To convert a json file to CSV you will need a linux program called jq. INPUTFILE=”inputfile-with-json” OUTPUTFILE=”outputfile-formatted.csv” jq -r ‘(.[0] | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv’ ${INPUTFILE} > ${OUTPUTFILE}
Lzop use to be my favorite fast compression program. That is until I learned about parallels gzip (pigz) Compress a Folder # compress a folder called “myfolder” at maximum compression using six threads tar cf – myfolder | pigz -9…
When you do not have enterprise support closing and opening elastic search indexes can break stuff in Graylog 2.4.6. Elastic Search Indexes Close/Open The official documentation for Elasticsearch 2.4.6 closing and opening an index can be found here: curl…
To split terminal in to four horizontal tmux windows you can run the following code: #!/bin/bash tmux new-window -a -n WinSplit tmux new-session -d -s WinSplit tmux selectp -t WinSplit tmux split-window -v tmux set-window-option -g window-status-current-bg blue tmux split-window…
If you are searching Graylog logs that are not properly indexed (ip address is not in a field) you may need to perform a text search for an IP Address or IP Addresses. IP Address Queries The following queries are…
The proper way to compare two files and print lines that match: awk ‘NR==FNR{arr[$0];next} $0 in arr’ file1.txt file2.txt Here is a shell script you can run: #!/bin/bash # Filename: showdupes.sh # source: # this file takes two text…
Problem Kali Linux 2018.4 x64 fails to install manually when using VM Fusion 10.1.5 (hangs during “copying data to disk” portion of the install). Solution Create a new Custom VM Select the iso you downloaded When prompted for the OS…
One very handy function to have in your .bash_profile is a function to extract IP addresses. ipextract function I frequently use this function during investigations and though I should share it with everyone. ipextract () { # example ipextract <…
Problem You have many smaller pcap files that you would like to combine in to a single file 10.0.0.10_1.pcap 10.0.0.10_2.pcap 10.0.0.10_3.pcap 10.0.0.10_4.pcap 10.0.0.10_5.pcap Solution mergecap -a 10.0.0.10* -w output_file.pcap Source:
