Adam Saul - Dispatch IT Blog

Sign in Subscribe

Adam Saul

VW MK4 BEW Camshaft and Turbo

This has been a long project or at least it feels like it. Safe to say, I will break this up into chunks. Started the process of removing the old camshaft and doing a timing belt replacement has lead me down the rabbit hole. Now the plan is to rebuild

BMW X5d Intake Manifold

Recently scooped up a 2016 BMW X5 N57 (roughly 70k miles on it) with the N57 engine and like all of my diesel projects, it was time to squeeze a little more out of it. I like to focus on efficiency first, performance second. First thing to check was the

Splunk UF Tagging

Do you have Splunk UF's that are running in a load-balanced manner and/or ingesting other host data (ie. central syslog server)? Take advantage of Splunk's built-in meta tagging. This meta tag can be used with multiple key::value definitions. Navigate to ~/etc/system/local within

Technology Add-on for Certificate Checking

We have released an updated version (1.2.2) of our Splunk Technology Add-on for Certificate Checking. This app was designed to help identify the plethora of SSL certificates used within a Splunk environment (Windows or *nix). For easier parsing, we now include the following fields about each certificate: -

Splunk Tier Tagging

Do you have a large amount of HF tiers or data coming in through other mechanisms? This will help troubleshoot where that data was "cooked" by Splunk. We will build a simple Splunk add-on app that you can deploy on Heavy Forwarder's and it will simply

Syslog Suricata Extractions

This extraction is for Suricata alerts that do not include an interface description > [(?<gen_id>\d+?):(?<sig_id>\d+?):(?<sigrev_id>\d+?)]\s+(?. ?)(?:\s+[Classification:\s)(?.*?)(?:])(?:\s+[Priority:\s+)(?\d+)(?:]\s+{)(? \w+)(?:}\s+)(?<src_ip>\S+)(?::)(?<src_port>\d+

First blog post

Thanks for stopping by! This is my first blog but I'm looking forward to sharing all the various projects I've built and things I've learned along the way. Projects/Posts to come: - Suricata alert extraction - Compiling nginx 1.19.6 with TLS