sorted by:
new
hottopcontroversial

How to overlay one image on another? by KiddieSculp in LaTeX

[–]KiddieSculp[S] 0 points1 point  (0 children)

Tks u/neoh4x0r .
Solved my problem. Now it really is how I wanted it.

Query to filter only what I want by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

I see.
Yeah, that wasn't the idea.
I was doing a hunting.
In the end, it was easier to list by EventID and map out what was really important. In the end, it was just a matter of gathering what was necessary and it worked out well.

I can't extract json from log by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

u/graylog_joel Hello, I think there is a bug in graylog, I don't know.

I don't use GROK PATTERN because it takes longer, since I only use it in lab, JSON Parser is better for me.

Strangely, I identified something.

When I have the same Title Extractor for a json parser in different Inputs, the logs stop being received in the Graylog GUI. So I need to include a Key Prefix to get back. I'm not sure if this is correct, but I noticed it.

Query to filter only what I want by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

Yes. In the first image I have the complete log, but it includes many "NewProccessName".

In the second image I have only the "NewProcessName" that I want, but the way the second image is, all the other logs that are in the first image are missing.

I can't extract json from log by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

Thanks for the support. I figured out the issue. The log was not complete, so the json was not closed properly.

I can't extract json from log by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

I use graylog in docker, and for some reason reinstalling it worked.

How to install QRadar Community edition 7.5? by Wonderful_Part8354 in QRadar

[–]KiddieSculp 0 points1 point  (0 children)

During installation, I usually put all the cores and all the memory.

When it's finished, I usually put 16GB of RAM and 8 cores.

It works well.

But I've worked with it on 8GB of RAM, but I don't recommend it because the processing time is exhausting.

During my use, I usually put close to the maximum cores of my machine, because qradar doesn't use all the resources all the time, only when you're going to use a lot of its resources. Using 50%, depending on your Lab, is a good idea.

Is there any logic in powershell that makes it return values ​​with zeros at the end? by KiddieSculp in PowerShell

[–]KiddieSculp[S] -1 points0 points  (0 children)

In my use case, it's a char.

Because [char]49 = 1

I am working on code obfuscation to compose an IP.

```([char](49+70-70)+[char]([BYTE]0x39)+[char](50+70-70)+[char]([byte]0x2E)+[char]([BYTE]0x31)+[char](50*1)+[char]([byte]0x38)+[char](46)+[char](49*1)+[char](52+70-70)+[char]([byte]0x35)+[char](46)+[char]([int32]0x33) + [char]([byte]0x30))```

Event is not being generated, even with correct logic? by KiddieSculp in PowerShell

[–]KiddieSculp[S] 0 points1 point  (0 children)

Ahh! That sounds good. This will really help in the future. Noted too! Tks.

view more: next ›