Blog Entries

04. 07. 2022 Davide Gallo NetEye

Using DSC to Distribute Icinga Agents

Desired State Configuration (DSC) is a feature in Powershell 4.0 and above that helps administrators to automate the configuration of Windows. I’ll show you below how to use it in order to maintain a consistent Icinga agent configuration across your Windows servers. Our use case As an admin I would like to distribute and configure the…

Read More
24. 06. 2022 Giuseppe Di Garbo NetEye

R.I.P. IPMI – Long Live Redfish

IPMI (the Intelligent Platform Management Interface) has been the de facto standard for managing and monitoring computer hardware for many years, but as Intel explicitly stated here no further updates to the IPMI specification are planned or should be expected. “No further updates to the IPMI specification are planned or should be expected. The IPMI…

Read More
21. 06. 2022 Davide Sbetti Log Management, Log-SIEM

Elastic Transformations: How to Aggregate and Enrich Your Data

In a previous article I analyzed how you can create effective visualizations in Kibana, and how to apply machine learning jobs with the goal of extracting as much information as possible from our data. However, you can also think of data as a raw material, which sometimes needs to be transformed and manipulated before allowing…

Read More
27. 05. 2022 Alessandro Romboli ITOA, NetEye

The Flux Language Inside ITOA

ITOA ITOA is the NetEye component which represents time series data using the Grafana graphics engine. Data is usually collected by Telegraf agents and stored into an InfluxDB specialized non-relational database. Flux In order to manipulate the time series data, Grafana usually adopted a relational language: InfluxQL. The relational approach has had a number of…

Read More
19. 05. 2022 Mattia Codato ctf-writeups, Development

Cyber Apocalypse CTF 2022 – Red Island Writeup

The Cyber Apocalypse CTF is back with the 2022 edition. It’s a Jeopardy-style competition organized by Hack The Box and is open to everyone. Together as a security-focused guild (a concept taken from the Spotify model) we here at Würth Phoenix participated in this challenge and in particular I focused on the web challenges. After…

Read More
15. 04. 2022 Giuseppe Di Garbo NetEye

Scheduled Downtime Management

The correct configuration and scheduling of downtime is an essential element of a monitoring system for several reasons: Mitigating notifications Providing IT operations and Service Desk teams with timely information about when monitored systems may be subject to faults due to maintenance Managing patching, reboot and maintenance procedures that are now typical of all IT…

Read More
29. 03. 2022 Davide Sbetti Machine Learning, NetEye

Data Exploration in Kibana: from a Simple Visualization to Anomaly Detection

These days we live in a data-driven world, where the collection and analysis of data empowers not only companies but also individuals to plan future actions based on the information that is extracted. NetEye enables both the collection and analysis of an enormous amount of data using various platforms, such as Kibana, for data written…

Read More
28. 03. 2022 Damiano Chini Bug Fixes, NetEye

Bug Fixes for NetEye 4.22

We fixed a bug for which the healthcheck 00400_local_neteye_target_services_are_disabled was failing on NetEye Satellites due to some services enabled by default on the NetEye Satellites. The healthcheck now does not control the state of such services on Satellites. For NetEye 4.22 we updated the following packages: neteye-setup to version 1.83.4-1

Read More
25. 03. 2022 Damiano Chini Bug Fixes, NetEye

Bug Fixes for NetEye 4.22

We fixed a bug for which the healthcheck 01220_telegraf_retention_policy_set was failing on NetEye Satellites. The healthcheck is now skipped on Satellites. For NetEye 4.22 we updated the following packages: icingaweb2-module-analytics, icingaweb2-module-analytics-autosetup to version 1.48.3-1

Read More
22. 03. 2022 Mattia Codato ctf-writeups, Development

CTF Insomni’hack Teaser 2022 ─ Vault Challenge

On January 29th, I attended my first CTF (capture the flag) competition: the Insomni’hack teaser.Based on my skills, I decided to go for the challenge called Vault which consists of a web-based vault of five pages: a home page, one where you can see the key/value pair you entered after logging in, a page for…

Read More
16. 03. 2022 William Calliari Bug Fixes, NetEye

Bug Fixes for NetEye 4.22

We added a default Retention Policy for the Telegraf databases. The default Retention Policy can be enabled and configured in the Icingaweb2 Modules Settings under: Configuration > Modules > analytics > Configuration. For NetEye 4.22 we updated the following packages: icingaweb2-module-analytics, icingaweb2-module-analytics-autosetup to version 1.48.2-1

Read More
15. 03. 2022 Alessandro Valentini Bug Fixes, Log-SIEM, NetEye

Bug Fixes for NetEye 4.22

We fixed a wrong behaviour which causes neteye satellite config create to do not work when executed with –tenant parameter. For NetEye 4.22 we updated the following packages: elasticsearch, elasticsearch-autosetup, elasticsearch-neteye-config, filebeat, filebeat-autosetup, filebeat-neteye-config, apm-server, apm-server-autosetup, apm-server-neteye-config, kibana, kibana-autosetup, kibana-neteye-config, logstash, logstash-autosetup, logstash-neteye-config to version 7.15.0_neteye3.37.2-1

Read More
14. 03. 2022 Rocco Pezzani NetEye, Unified Monitoring

Hosts, Zones and Broken Icinga 2 Configurations

During my experience as a Würth Phoenix consultant, I’ve seen a pretty long list of broken Icinga 2 configurations. Several times, customers have begun a scheduled meeting with something like “Hey mister consultant, ever since the last deploy some objects have stopped being monitored, but I don’t see any errors!”. After some troubleshooting, everything always…

Read More
11. 03. 2022 Enrico Alberti Log-SIEM, NetEye

NetEye for Data Protection Officers

With NetEye 4.22 we released a feature awaited for years: the ability to reach the Elasticsearch API externally, thanks to our NGINX proxy under NetEye. This new feature brings with it a lot of use cases, but what was turning over and over in my head was the automatic process for verification of the blockchains…

Read More
02. 03. 2022 Damiano Chini APM, Log-SIEM, NetEye

Observing Events in Tornado with Elastic APM

Sometimes you’d just really like to have an overview of what happens to the Events that flow through Tornado. Where do they come from? Did they get stuck somewhere in the Collectors or in Tornado? Which Tornado Actions did they trigger? Gathering all this information from hundreds of log lines across different services (i.e., Tornado…

Read More

Archive