log Analytics Queries."""
    identifier = "ala"
    active = True

    reEscape = re.compile('("|\\\\(?![*?]))')