general.cheat

% general

# Read file line by line
while IFS= read -r line; do echo "$line"; done < "<inputfile>"

# Go to a recently visited directory (e.g. /host/opt/zeek/logs) #tip
g logs

# Go to the host filesystem #tip
g /host

# Not a fan of Vim or Emacs? Try a modern alternative to nano #tip
micro

# Determine when an IP or domain has ever been seen in the past #tip
fd conn | xargs ug -Flz <search string>

% timestamp

# Convert timestamp to date #tip
chop ts | ts2

# Convert timestamp column to date #tip
cols ts ts2

# Convert timestamp column
cols <column> ts2 <period>

$ column: echo ts
$ period: printf 'day\nhour\nminute\nsecond\nnanosecond\n'


% plot
@ timestamp

# Show a bar graph of count per day #tip
chop ts | ts2 | freq | plot-bar Date

# Show a bar graph of count per time period
chop ts | ts2 <period> | freq | plot-bar <period>


% zeek

# Convert Zeek to CSV (alias) #tip
z2c

# Convert Zeek to regular TSV (alias) #tip
z2t

# Convert Zeek to JSON (alias) #tip
z2j

# Convert Zeek to Zeek TSV (alias) #tip
z2z

# Display Zeek logs in an scrollable table #tip
zv

# Convert Zeek to regular TSV
sed -e '0,/^#fields\t/s///' | grep -v '^#'

# Detect DNS tunneling #tip
filter --dns | chop query | distinct | domain | mfo 20


% chop

# Common DNS fields
chop id.orig_h id.resp_h id.resp_p query answers

# Common SSL fields
chop id.orig_h id.resp_h server_name

# Common HTTP fields
chop id.orig_h id.resp_h host

# Common Conn fields
chop id.orig_h id.resp_h id.resp_p conn_state orig_bytes resp_bytes


% helpers

# Skip lines (1 by default); replaces `tail -n +2` #tip
skip

# Most Frequent Occurrence; replaces `sort | uniq -c | sort -nr` #tip
mfo

# Get the top 25 most frequent results #tip
mfo 25

# Least Frequent Occurrence; replaces `sort | uniq -c | sort -n` #tip
lfo

# Get the top 25 least frequent results #tip
lfo 25

# Number of distinct elements (`card`inality); replaces `sort | uniq | wc -l` #tip
card

# Find distinct elements; replaces `sort | uniq` #tip
distinct

# Uniq a file leaving first line (header) in place #tip
{ IFS= read -r header; echo -n "$header" ; distinct ; }

# Strip subdomains from list of domains #tip
domain

# Strip up to 3rd level domain from list of domains #tip
domain 3

# Turn a list of IPv4 addresses into class C subnets #tip
cat ips.txt | rev | domain 3 | rev | distinct

# Perform WHOIS queries on a list of IPs #tip
cat ips.txt | whois-bulk