asch513 Goto Github PK

elk_hunter

A daemon to execute ElasticSearch queries and create ACE alerts based on the results.

elk_monitor

There are plenty of tools available to monitor elasticsearch infrastructure, but knowing if certain logs are no longer being sent to elasticsearch is a problem I've seen across several companies. This script, initial created for integration with icinga, monitors if logs are not coming in from expected hosts, finds additional hosts that are sending logs, and when event ingestion volumes are out of spec.

integraldefense.github.io

pdfparser

python-humio

python humio adapter

qit

Query It - takes a list of hashes or searches for urlquery, runs the search and tells you which ones you already added to a dataset (trying to find unknown fraud sites)

sipit

command line interface for adding indicators and querying different aspects of SIP

smm

Because, I gotta have more sysmon baby. And, if I want more sysmon I should probably give it to myself. I got a fever, and the only prescription is more sysmon.

splunk_detect

operationalize your indicators of compromise, and send alerts/matches to ACE

sysmon-config

Sysmon configuration file template with default high-quality event tracing

virustotalapi

VirusTotal Full api

yara_scanner

A Python wrapper library for libyara and a local server for fully utilizing the CPUs of the system to scan with yara.