Querying McAfee ePo on End User Machines

Code loop through a range of IPs and query McAfee epo on client machines # Loop through IP address 10.0.0.10 – 10.0.0.20 and print out # the computer name and the agent version echo “” > output; for ((i=10;i<=20;i++)) do # -s Silent Curl # -m 1 Wait no longer than 1 second per host . . . → Read More: Querying McAfee ePo on End User Machines

Add icons to your exported Chrome/Firefox Bookmarks

When you export your bookmarks from Chrome and Firefox the resulting HTML looks pretty plain.

Exported Bookmarks with Icons

To enhance the exported bookmarks file by added icons try the following

perl -i’bak’ -ple ‘s/ ICON=”([^”]+”)>/><img src=”$1″> /’ bookmarks.html

Enhance with CSS

You can further enhance the file using this js fiddle: http://jsfiddle.net/vaj0tted/

. . . → Read More: Add icons to your exported Chrome/Firefox Bookmarks

Return AlienVault OSSIM Current Version from Command Line

If you want to return the current AlienVault OSSIM version you are running from a command line try this:

version=$(dpkg -l | grep ossim-cd-tools | awk ‘{print $3}’ | awk -F’-‘ ‘{ print $1 }’) echo $version

Convert JSON to CSV

To convert a json file to CSV you will need a linux program called jq.

INPUTFILE=”inputfile-with-json” OUTPUTFILE=”outputfile-formatted.csv” jq -r ‘(.[0] | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv’ ${INPUTFILE} > ${OUTPUTFILE}

Parallel Gzip

Lzop use to be my favorite fast compression program. That is until I learned about parallels gzip (pigz)

Compress a Folder # compress a folder called “myfolder” at maximum compression using six threads tar cf – myfolder | pigz -9 -p 6 > myfolder.tar.gz Compress a Folder (Using Variables): # compress a folder called . . . → Read More: Parallel Gzip

Graylog 2.4.6 manual index backup and restore

When you do not have enterprise support closing and opening elastic search indexes can break stuff in Graylog 2.4.6.

Elastic Search Indexes Close/Open

The official documentation for Elasticsearch 2.4.6 closing and opening an index can be found here:

https://www.elastic.co/guide/en/elasticsearch/reference/2.4/indices-open-close.html

curl -XPOST ‘localhost:9200/my_index/_close’ curl -XPOST ‘localhost:9200/my_index/_open’ Closing an index

To close an index:

# curl -XPOST . . . → Read More: Graylog 2.4.6 manual index backup and restore

Script to Backup Alienvault OSSIM Master Server

Script to backup AlienVault OSSIM master server . . . → Read More: Script to Backup Alienvault OSSIM Master Server

tmux horizontal window splitting

To split terminal in to four horizontal tmux windows you can run the following code:

#!/bin/bash tmux new-window -a -n WinSplit tmux new-session -d -s WinSplit tmux selectp -t WinSplit tmux split-window -v tmux set-window-option -g window-status-current-bg blue tmux split-window -v tmux split-window -v tmux select-layout even-vertical tmux attach -t WinSplit

The result is something . . . → Read More: tmux horizontal window splitting

Graylog Query by IP Address with Wildcard/CIDR

If you are searching Graylog logs that are not properly indexed (ip address is not in a field) you may need to perform a text search for an IP Address or IP Addresses.

IP Address Queries

The following queries are examples of how to query Graylog for one or more IP addresses (not using a . . . → Read More: Graylog Query by IP Address with Wildcard/CIDR

Compare two Files and Print Lines that Match

The proper way to compare two files and print lines that match:

awk ‘NR==FNR{arr[$0];next} $0 in arr’ file1.txt file2.txt

Here is a shell script you can run:

#!/bin/bash # Filename: showdupes.sh # source: http://brakertech.com/compare-two-files-and-print-lines-that-match/ # this file takes two text files as input # sorts them and outputs lines from # file 2 that match . . . → Read More: Compare two Files and Print Lines that Match