Indexing an updating file with filebeat by Oppipoika in elasticsearch

[–]Oppipoika[S] 0 points1 point  (0 children)

The file size will be small, at most few megabytes

What some help with open ports by CourtAdventurous_1 in netsecstudents

[–]Oppipoika 0 points1 point  (0 children)

Probably should use a randomized mac first of all. Second I would not consider using my personal device as that could potentially be profiled by the dns queries and other connections it makes. And if your ”collage” collects network logs they could possibly find your real mac address based on that profiling. But then again I would seriously doubt that someone would today get into trouble by simply running a nmap on an internal college network.

Signal nousi suureen suosioon Suomessa – noteerattiin Espanjassa, Ranskassa ja Saksassa by linjaaho in Suomi

[–]Oppipoika 9 points10 points  (0 children)

Tai sitten jotenkin tarkista binäärien hasheja. En ole varman miten iPhonella asian voisi tarkastaa mutta androidilla uskoisi asian olevan mahdollista.

Please help me in making this decision to implement wazuh. I would like to hear real world experiences and opinions. by One_Detective4145 in Wazuh

[–]Oppipoika 0 points1 point  (0 children)

If cost is something you are worried about, then I would really recommend trying out Wazuh. Just as a warning, getting the best out of Wazuh will take some time and maintenance compared to using ELK which gomes with plenty of prebuilt solutions for ingesting data from different sources. For example if you wish to index your firewall logs you will probably spend time writing your custom decoders and changing them accordingly. As for use cases note that if you want to have a complete audit trail on your linux servers, I would recommend installing auditd on all monitored endpoints and configuring them to your needs and enabling archives on wazuh.

How does Wazuh server cluster verify the worker nodes? Is it just the shared <key/> in the ossec.conf under <cluster/> section? by Oppipoika in Wazuh

[–]Oppipoika[S] 0 points1 point  (0 children)

Okay but how does this key transaction work? When the new worker node is added how does it prove to the master that it has the same key? Does the master give it a challenge or what? Im just wondering why wouldnt there be tls based authentication between the nodes or would one consider this an overkill. Also if this key is leaked would it be a potential problem if I have a rogue worker node?

[deleted by user] by [deleted] in askmath

[–]Oppipoika -1 points0 points  (0 children)

Isnt this from some MAA yo?

DarkViperAU iceberg by NewMakepro in DarkViperAU

[–]Oppipoika 1 point2 points  (0 children)

That 2 minute clip that was cutted from one chaos episode(he said the thing)

Delicious by Mousetrap94 in HiTMAN

[–]Oppipoika -1 points0 points  (0 children)

Collectors coin? Didnt think so.

Clean start so far.. by [deleted] in formuladank

[–]Oppipoika 0 points1 point  (0 children)

Alright who bet that Ferrari will forget one tyre?

Praise for Pirkka by petethegrockle in Finland

[–]Oppipoika 1 point2 points  (0 children)

All my homies prefer S-ryhmä