Splunk의 eval과 rex - 5th

줄바꿈(\n) 문자를 이용해서 두 번째 라인의 계정 정보만을 검사하는 정규표현식.

SQL 대시보드 shaper

SQL을 입력하면 차트를 그려주는 데이터 시각화 툴 shaper.

C:\Users\Administrator>pip install shaper-bin
Collecting shaper-bin
  Downloading shaper_bin-0.14.0-py3-none-any.whl.metadata (2.3 kB)
Requirement already satisfied: requests>=2.31.0 in c:\users\administrator\appdata\local\programs\python\python314\lib\site-packages (from shaper-bin) (2.32.5)
Requirement already satisfied: charset_normalizer<4,>=2 in c:\users\administrator\appdata\local\programs\python\python314\lib\site-packages (from requests>=2.31.0->shaper-bin) (3.4.4)
Requirement already satisfied: idna<4,>=2.5 in c:\users\administrator\appdata\local\programs\python\python314\lib\site-packages (from requests>=2.31.0->shaper-bin) (3.11)
Requirement already satisfied: urllib3<3,>=1.21.1 in c:\users\administrator\appdata\local\programs\python\python314\lib\site-packages (from requests>=2.31.0->shaper-bin) (1.26.20)
Requirement already satisfied: certifi>=2017.4.17 in c:\users\administrator\appdata\local\programs\python\python314\lib\site-packages (from requests>=2.31.0->shaper-bin) (2025.11.12)
Downloading shaper_bin-0.14.0-py3-none-any.whl (12 kB)
Installing collected packages: shaper-bin
Successfully installed shaper-bin-0.14.0

Sysmon의 이벤트 필터링

특정 경로의 실행 파일을 예외 처리하는 Network connection 이벤트 필터링 설정. 

<Sysmon schemaversion="4.90"/>
  <!-- Capture all hashes -->
  <HashAlgorithms>*</HashAlgorithms>
  <EventFiltering>
    <FileDelete onmatch="include"/>
    <ClipboardChange onmatch="include"/>
    <ProcessCreate onmatch="exclude"/>
    <ProcessTerminate onmatch="include"/>					
    <ProcessTampering onmatch="exclude"/>
    <ProcessAccess onmatch="exclude"/>
    <FileCreateTime onmatch="exclude"/>
    <FileCreate onmatch="exclude"/>
    <FileCreateStreamHash onmatch="exclude"/>

데이터 노가다 실수담 - 16th

csv 포맷 iis 로그.