theCanary

Akamai CDN Configuration Testing

Akamai Debug Headers!

Request Headers

-H "Pragma:akamai-x-get-client-ip, akamai-x-cache-on, akamai-x-cache-remote-on, akamai-x-check-cacheable, akamai-x-get-cache-key, akamai-x-get-extracted-values, akamai-x-get-nonces, akamai-x-get-ssl-client-session-id, akamai-x-get-true-cache-key, akamai-x-serial-no, akamai-x-feo-trace, akamai-x-get-request-id"

Edge Suite

Mac Uninstall pkg Manually

using pkgutil

# list all your installed packages
pkgutil --pkgs

# show your package info
pkgutil --pkg-info

Continuous Monitoring in OS X Systems and Security

Dan Griggs, cmdSecurity

Compromise of the device in inevitable. We lock down devices, we break things for our users, we forbid them certain rights, and yet it still gets broken.

Continuous Monitoring is necessary if breakage is inevitable. State change and state monitoring is critical. Define what is most sensitive about a system, lock down access to those components. Moderately secure the rest of the system for UX improvements.

Watch for the vulnerability's end result, not the vulnerability.

Detect Numeric Outliers – Advances

Iman Makaremi - Senior Data Scientist, Splunk

Matthew Modestino - ITOA Practitioner, Splunk

So they want to move away from static alarming/decision making. Can the data itself tell you what's normal? Basically, looking for outliers with ML (and the MLTK). One of them is Ops, the other did the math.

"We know what's normal - we collect it every day." You already have the baseline. But how do you write SPL to detect deviation? (Hoping this next bit is relevant to sourcetype volume tracking and to larger anomaly detection work at Yelp.)

	Dim WithEvents newCal As Items
	Dim WithEvents mynewCal As Outlook.AppointmentItem

	Public Function uDebug(ByVal d As Variant) As Boolean
	Dim setDebug As Boolean
	setDebug = True

	If setDebug Then
	Debug.Print (d)
	End If

	Host Enumeration:

	--- OS Specifics ---
	wmic os LIST Full (* To obtain the OS Name, use the "caption" property)

	wmic computersystem LIST full

	--- Anti-Virus ---

	wmic /namespace:\\root\securitycenter2 path antivirusproduct

	#!/usr/bin/bash

	SOURCE_PORT=8888
	DESTINATION_PORT=5601
	USER=myuser
	REMOTE_HOST=10.0.0.1

	ssh -L $SOURCE_PORT:localhost:$DESTINATION_PORT $USER@$REMOTE_HOST -N

	# Then browse: http://localhost:$SOURCE_PORT

	$fso = New-Object -ComObject scripting.filesystemobject
	$f = $fso.GetFolder("C:\Users\Administrator\")
	$folders = Foreach($folder in $f.SubFolders)
	{
	New-Object -TypeName psobject -Property @{
	name=$folder.path;
	size=$folder.size
	}
	}

	The following are list of tools i use.

	Encryption:
	ShadowCrypt

	Programming IDEs:
	PHPStorm
	IntelliJ
	RStudio/Revolution R Open
	RegEx Buddy

	# Partition Resize
	Resize-Partition -Size 100GB -DriveLetter C