Use this checklist to track logstash wiki and documentation

• Update https://github.com/Cyb3rWard0g/HELK/wiki/Create-Plugins-Offline-Package
• Update HELK overview picture
  • remove alien vault integration
  • update with new indexes #256
• document catch all for windows
• document indexme catch all
• some general guideline on X amount of devices and or X amo

Currently auth02mozdef.py uses the Auth0 /api/v2/logs endpoint to fetch logs.

Auth0 has, since this was developed, released Auth0 LogStreams which uses AWS EventBridge.

Please switch

• T-Pot 19.03 Standard Installation on Debian sid
• Hardware (i5-540M)

I'm trying to activate SSL for Elasticsearch because I want to connect to it with remote Logstash instances.

• I generated a certificate with the elasticsearch-certutil following this guide: https://www.elastic.co/guide/en/elasticsearch/reference/7.3/configuring-tls.html
• I placed the certificate in /data/elk/
• I als

Currently, I must specify a username for a host in aker.ini. This is a convenient feature in some scenarios, but it would be nice if Aker would default to the user's username for the connection and optionally allow the user to specify a different username if he or she wanted.

As an example, consider the following:

[supertylerc]
hosts = 10.0.0.1,22
    192.168.0.1,22,admin

Instead of using the receiver URL for the EU region it would be better to set it up via a region flag. This is easier to manage and less things can go wrong.

https://github.com/SAP/cf-python-logging-support have a quite similar setup in term of adding framework support. We can pull Django and Falcon support from https://github.com/SAP/cf-python-logging-support/tree/master/sap/cf_logging/django_logging and https://github.com/SAP/cf-python-logging-support/tree/master/sap/cf_logging/falcon_logging to json_logging