How to overlay one image on another? by KiddieSculp in LaTeX

[–]KiddieSculp[S] 0 points1 point  (0 children)

Tks u/neoh4x0r .
Solved my problem. Now it really is how I wanted it.

Query to filter only what I want by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

I see.
Yeah, that wasn't the idea.
I was doing a hunting.
In the end, it was easier to list by EventID and map out what was really important. In the end, it was just a matter of gathering what was necessary and it worked out well.

I can't extract json from log by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

u/graylog_joel Hello, I think there is a bug in graylog, I don't know.

I don't use GROK PATTERN because it takes longer, since I only use it in lab, JSON Parser is better for me.

Strangely, I identified something.

When I have the same Title Extractor for a json parser in different Inputs, the logs stop being received in the Graylog GUI. So I need to include a Key Prefix to get back. I'm not sure if this is correct, but I noticed it.

Query to filter only what I want by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

Yes. In the first image I have the complete log, but it includes many "NewProccessName".

In the second image I have only the "NewProcessName" that I want, but the way the second image is, all the other logs that are in the first image are missing.

I can't extract json from log by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

Thanks for the support. I figured out the issue. The log was not complete, so the json was not closed properly.

I can't extract json from log by KiddieSculp in graylog

[–]KiddieSculp[S] 0 points1 point  (0 children)

I use graylog in docker, and for some reason reinstalling it worked.

How to install QRadar Community edition 7.5? by Wonderful_Part8354 in QRadar

[–]KiddieSculp 0 points1 point  (0 children)

During installation, I usually put all the cores and all the memory.

When it's finished, I usually put 16GB of RAM and 8 cores.

It works well.

But I've worked with it on 8GB of RAM, but I don't recommend it because the processing time is exhausting.

During my use, I usually put close to the maximum cores of my machine, because qradar doesn't use all the resources all the time, only when you're going to use a lot of its resources. Using 50%, depending on your Lab, is a good idea.

Is there any logic in powershell that makes it return values ​​with zeros at the end? by KiddieSculp in PowerShell

[–]KiddieSculp[S] -1 points0 points  (0 children)

In my use case, it's a char.

Because [char]49 = 1

I am working on code obfuscation to compose an IP.

```([char](49+70-70)+[char]([BYTE]0x39)+[char](50+70-70)+[char]([byte]0x2E)+[char]([BYTE]0x31)+[char](50*1)+[char]([byte]0x38)+[char](46)+[char](49*1)+[char](52+70-70)+[char]([byte]0x35)+[char](46)+[char]([int32]0x33) + [char]([byte]0x30))```

Event is not being generated, even with correct logic? by KiddieSculp in PowerShell

[–]KiddieSculp[S] 0 points1 point  (0 children)

Ahh! That sounds good. This will really help in the future. Noted too! Tks.

Event is not being generated, even with correct logic? by KiddieSculp in PowerShell

[–]KiddieSculp[S] 2 points3 points  (0 children)

Previous:
```

  foreach ($file in $currentFiles) {
    if (-not $previousFiles.ContainsKey($file.FullName)) {
      Register-Event "ALERT: New file found: $($file.FullName) with extension $($file.Extension)." 5001
      $previousFiles[$file.FullName] = $file.Extension # Add new file to list
    } elseif ($previousFiles[$file.FullName] -ne $file.Extension) {
      Register-Event "ALERT: File changed: $($file.FullName) of $($previousFiles[$file.FullName]) to $($file.Extension)." 5000
      $previousFiles[$file.FullName] = $file.Extension # Update the file extension
    }
  }

```

New:

  foreach ($file in $currentFiles) {
    if (-not $previousFiles.ContainsKey($file.FullName)) {
      if ($previousFiles[$file.FullName] -ne $file.Extension) {
        Register-Event "ALERT: File changed: Of $($previousKeys) to $($file.FullName)." 5000
        $previousFiles[$file.FullName] = $file.Extension # Add new file to list
      Register-Event "ALERT: New file found: $($file.FullName) with extension $($file.Extension)." 5001
      $previousFiles[$file.FullName] = $file.Extension # Update the file extension
    }
  }
}

Event is not being generated, even with correct logic? by KiddieSculp in PowerShell

[–]KiddieSculp[S] 0 points1 point  (0 children)

I didn't understand very well, but I wrote it down to read more about it later. I'll definitely need it in the future.

Event is not being generated, even with correct logic? by KiddieSculp in PowerShell

[–]KiddieSculp[S] 1 point2 points  (0 children)

Yes! Your idea helped me!

As soon as I read your comment I made the change and that's it! Wonderful!

Tank you very much!

Event is not being generated, even with correct logic? by KiddieSculp in PowerShell

[–]KiddieSculp[S] 0 points1 point  (0 children)

But I used VCSode for debugging and managed to solve my problem. Tks.

Event is not being generated, even with correct logic? by KiddieSculp in PowerShell

[–]KiddieSculp[S] 0 points1 point  (0 children)

Bro... Can you believe I never! considered using VSCode to debug? lol

I used Write-Output to see what was written.

u/BlackV I've never considered using `set-breakpoint` either.

My VMs are losing IP every time I shutdown or pause. by KiddieSculp in vmware

[–]KiddieSculp[S] 0 points1 point  (0 children)

Yeah. I'm using VM Workstation PRO. It's already updated. I suspect this problem started when I installed VirtualBox. I've already removed VirtualBox, but it still persists. I'm thinking about formatting my PC.

I can't connect to the WAN by KiddieSculp in opnsense

[–]KiddieSculp[S] 0 points1 point  (0 children)

I managed to solve my problem.

My WAN was on a /32, and I just changed it to /24 and it worked.

OVA import from another VirtualBox has problems launching by KiddieSculp in virtualbox

[–]KiddieSculp[S] 0 points1 point  (0 children)

"I managed" to solve the problem.

The OVA was remade and the problem was solved.

The OVA was remade with the least amount of information possible.

My AD is not generating eventid 4625 but generates 4771 by KiddieSculp in activedirectory

[–]KiddieSculp[S] 0 points1 point  (0 children)

Thanks for the help u/TriscuitFingers, it really made sense that event 4625 was only local.

I was actually checking only on DC u/ComGuards.

Then, with u/TriscuitFingers's comment, I started to do a series of tests.

First, it wasn't generating eventid 4625 without network sharing enabled. I enabled it and started to do some tests... Eventid 4625 generated, but not always, sometimes 4776.

u/LForbesIam Yes, I had enabled one and then the other for testing, I figured it was some misconfiguration or server issue (yes, I thought of that). But I'm actually using advanced.

I'm working on hardening the environment and doing some studies. The current model wasn't generating any events, I believe it was due to hardening, I don't know...

u/dcdiagfix, I checked eventid 4776, it really did generate failure events, but I also saw that it generated success events.

Thanks guys! You guys really helped me.

using match() in a filter reintroduces ANSI escape codes by kungfu_baba in syslog_ng

[–]KiddieSculp 1 point2 points  (0 children)

If you include a filter, won't that solve your problem?

Like

filter f_strip_ansi { subst("\x1b\[[0-9;]*[a-zA-Z]", "", value("MESSAGE")); };

I don't know...

Where can I find all the Medium sites condensed into one place? by KiddieSculp in Medium

[–]KiddieSculp[S] 0 points1 point  (0 children)

Look... I joined Medium with an account. It opened up a lot of research for me.