rylnd

#!/bin/bash

RULE_PATH="${1:-.}"
echo "Rule Path: $RULE_PATH"

IMPORT_FILE="${2:-rules.ndjson}"
echo "Import file: $IMPORT_FILE"

rule_count=0;

rylnd

#!/bin/sh

#
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
# or more contributor license agreements. Licensed under the Elastic License
# 2.0; you may not use this file except in compliance with the Elastic License
# 2.0.
#

set -e

rylnd

GET risk_score,watchlist/_search
{
  "size": 0,
  "aggs": {
    "identities": {
      "composite": {
        "sources": [
          {
            "identityField": {
              "terms": {

rylnd

# for each identifier (example with user.name)
GET risk-score-demo/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "event.category": "risk"

rylnd

const RiskReasonLocation = '.alerts*' // configurable in future
const IdentifierMapping = [
  {sourceField: 'host.name', entityField: 'host.name'},
  {sourceField: 'user.name', entityField: 'user.name'},
  ]; // configurable in future

for (Identifier of IdentifierMapping) {
  GET(`${RiskReasonLocation}/_search`, {
    'event.type': 'risk_reason',
    [Identifier.sourceField]: '*',

rylnd

## REINDEX DEMO

DELETE events-1
DELETE security-events-1

PUT events-1
{
  "mappings": {
    "properties": {
      "@timestamp": {

rylnd

#!/usr/bin/env bash

KIBANA_URI="${KIBANA_URL:-"http://localhost:5601"}"
KIBANA_USR="${KIBANA_USER:-"elastic"}"
KIBANA_PWD="${KIBANA_PASS:-"changeme"}"

KIBANA_SPACE="${SPACE_ID:-""}"
if [ -n "$KIBANA_SPACE" ]; then
  SPACE_PART="s/${KIBANA_SPACE}/"
fi

rylnd

type I = unknown;
type A = RequestOverWire // snake case, optionals
type O = RequestToUse // camelCase, all keys present, values defaulted
​
// frontend
const request: I = { id: 'my-id' };
const payload: A = requestSchema.decode(request);
if (isLeft(payload)) {
  displayErrors(payload);
} else {

rylnd

# outside of a repo
git init test
cd test
time git status
for i in {1..40000}; do touch $i; done
time git status
git add .
git commit -m "adding files"
time git status

rylnd

# a/b.rb
module A
  module B
    THING = 'thing'
  end
end