Red Alert 2 On Linux

[Marthe Bernskoetter]

HelloI had to move my entire old Splunk directory to a new filesystem for archiving as it was pretty hosed. Did a reinstall back to /opt/splunk and have just been setting it all up again. I created some pretty specific alerts previously that I would like to see if I can just copy over from the old instance. Does anyone know where those are stored?

I'm trying to change the default Alert Sound on GNOME, but I'm not sure how to do this. I've tried to import .ogg files into .local/share/sounds but when I looked at Tweaks nothing changed. Same applies with the Sound setting in Settings. I tried to put the .ogg file in /usr/share/sounds in another Linux Distro, but it's the same result, but I didn't do it on this Distro.

The sounds folder in

/usr/share/gnome-control-center/sounds/gnome-sounds-default.xml

doesn't exist. Same goes for the file. If I create the file manually then it doesn't do anything, I've tried doing this exact same thing on Fedora.

A work around.

I just replaced a sound from /usr/share/sounds/gnome/default/alerts/ with the sound I wanted renaming it to whatever I am replacing it with. Then switched to that sound in Gnome sound settings.

The Alertmanager handles alertssent by client applications such as the Prometheus server.It takes care of deduplicating, grouping, and routingthem to the correct receiver integration such as email, PagerDuty, or OpsGenie.It also takes care of silencing and inhibition of alerts.

Grouping categorizes alerts of similar nature into a single notification. Thisis especially useful during larger outages when many systems fail at once andhundreds to thousands of alerts may be firing simultaneously.

Example: Dozens or hundreds of instances of a service are running in yourcluster when a network partition occurs. Half of your service instancescan no longer reach the database.Alerting rules in Prometheus were configured to send an alert for each serviceinstance if it cannot communicate with the database. As a result hundreds ofalerts are sent to Alertmanager.

As a user, one only wants to get a single page while still being able to seeexactly which service instances were affected. Thus one can configureAlertmanager to group alerts by their cluster and alertname so it sends asingle compact notification.

Example: An alert is firing that informs that an entire cluster is notreachable. Alertmanager can be configured to mute all other alerts concerningthis cluster if that particular alert is firing.This prevents notifications for hundreds or thousands of firing alerts thatare unrelated to the actual issue.

Silences are a straightforward way to simply mute alerts for a given time.A silence is configured based on matchers, just like the routing tree. Incomingalerts are checked whether they match all the equality or regular expressionmatchers of an active silence.If they do, no notifications will be sent out for that alert.

Also looking for a solution like this. Its so easy to set automatic restarts for services in windows servers but no feature like this for Linux. You would think this would be a built in feature by now.

This is a very old post that I wrote that talks about how it could be done. Basically kicking off a custom script via the Alert Engine to do it. This was only for a proof of concept, and it isn't very polished, but it did work.

However, if I had to do it again I'd probably skip the Alert Engine and simply use a SAM Application Template with a Linux Script Monitor (since you already have to have an Application Template for your Process monitors). Have an extra monitor in that template that runs a script that monitors the deamons I want up, and if they are stopped to restart them. Build in some type of logic to handle too many restart attempts, etc. If the deamons are all up, then have the script simply output something to signify everything is ok. The pros to this approach, is that it keeps the ssh creds more secure AND will use the Linux Agent to execute the script if it is deployed.

I got to where I do this for all of my custom script monitors. Why just monitor and create alerts when I'm already in here writing code that will execute on the target machine. If the condition fails i write an output that will set the component into Warning and so SAM records that i've initiated a remediation, and if that remediation fails then we actually mark the component as down and we know that whatever is wrong is more complex than my existing automatic fix can handle.

To see if Snort is working, beyond just getting it to load without errors (not a trivial feat in itself), it is helpful to generate some alerts. The easiest way to do this to validate setup and configuration is to create a couple of testing rules, load them in Snort, and trigger them so you can check to see if they generate alerts as expected. Put your testing rules in the local.rules file that is located in the /etc/snort/rules directory.

If you are going to test Snort with these rules using unified2 output handled by Barnyard2, then you also need to make sure that each rule you write is recorded in the sid-msg.map file located in the /etc/snort directory. Barnyard2 references this mapping file to be able to record information about each alert beyond the signature identifier (sid). Edit sig-msg.map using nano, scroll to the very end of the file, and add a new line for each rule you have created. The syntax in the sig-msg.map file is so for example for the ICMP Testing Rule above, you would add a line that reads:

1000001 ICMP TESTING

If you load these rules by starting Snort with the -A console option, when you test the rules by performing the steps listed below, you can see the output on the screen as it happens.

Hi,

I got a critical alert from a Linux agent and after I fixed the problem I went to checkmk to clear the log so the alert will go away. To my surprise, for the Linux agent there is no Open Log > Clear option like for the Windows one.

I tried by acknowledging the problem but the alert is still there after 24 hours.

Our Linux sys admin is writing a shell script that returns a value (1 or 0). If the value is 1, then I would like to generate a problem within Dynatrace and raise a custom error alert. Is this possible and, if so, what series of steps would I need to implement?

Apart from the API @ACKERMANN M. mentions, there is the option to write your own plugin that is executed by OneAgent. However, just for parsing 1/0 value from a single script, this is quite a big effort. If it's feasible for you, you can also use this generic execution template for that:

The Cybersecurity and Infrastructure Security Agency issued an alert Friday warning of a previously unnoticed backdoor in a widely used Linux tool that compresses and encrypts files shared between parties.

A malicious actor planted a vulnerability into XZ Utils, a Linux file compression and transfer capability. The sinister code was rolled into two recently released versions of the tool, but only certain beta versions of Linux offerings are exposed, according to a March 30 analysis from Red Hat, a cybersecurity company that provides a commercial Linux distribution.

The malicious code was introduced in a Feb. 23 update containing a self-installation script that would have enabled the vulnerability to plant itself into production versions of Ubuntu, which is a Linux distribution used in IT stacks by major companies like Instacart, Slack and Robinhood.

The flaw was discovered by Microsoft engineer Andres Freund, who documented the technical findings on Friday. Other Linux distribution communities have been quickly alerting users to the vulnerability, helping to avert what might have been a much more pervasive problem.

Notably, the malicious code was introduced by a user who has long-contributed to XZ builds. Because the tool is open-source, the capability relies on contributions from community members who keep it up to date through patches and regular updates.

The repository that stores the exploit has since been shuttered as GitHub works to assess the potential ramifications of how or where the malicious build could have been inadvertently incorporated into Linux offerings.

The event is likely to reinvigorate debates in Washington over the safety and security of open-source tools. The discussions have already become a flash point in AI policy talks as lawmakers and the tech industry tussle over how accessible AI systems should be made to the general public.

Alerts are the notifications that Defender for Cloud generates when it detects threats on your resources. It prioritizes and lists the alerts along with the information needed to quickly investigate the problem. Defender for Cloud also provides recommendations for how you can remediate an attack.

If you're using the new preview alerts experience as described in Manage and respond to security alerts in Microsoft Defender for Cloud, you can create sample alerts from the security alerts page in the Azure portal.

After a few minutes, the alerts appear in the security alerts page. They also appear anywhere else that you've configured to receive your Microsoft Defender for Cloud security alerts (connected SIEMs, email notifications, and so on).

After the Microsoft Defender for Endpoint agent is installed on your machine, as part of Defender for Servers integration, follow these steps from the machine where you want to be the attacked resource of the alert:

Defender for Containers provides security alerts for both your clusters and underlying cluster nodes. Defender for Containers accomplishes this by monitoring both the control plane (API server) and the containerized workload.

You can tell if your alert is related to the control plan or the containerized workload based on its prefix. Control plane security alerts have a prefix of K8S_, while security alerts for runtime workload in the clusters have a prefix of K8S.NODE_.

3a8082e126