index.xml

<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
    <channel>
        <title></title>
        <link>http://example.org/</link>
        <description></description>
        <generator>Hugo -- gohugo.io</generator><language>en</language><copyright>This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.</copyright><lastBuildDate>Fri, 22 Apr 2022 06:42:34 &#43;0100</lastBuildDate>
            <atom:link href="http://example.org/index.xml" rel="self" type="application/rss+xml" />
        <item>
    <title>Storing GitHub Org Auditlogs in Elasticsearch</title>
    <link>http://example.org/posts/github-org-auditlogs-elasticsearch/</link>
    <pubDate>Fri, 22 Apr 2022 06:42:34 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/github-org-auditlogs-elasticsearch/</guid>
    <description><![CDATA[I had a need to generate an alert when someone overrode a Branch Protection setting. To do this I decided to pull some of the GitHub Auditlog into Elasticsearch.
Theres a GitHub API client written in sh, called ok.sh, which can be found here. At the time it didn&rsquo;t support querying the Org Auditlog, so I PR&rsquo;d that here.
Once the PR was in place, I wrote a Dockerfile to create a container to deploy on Kubernetes.]]></description>
</item><item>
    <title>Packet Capture using tcpdump on Kubernetes Pods in Azure AKS</title>
    <link>http://example.org/posts/packet-capture-tcpdump-kubernetes-pods-azure/</link>
    <pubDate>Thu, 21 Apr 2022 14:44:24 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/packet-capture-tcpdump-kubernetes-pods-azure/</guid>
    <description><![CDATA[Assuming the target containers can actually install new software (apt install is available) what follows is a quick and very dirty method to run tcpdump on k8s/AKS containers in Azure.
If you&rsquo;re running Kubernetes 1.23 and up, please read this instead:
https://downey.io/blog/kubernetes-ephemeral-debug-container-tcpdump/
Install some needed utilities Use whatever pod label is required to target the right pods.
kubectl get pods -l &lt;LABEL&gt; -o name | \ xargs -I{} kubectl exec {} -- apt-get -y update Install tcpdump, screen, psmisc, and rclone]]></description>
</item><item>
    <title>Azure Translation Services with Elasticsearch and Logstash</title>
    <link>http://example.org/posts/azure-translation-services-elasticsearch-logstash/</link>
    <pubDate>Thu, 31 Mar 2022 06:54:40 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/azure-translation-services-elasticsearch-logstash/</guid>
    <description><![CDATA[Recently had a need to parse some XML into Elasticsearch, specifically some CERT RSS feeds. Logstash has an RSS input, but it&rsquo;s a bit basic, and doesn&rsquo;t provide any language indications if the RSS feed includes them. One of the feeds I&rsquo;m using can be various languages per item, and many others are non-english entirely.
Since this would be parsing the same RSS feeds repeatedly, I need a predictable Document ID, so I can re-insert / upsert the item, and not create a new document every time the RSS feed is parsed.]]></description>
</item><item>
    <title>Fedora CoreOS 35 USB Boot on Raspberry Pi 4</title>
    <link>http://example.org/posts/fedora-coreos-on-raspberry-pi4/</link>
    <pubDate>Wed, 23 Mar 2022 08:55:15 &#43;0000</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/fedora-coreos-on-raspberry-pi4/</guid>
    <description><![CDATA[Note: While the RPI now boots, if I have anything else plugged into USB ports, such as a keyboard, it throws the same TRB related error.
 For whatever reason, Fedora&rsquo;s support of Raspberry Pi4&rsquo;s seems a bit iffy. The official documentation (here) is quite good, and I managed to easily get the RPI4 booting CoreOS via the EDK2 UEFI firmware approach. The problem was that I wanted to use the U-Boot approach, and that was just not playing ball.]]></description>
</item><item>
    <title>Modsecurity, DetectionOnly and enforcing select rules</title>
    <link>http://example.org/posts/modsecurity-detectiononly-and-enforcing-select-rules/</link>
    <pubDate>Tue, 17 Aug 2021 10:21:48 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/modsecurity-detectiononly-and-enforcing-select-rules/</guid>
    <description><![CDATA[I recently had a reason to want to achieve the following:
 ModSecurity globally in DetectionOnly mode (not enforcing rules, just logging)  Continue to operate the CRS in DetectionOnly mode.   For a specific ruleset:  Enforcing a default deny on inbound requests to an API. Enforcing allow rules for specific API routes and methods of the API    So I wanted all of our inbound CRS rules to continue to work in DetectionOnly mode, while I had a custom set of rules that would deny all access, with a set of whitelists to specific methods/paths.]]></description>
</item><item>
    <title>Alerting using SIEM Detections and ElastAlert2</title>
    <link>http://example.org/posts/alerting-using-siem-detections-and-elastalert/</link>
    <pubDate>Tue, 17 Aug 2021 08:32:41 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/alerting-using-siem-detections-and-elastalert/</guid>
    <description><![CDATA[ElasticSearch SIEM Detections and Alerts and Actions are quite useful features, except for the fact that actual alerting is behind a license paywall. So while both of these features can run rules, check for conditions, and record the results in an index, neither of them actually provide alerting support.
Alerting requires a Gold License, which if alerting is the only thing you want, is an excessive cost.
If you can&rsquo;t move off ElasticSearch to OpenSearch, which has Alerting available for free, you can use tools such as ElastAlert21 to handle the Alerting requirements.]]></description>
</item><item>
    <title>Using Elasticsearch Upserts to Combine Multiple Event Lines Into One</title>
    <link>http://example.org/posts/using-elasticsearch-upserts-to-combine-multiple-event-lines-into-one/</link>
    <pubDate>Tue, 24 Nov 2020 07:39:19 &#43;0000</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/using-elasticsearch-upserts-to-combine-multiple-event-lines-into-one/</guid>
    <description><![CDATA[Note This approach is probably not appropriate for high volume / high throughput events. It required in my case quite a lot of Logstash parsing, and Elasticsearch doc_as_upsert use, both of which will have a significant performance penalty. For low throughput use it works fine.
 Sometimes log sources split logically grouped events into separate lines, and sometimes those logically grouped event lines are mixed into the same log file with actual singular line events.]]></description>
</item><item>
    <title>Shell script, Azure Storage using a Service Principle</title>
    <link>http://example.org/posts/shell-script-azure-storage-using-a-service-principle/</link>
    <pubDate>Tue, 20 Oct 2020 08:19:21 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/shell-script-azure-storage-using-a-service-principle/</guid>
    <description><![CDATA[Needed something in shell to upload files to an Azure Storage account. Hopefully its useful for others, so put it up on Github here ( https://github.com/robrankin/bash-azure-storage )]]></description>
</item><item>
    <title>Event Threat Enrichment using Logstash and Minemeld</title>
    <link>http://example.org/posts/event-threat-enrichment-logstash-minemeld/</link>
    <pubDate>Fri, 25 Sep 2020 09:22:36 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/event-threat-enrichment-logstash-minemeld/</guid>
    <description><![CDATA[At my work we use the Elastic Stack for quite a few things, but one of the more recent-ish &ldquo;official&rdquo; roles is as our SIEM. Elastic introduced SIEM specific funcationality to Kibana a few releases ago, around 7.4 if I rembember correctly.
One of the features that the Elastic Stack doesn&rsquo;t really support well (yet) is an enrichment system. They did introduce an elasticsearch side enrichment system in 7.5, but in my opinionn theres a few problems with it:]]></description>
</item><item>
    <title>Querying Cylance Protect Api From Shell</title>
    <link>http://example.org/posts/querying-cylance-protect-api-from-shell/</link>
    <pubDate>Fri, 11 Sep 2020 17:32:50 &#43;0100</pubDate>
    <author>Author</author>
    <guid>http://example.org/posts/querying-cylance-protect-api-from-shell/</guid>
    <description><![CDATA[We use Cylance as our AV type protection. They&rsquo;re one of the better solutions I&rsquo;ve seen, but theres some strange gaps in my opinion. There doesn&rsquo;t seem to be a built in method for alerting. One of the things we&rsquo;d like to be able to alert on is when a devices goes &ldquo;offline&rdquo;, and apparently this information is not provided through Cylance&rsquo;s syslog output. It is however available from their API.]]></description>
</item></channel>
</rss>