Lahilabs
IT Learning and Labbing

How to Monitor SNMP devices with Telegraf and InfluxDB and Grafana | Meraki WAN Data

Howard Mukanda Security, Virtualization December 8, 2018

Why did i write this... Every IT admin needs to know what is going on in their environment at all times. Having a dashboard in your office on a TV and active alerts to your phone is critical in our careers. You ideally want to know about the problem before end users start calling. That’s why SNMP is very important and being able to use it to your advantage will make your life easier.

Parsing And Visualizing Squid Proxy logs in Graylog and Grafana

Howard Mukanda Security, Virtualization August 23, 2019

Squid Proxy logs json Tutorial from this video: Parsing And Visualizing Squid Proxy logs in Graylog and Grafana : This is the json for the Grafana graph: { “annotations”: { “list”: [ { “builtIn”: 1, “datasource”: “– Grafana –“, “enable”: true, “hide”: true, “iconColor”: “rgba(0, 211, 255, 1)”, “name”: “Annotations & Alerts”, “type”: “dashboard” }
Read More »

How to Parse Snort IDS Logs in Graylog

Howard Mukanda Uncategorized August 17, 2019

Here is the rule that i used in the video: rule “Extract Snort alert fields” when has_field(“message”) then let m = regex(“\(\d+):(\d+):(\d+)\ \[Classification: (.+?)\] \[Priority: (\d+)]: \<(.+?)\> \{(.+?)\} (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))? -> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))?\R?”, to_string($message.message)); set_field(“snort_alert”, true); set_field(“generator_id”, m[“0”]); set_field(“signature_id”, m[“1”]); set_field(“signature_revision_id”, m[“2”]); set_field(“description”, m[“3”]); set_field(“classification”, m[“4”]); set_field(“priority”, to_long(m[“5”])); set_field(“protocol”, m[“7”]); set_field(“src_addr”, m[“8”]); set_field(“src_port”, to_long(m[“10”])); set_field(“dst_addr”, m[“11”]); set_field(“dst_port”,
Read More »