This article is about the Ansible URI module. In the last couple of months, I have spent a lot of time around automation of Elasticsearch and wanted to share some useful information about how to use Ansible to interact with REST API endpoints and make them idempotent. We all know Ansible modules are idempotent in nature, which means performing an operation once has exactly the same result as performing it repeatedly without any intervening actions....
Recently, I’ve been working on understanding and detecting the Log4j vulnerability using Elasticsearch. If you want to know more about this vulnerability, I would suggest reading the blog series https://www.securitynik.com/2021/12/beginning-log4-shell-understanding.html by Nik Alleyne on his blog securitynik.com. To detect outbound traffic going to IOCs related to Log4j, I needed to upload CSV data to Elasticsearch. To achieve that, I followed these steps: 1. First create a new index logs-threat-intel Using Dev Tools in Kibana, issue the Create Index API call...
AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs. You can ship these CloudTrail logs into the ELK stack and learn how to visualize these events, near real time, using Kibana....