Skip to content

Instantly share code, notes, and snippets.

name: Server.Monitor.StoreClientInfo
author: Andreas Misje – @misje
description: |
Save data from client interrogation as client metadata.
This artifact listens for flow completions, typically Custom.Generic.Client.Info,
your own override of the interrogation artifact, and extracts any information
gathered in the interrogation.
The primary use case for this artifact is to any useful information about the
@misje
misje / Exchange.Monitor.Alerts.yaml
Created November 12, 2025 10:12
Exchange.Monitor.Alerts
name: Exchange.Monitor.Alerts
author: Andreas Misje – @misje
description: |
Send an e-mail when an alert is created.
This artifact forwards alerts from Server.Internal.Alerts as e-mails. Alert
context, like client information, original timestamp, artifact name/type and
any other argument passed to `alert()` will be included, either in an HTML-
formatted table or as a clear-text bullet list.
@misje
misje / Exchange.Server.Alerts.Mail.yaml
Created November 12, 2025 10:11
Exchange.Server.Alerts.Mail
name: Exchange.Server.Alerts.Mail
author: Andreas Misje – @misje
description: |
Send an e-mail when a client flow (with artifacts of interest) has finished.
Cancelled collections and collections with artifacts that do not satisfy
preconditions do not create notifications when they are finished.
Example use cases:
- A collection is created for an offline client and you want to be notified
### Keybase proof
I hereby claim:
* I am misje on github.
* I am misje (https://keybase.io/misje) on keybase.
* I have a public key whose fingerprint is BFD7 E35A BEBF ABD5 E37F 8BD3 2F17 C04A F166 CA9A
To claim this, I am signing this object:
@misje
misje / 600500-gcp_rules.xml
Created August 1, 2023 06:34
Wazuh GCP rules
<group name="gcp,google_workspace,">
<rule id="600500" level="3">
<if_sid>65042</if_sid>
<field name="gcp.protoPayload.methodName">^google.apps.cloudidentity.groups.v1.MembershipsService.UpdateMembership$</field>
<field name="gcp.protoPayload.metadata.membershipDelta.roleDeltas">BLOCKED</field>
<field name="gcp.protoPayload.metadata.membershipDelta.roleDeltas">ADD</field>
<description>$(data.gcp.protoPayload.metadata.membershipDelta.member) blocked from $(gcp.protoPayload.metadata.group) by $(gcp.protoPayload.authenticationInfo.principalEmail)</description>
</rule>
<rule id="600501" level="3">
@misje
misje / strip.sh
Created August 28, 2019 10:40
Strip all but most essensial EXIF tags from pictures
#!/usr/bin/env bash
set -e
set -o pipefail
set -o nounset
PROGNAME="$(basename "$0")"
# Require at least one argument:
[[ $# -lt 1 ]] && {>&2 echo "Usage: $PROGNAME image.jpg..."; exit 1;}
exiftool -overwrite_original -all= -tagsFromFile @ -Artist -ExposureTime -FNumber -ISO -ExifVersion -CreateDate -FocalLength -DateTimeOriginal -ColorSpaceData -ApertureValue "$@"
@misje
misje / mattermost.conf
Last active September 25, 2024 12:51
Mattermost Apache config example
<VirtualHost *:80>
ServerName mattermost.example.org
ServerAdmin webmaster@example.org
ErrorLog ${APACHE_LOG_DIR}/mattermost-error.log
CustomLog ${APACHE_LOG_DIR}/mattermost-access.log combined
# Enforce HTTPS:
RewriteEngine On
RewriteCond %{HTTPS} !=on
@misje
misje / mattermost.service
Last active July 3, 2018 09:11
Mattermost systemd service file example
[Unit]
Description=Mattermost
After=network.target mysql.service
[Service]
Type=simple
ExecStart=/srv/mattermost/bin/mattermost
Restart=always
RestartSec=10
WorkingDirectory=/srv/mattermost
@misje
misje / Matterbridge.service
Created December 15, 2015 21:31
Matterbridge systemd service file example
[Unit]
Description=Mattermost IRC bridge
After=network.target
Wants=mattermost.service
[Service]
Type=simple
ExecStart=/srv/mattermost/bin/matterbridge
Restart=always
RestartSec=30