Python script to detect anomalies in Elasticsearch depending on the given Red Team operational details.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.

Python Query Script


Install required packages:

apt-get install python-pip python2.7 virtualenv

Create virtual environment:

virtualenv -p /usr/bin/python2.7 ./venv

Activate the virtual environment.

source ./venv/bin/activate

Install required Python packages:

pip install -r requirements.txt

Set package path:

export PYTHONPATH=venv/lib/python2.7/site-packages/


Usage: [options]

  -h, --help            show this help message and exit
  --host=HOST           ES host []
  --port=PORT           ES port [9200]
  --index=INDEX         ES index [packetbeat-*]
  --refresh=REFRESH     Refresh every x seconds [60]
  --paths=PATH          C2 paths [/legit/communication/uri/to/filter/width/get
                        C2 path prefix [/legit/*]
                        C2 user agent [Mozilla/5.0 (Windows NT 6.1; WOW64;
                        Trident/7.0; rv:11.0) like Gecko]
  --geo-country=GEO     C2 country [Netherlands]
  --dns=DNS             C2 dns host name
                        C2 dns host name prefix root