WRKLOG-2026-06-09

# RealVNC
Get-ItemProperty "HKLM:\SOFTWARE\RealVNC\*" -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\RealVNC\*" -ErrorAction SilentlyContinue

# TightVNC
Get-ItemProperty "HKLM:\SOFTWARE\TightVNC" -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\TightVNC" -ErrorAction SilentlyContinue

# UltraVNC
Get-ItemProperty "HKLM:\SOFTWARE\uvnc bvba\UltraVNC" -ErrorAction SilentlyContinue

# TigerVNC
Get-ItemProperty "HKLM:\SOFTWARE\TigerVNC" -ErrorAction SilentlyContinue

Get-Service | Where-Object { $_.DisplayName -match "vnc" -or $_.Name -match "vnc" } |
  Format-Table Name, DisplayName, Status, StartType -AutoSize

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -match "vnc" } |
  Select-Object DisplayName, DisplayVersion, UninstallString, InstallDate |
  Format-List

Get-ScheduledTask | Where-Object { $_.TaskName -match "vnc" -or $_.TaskPath -match "vnc" } |
  Format-Table TaskName, TaskPath, State -AutoSize

Get-NetFirewallRule | Where-Object { $_.DisplayName -match "vnc" } |
  Format-Table DisplayName, Direction, Action, Enabled -AutoSize

# Also check by port — VNC rules may not mention VNC in the name
Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -match "^590[0-9]$" } |
  Get-NetFirewallRule |
  Format-Table DisplayName, Direction, Action, Enabled -AutoSize

Get-NetTCPConnection -State Listen |
  Where-Object { $_.LocalPort -ge 5900 -and $_.LocalPort -le 5910 } |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{N='ProcessName';E={(Get-Process -Id $_.OwningProcess).ProcessName}} |
  Format-Table -AutoSize

Get-Service | Where-Object { $_.DisplayName -match "vnc" -or $_.Name -match "vnc" } | ForEach-Object {
    Write-Host "Stopping: $($_.DisplayName) [$($_.Name)]" -ForegroundColor Yellow
    Stop-Service -Name $_.Name -Force
    Set-Service -Name $_.Name -StartupType Disabled
    Write-Host "  Stopped and disabled." -ForegroundColor Green
}

# Gather uninstall entries
$vnc = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -match "vnc" }

foreach ($app in $vnc) {
    Write-Host "Uninstalling: $($app.DisplayName)" -ForegroundColor Yellow
    Write-Host "  UninstallString: $($app.UninstallString)" -ForegroundColor Cyan

    # Attempt silent uninstall — adjust flags per vendor
    if ($app.UninstallString -match "msiexec") {
        # MSI-based: add /quiet /norestart
        $msiArgs = ($app.UninstallString -replace "msiexec.exe\s*", "") + " /quiet /norestart"
        Start-Process "msiexec.exe" -ArgumentList $msiArgs -Wait
    } else {
        # EXE-based: try /S (NSIS) or /SILENT (Inno Setup)
        $exe = $app.UninstallString -replace '"', ''
        Start-Process $exe -ArgumentList "/S" -Wait -ErrorAction SilentlyContinue
    }
}

# RealVNC Server
& "C:\Program Files\RealVNC\VNC Server\vnclicense.exe" -deactivate 2>$null
& "C:\Program Files\RealVNC\VNC Server\vncserver.exe" -unregister 2>$null

# TightVNC — typical MSI GUID (verify with registry query above)
# msiexec /x {YOUR-GUID-HERE} /quiet /norestart

# UltraVNC
& "C:\Program Files\uvnc bvba\UltraVNC\unins000.exe" /SILENT 2>$null

# Remove rules named with VNC
Get-NetFirewallRule | Where-Object { $_.DisplayName -match "vnc" } | ForEach-Object {
    Write-Host "Removing firewall rule: $($_.DisplayName)" -ForegroundColor Yellow
    Remove-NetFirewallRule -Name $_.Name
}

# Remove rules allowing VNC ports regardless of name
Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -match "^590[0-9]$" } |
  Get-NetFirewallRule | ForEach-Object {
    Write-Host "Removing port-based rule: $($_.DisplayName) [port filter match]" -ForegroundColor Yellow
    Remove-NetFirewallRule -Name $_.Name
}

$vnc_paths = @(
    "$env:ProgramFiles\RealVNC",
    "${env:ProgramFiles(x86)}\RealVNC",
    "$env:ProgramFiles\TightVNC",
    "${env:ProgramFiles(x86)}\TightVNC",
    "$env:ProgramFiles\uvnc bvba",
    "${env:ProgramFiles(x86)}\uvnc bvba",
    "$env:ProgramFiles\TigerVNC",
    "${env:ProgramFiles(x86)}\TigerVNC"
)

foreach ($path in $vnc_paths) {
    if (Test-Path $path) {
        Write-Host "Removing: $path" -ForegroundColor Yellow
        Remove-Item -Path $path -Recurse -Force
    }
}

# Active VNC services
systemctl list-units --type=service --all | grep -i vnc

# Enabled VNC services (survive reboot)
systemctl list-unit-files --type=service | grep -i vnc

dpkg -l | awk '/vnc|tigervnc|tightvnc|x11vnc|vino/{print $1, $2, $3}'

rpm -qa | grep -iE 'vnc|tigervnc|tightvnc|x11vnc|vino'

ss -tlnp | awk '$4 ~ /:590[0-9]/ {print}'
# Example output:
# LISTEN  0  5  0.0.0.0:5901  0.0.0.0:*  users:(("Xvnc",pid=1234,fd=7))

ps aux | awk '/[Vv]nc|[Xx]11vnc|[Vv]ino/{print $1, $2, $11}'

find /etc /home -name "*.vnc" -o -name "xstartup" -o -name ".vnc" -type d 2>/dev/null

# Stop all VNC-related services
for svc in $(systemctl list-units --type=service --all --no-legend | awk '/vnc/{print $1}'); do
    echo "Stopping: ${svc}"
    sudo systemctl stop "${svc}"
    sudo systemctl disable "${svc}"
    echo "  Stopped and disabled."
done

# Verify what will be removed first
apt list --installed 2>/dev/null | grep -iE 'vnc|tigervnc|tightvnc|x11vnc|vino'

# Remove (purge removes config files too)
sudo apt purge -y tigervnc-standalone-server tigervnc-common \
    tightvncserver x11vnc vino 2>/dev/null
sudo apt autoremove -y

# Verify first
rpm -qa | grep -iE 'vnc|tigervnc|tightvnc|x11vnc|vino'

# Remove
sudo dnf remove -y tigervnc-server tigervnc x11vnc 2>/dev/null

# Check for VNC rules
sudo ufw status numbered | grep -i "590[0-9]"

# Delete by rule number (adjust number from output above)
# sudo ufw delete <rule-number>

# Or deny the range explicitly
sudo ufw deny 5900:5910/tcp comment "Block VNC — unauthorized remote access"
sudo ufw reload

# Check current rules
sudo firewall-cmd --list-all | grep -E "590[0-9]|vnc"

# Remove VNC service if added
sudo firewall-cmd --permanent --remove-service=vnc-server 2>/dev/null

# Block VNC ports explicitly
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="5900-5910" protocol="tcp" reject'
sudo firewall-cmd --reload

# Find and list .vnc directories across all home dirs
find /home -maxdepth 2 -name ".vnc" -type d 2>/dev/null

# Remove them (after confirming the list above)
# find /home -maxdepth 2 -name ".vnc" -type d -exec rm -rf {} +

show run | include vnc
show run | include http server
show run | include ssh
show run management-access

show run | section line vty
show run | include ip http
show ip ssh
show run | include access-class

# FMC management is web-based (HTTPS 443)
# Verify no additional listeners on unexpected ports
show network          # FMC CLI
show access-list      # Check for VNC port permits on managed firewalls

# ASA
show access-list | include 5900
show access-list | include 5901

# IOS-XE
show ip access-lists | include 5900

# Single host
# Replace <target-ip> with the remediated host
# Example: nmap -p 5900-5910 10.50.4.100
nmap -sT -p 5900-5910 <target-ip>

# Subnet sweep — find any remaining VNC listeners
# Example: nmap -p 5900-5910 10.50.4.0/24
nmap -sT -p 5900-5910 --open <subnet-cidr>

# Services
Get-Service | Where-Object { $_.DisplayName -match "vnc" }
# Expected: no output

# Listening ports
Get-NetTCPConnection -State Listen |
  Where-Object { $_.LocalPort -ge 5900 -and $_.LocalPort -le 5910 }
# Expected: no output

# Registry
Get-ItemProperty "HKLM:\SOFTWARE\*VNC*", "HKLM:\SOFTWARE\WOW6432Node\*VNC*" -ErrorAction SilentlyContinue
# Expected: no output

# Installed programs
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -match "vnc" }
# Expected: no output

# Services
systemctl list-units --type=service --all | grep -i vnc
# Expected: no output

# Listening ports
ss -tlnp | awk '$4 ~ /:590[0-9]/'
# Expected: no output

# Packages
dpkg -l 2>/dev/null | grep -i vnc    # Debian
rpm -qa 2>/dev/null | grep -i vnc    # RHEL
# Expected: no output (or status 'rc' = removed, config remaining)

# Processes
pgrep -ai vnc
# Expected: no output

# Capture evidence to a timestamped file per host
# Example: HOSTNAME=ws-radiology-04
echo "=== VNC Removal Evidence — $(hostname) ===" > "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
echo "Date: $(date)" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
echo "" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"

echo "--- Services ---" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
systemctl list-units --type=service --all 2>/dev/null | grep -i vnc >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
echo "(none found)" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"

echo "--- Listening Ports ---" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
ss -tlnp | awk 'NR==1 || $4 ~ /:590[0-9]/' >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"

echo "--- Packages ---" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
dpkg -l 2>/dev/null | grep -i vnc >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
rpm -qa 2>/dev/null | grep -i vnc >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"

echo "--- Nmap ---" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"
echo "Run from scanning host: nmap -sT -p 5900-5910 $(hostname -I | awk '{print $1}')" >> "/tmp/vnc-removal-$(hostname)-$(date +%F).txt"

Administration → System → Logging → Remote Logging Targets
  → Add

  Name:           CHLXSYSLOG01
  IP Address:     10.248.13.254
  Port:           514
  Facility:       LOCAL6
  Max Length:     8192
  Include Alarms: Yes (optional — adds ISE health alarms to syslog)

Administration → System → Logging → Logging Categories

  Category                          → Enable → Target: CHLXSYSLOG01
  ─────────────────────────────────────────────────────────────────
  Passed Authentications            → ✓
  Failed Attempts                   → ✓
  RADIUS Diagnostics                → ✓
  Authentication Flow Diagnostics   → ✓
  Administrator Audits              → ✓ (optional — tracks admin logins)
  System Diagnostics                → ✓ (optional — ISE health)
  Posture and Client Provisioning   → ✓ (optional)

# SSH to ISE, enter application shell
# ISE does not expose syslog target config via CLI — GUI only.
# CLI can verify after configuration:
show logging application
show logging system

CISE_Passed_Authentications     — Successful 802.1X/MAB/RADIUS auths
CISE_Failed_Attempts            — Auth failures (wrong cert, expired, policy deny)
CISE_RADIUS_Diagnostics         — RADIUS protocol-level events
CISE_RADIUS_Accounting          — Accounting start/stop/interim
CISE_Administrative_and_Operational_Audit — Admin GUI/CLI actions
CISE_Profiler                   — Endpoint profiling events
CISE_System_Diagnostics         — ISE node health, replication
CISE_Threat_Centric_NAC         — TC-NAC verdicts (if enabled)

conf t
logging host 10.248.13.254
logging trap informational
logging facility local6
logging source-interface Loopback0    (1)
logging on
end

show logging
show logging | include Logging to

Logging to 10.248.13.254 (udp port 514, audit disabled,
    link up),
    27 message lines logged,
    0 message lines rate-limited,
    0 message lines dropped-by-MD,
    xml disabled, sequence number disabled
    filtering disabled
Logging Source-Interface: Loopback0

%SEC-6-IPACCESSLOGP     — ACL permit/deny hits
%LINK-3-UPDOWN          — Interface state changes
%LINEPROTO-5-UPDOWN     — Line protocol state changes
%SYS-5-CONFIG_I         — Config change from terminal
%AUTHMGR-5-*            — 802.1X auth manager events
%DOT1X-5-*              — 802.1X protocol events
%MAB-5-*                — MAB authentication events
%EPM-6-POLICY_APP*      — Endpoint policy application (dACL, VLAN)
%RADIUS-4-RADIUS_DEAD   — RADIUS server unreachable

System → Configuration → Logging → Syslog Server
  → Add Syslog Server

  IP Address:    10.248.13.254
  Port:          514
  Protocol:      UDP
  Facility:      LOCAL5

  Enable logging for:
    ✓ Health Events
    ✓ Audit Logs
    ✓ Intrusion Events (if applicable)
    ✓ Connection Events (high volume — enable selectively)

! On FMC: Devices → Platform Settings → <policy> → Syslog
! Or via FlexConfig:
platform logging host inside 10.248.13.254 udp/514
platform logging trap informational
platform logging facility local5

FMC audit logs:
  "User '<user>' ... from <ip>"             — Admin login/logout
  "Policy '<name>' ... deployed"            — Policy deployment
  "Task '<name>' ... completed/failed"      — Scheduled task results

FTD connection events (if enabled):
  %FTD-6-430003   — Connection permitted
  %FTD-4-430002   — Connection denied
  %FTD-1-430001   — Intrusion event

FTD intrusion events:
  GID:SID format (e.g., 1:40000)           — Snort rule triggers
  Classification, Priority, Source/Dest     — Full 5-tuple

Health events:
  "Health Alert: <module> ... <status>"     — Disk, CPU, interface health

# What configs exist now?
ls -la /etc/rsyslog.d/

# Is the ASA config from yesterday still active?
sudo awk '/^[^#]/ && NF' /etc/rsyslog.d/10-asa.conf

# Current disk usage — baseline before adding sources
df -h /var | awk 'NR==1 || /var/'
du -sh /var/log/asa/ 2>/dev/null || echo "No ASA log dir yet"

sudo tee /etc/rsyslog.d/20-ise.conf << 'RSYSLOG'
# ISE syslog — home lab ISE instance
# Source IP: <ISE_IP> (replace with actual ISE management IP)
# Facility: local6 (set on ISE remote logging target)
# Created: 2026-06-09

template(name="IseFile" type="string"
    string="/var/log/ise/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log")

if $fromhost-ip == '<ISE_IP>' then {
    action(type="omfile" dynaFile="IseFile"
           FileCreateMode="0640"
           DirCreateMode="0750"
           CreateDirs="on")
    stop
}
RSYSLOG

sudo awk '/^[^#]/ && NF' /etc/rsyslog.d/20-ise.conf

sudo tee /etc/rsyslog.d/20-switch.conf << 'RSYSLOG'
# Network switch syslog — IOS/IOS-XE
# Source IP: <SWITCH_IP> (replace with switch management/source-interface IP)
# Facility: local6 (set on switch: logging facility local6)
# Created: 2026-06-09

template(name="SwitchFile" type="string"
    string="/var/log/switch/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log")

if $fromhost-ip == '<SWITCH_IP>' then {
    action(type="omfile" dynaFile="SwitchFile"
           FileCreateMode="0640"
           DirCreateMode="0750"
           CreateDirs="on")
    stop
}
RSYSLOG

sudo awk '/^[^#]/ && NF' /etc/rsyslog.d/20-switch.conf

sudo tee /etc/rsyslog.d/20-fmc.conf << 'RSYSLOG'
# FMC syslog — Cisco Firepower Management Center
# Source IP: <FMC_IP> (replace with FMC management IP)
# Facility: local5 (set on FMC syslog server config)
# Created: 2026-06-09

template(name="FmcFile" type="string"
    string="/var/log/fmc/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log")

if $fromhost-ip == '<FMC_IP>' then {
    action(type="omfile" dynaFile="FmcFile"
           FileCreateMode="0640"
           DirCreateMode="0750"
           CreateDirs="on")
    stop
}
RSYSLOG

sudo awk '/^[^#]/ && NF' /etc/rsyslog.d/20-fmc.conf

/etc/rsyslog.d/
├── 10-asa.conf         ← existing (2026-06-08)
├── 20-fmc.conf         ← new
├── 20-ise.conf         ← new
├── 20-switch.conf      ← new
└── (any other existing configs)

sudo /usr/sbin/rsyslogd -N1

rsyslogd: version 8.2504.0, config validation run (level 1)...
rsyslogd: End of config validation run. Bye.

# Before — confirm current PID and uptime
systemctl show rsyslog --property=MainPID,ActiveEnterTimestamp

# Change
sudo systemctl restart rsyslog

# After — confirm new PID and clean status
systemctl show rsyslog --property=MainPID,ActiveEnterTimestamp
systemctl is-active rsyslog && echo "rsyslog running" || echo "FAILED"
sudo journalctl -u rsyslog --since "30 seconds ago" --no-pager

# ISE — filter by ISE source IP
sudo tcpdump -i any src host <ISE_IP> and port 514 -nn -c 5

# Switch — filter by switch source IP
sudo tcpdump -i any src host <SWITCH_IP> and port 514 -nn -c 5

# FMC — filter by FMC source IP
sudo tcpdump -i any src host <FMC_IP> and port 514 -nn -c 5

# ISE
ls -la /var/log/ise/ 2>/dev/null && tail -5 /var/log/ise/*/$(date +%Y-%m-%d).log 2>/dev/null || echo "No ISE logs yet"

# Switch
ls -la /var/log/switch/ 2>/dev/null && tail -5 /var/log/switch/*/$(date +%Y-%m-%d).log 2>/dev/null || echo "No switch logs yet"

# FMC
ls -la /var/log/fmc/ 2>/dev/null && tail -5 /var/log/fmc/*/$(date +%Y-%m-%d).log 2>/dev/null || echo "No FMC logs yet"

# Pane 1: ISE
sudo tail -f /var/log/ise/*/$(date +%Y-%m-%d).log

# Pane 2: Switch
sudo tail -f /var/log/switch/*/$(date +%Y-%m-%d).log

# Pane 3: FMC
sudo tail -f /var/log/fmc/*/$(date +%Y-%m-%d).log

# From a wired endpoint, disconnect/reconnect the cable.
# Or from ISE CLI:
show logging application | tail -20
# Any RADIUS auth attempt generates CISE_Passed_Authentications or CISE_Failed_Attempts

! On the switch — any config change generates %SYS-5-CONFIG_I
conf t
hostname <current-hostname>
end
! Or shut/no shut a test interface

FMC GUI: System → Health → Health Monitor → Run All Modules
This generates health event syslogs immediately.
Or: make any policy change → deploy → generates audit log.

cat /etc/logrotate.d/rsyslog

sudo tee /etc/logrotate.d/rsyslog-sources << 'LOGROTATE'
/var/log/asa/*/*.log
/var/log/ise/*/*.log
/var/log/switch/*/*.log
/var/log/fmc/*/*.log
{
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0640 syslog adm
    sharedscripts
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}
LOGROTATE

sudo logrotate -d /etc/logrotate.d/rsyslog-sources

sudo tee /etc/rsyslog.d/90-monad-forward.conf << 'RSYSLOG'
# Forward all collected logs to Monad syslog input
# Disk-assisted queue provides backpressure and survives outages
#
# queue.type="LinkedList"         — in-memory linked list (fast, low overhead)
# queue.filename="monad-fwd"     — enables disk assistance; files land in WorkDirectory
# queue.maxDiskSpace="500m"      — cap disk usage at 500MB before dropping
# queue.saveOnShutdown="on"      — flush in-memory queue to disk on rsyslog stop/restart
# action.resumeRetryCount="-1"   — retry forever (never give up on Monad)
# action.resumeInterval="30"     — wait 30s between retry attempts
#
# template: RSYSLOG_SyslogProtocol23Format = RFC 5424 structured syslog
#   Monad's syslog input expects RFC 5424. If it chokes, try RSYSLOG_TraditionalForwardFormat (BSD).

action(type="omfwd"
       target="<MONAD_SYSLOG_ENDPOINT>"
       port="<PORT>"
       protocol="tcp"
       template="RSYSLOG_SyslogProtocol23Format"
       queue.type="LinkedList"
       queue.filename="monad-fwd"
       queue.maxDiskSpace="500m"
       queue.saveOnShutdown="on"
       action.resumeRetryCount="-1"
       action.resumeInterval="30")
RSYSLOG

dpkg -l | awk '/rsyslog.*http/'
# If not installed:
# sudo apt install rsyslog-omhttp

sudo tee /etc/rsyslog.d/90-monad-forward-http.conf << 'RSYSLOG'
module(load="omhttp")

template(name="MonadJSON" type="list") {
    constant(value="{\"message\":\"")
    property(name="msg" format="jsonf")
    constant(value="\",\"host\":\"")
    property(name="hostname")
    constant(value="\",\"facility\":\"")
    property(name="syslogfacility-text")
    constant(value="\",\"severity\":\"")
    property(name="syslogseverity-text")
    constant(value="\",\"timestamp\":\"")
    property(name="timereported" dateformat="rfc3339")
    constant(value="\"}")
}

action(type="omhttp"
       server="<MONAD_HTTP_ENDPOINT>"
       serverport="443"
       restpath="<MONAD_HTTP_PATH>"
       usehttps="on"
       httpheaderkey="Authorization"
       httpheadervalue="ApiKey <MONAD_API_KEY>"
       template="MonadJSON"
       batch="on"
       batch.maxsize="100"
       queue.type="LinkedList"
       queue.filename="monad-http-fwd"
       queue.maxDiskSpace="500m"
       queue.saveOnShutdown="on"
       action.resumeRetryCount="-1"
       action.resumeInterval="30")
RSYSLOG

sudo rsyslogd -N1 2>&1 | tail -5

sudo systemctl restart rsyslog
sudo systemctl status rsyslog --no-pager

ls -la /var/spool/rsyslog/
# Should see monad-fwd.* files appear once messages start queuing

curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v2/${MONAD_ORG_ID}/pipelines" | \
  jq '.pipelines[] | {name, id, enabled}'

curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v1/inputs" | \
  jq '.[] | select(.name | test("syslog"; "i")) | {type_id, name, description}'

curl -s -X POST \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  -H "Content-Type: application/json" \
  "${MONAD_API_URL}/v1/${MONAD_ORG_ID}/inputs" \
  -d '{
    "name": "CHLXSYSLOG01-Forward",
    "description": "Syslog forwarded from centralized rsyslog collector (10.248.13.254)",
    "type": "monad-syslog",
    "config": {
      "settings": {}
    }
  }' | jq '.'

SYSLOG_INPUT_ID="<id-from-response>"

curl -s -X POST \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  -H "Content-Type: application/json" \
  "${MONAD_API_URL}/v2/${MONAD_ORG_ID}/pipelines" \
  -d '{
    "name": "CHLA-rsyslog-to-Sentinel",
    "description": "Centralized rsyslog (CHLXSYSLOG01) forwarding to Microsoft Sentinel",
    "enabled": false
  }' | jq '.'

PIPELINE_ID="<id-from-response>"

INPUT_NODE_ID=$(cat /proc/sys/kernel/random/uuid)

curl -s -X PATCH \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  -H "Content-Type: application/json" \
  "${MONAD_API_URL}/v2/${MONAD_ORG_ID}/pipelines/${PIPELINE_ID}" \
  -d "$(jq -n \
    --arg node_id "$INPUT_NODE_ID" \
    --arg input_id "$SYSLOG_INPUT_ID" \
    '{
      nodes: [{
        id: $node_id,
        slug: ("input-" + ($node_id | split("-")[0])),
        component_id: $input_id,
        component_type: "input",
        enabled: true
      }]
    }')" | jq '.'

curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v1/${MONAD_ORG_ID}/outputs" | \
  jq '.outputs[] | select(.name | test("sentinel"; "i")) | {name, id, type}'

curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v1/outputs" | \
  jq '.[] | select(.name | test("sentinel"; "i")) | {type_id, name}'

curl -s -X POST \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  -H "Content-Type: application/json" \
  "${MONAD_API_URL}/v1/${MONAD_ORG_ID}/outputs" \
  -d '{
    "name": "CHLA-Sentinel",
    "description": "Microsoft Sentinel workspace for CHLA SIEM",
    "type": "microsoft-sentinel",
    "config": {
      "settings": {
        "tenant_id": "<AZURE_TENANT_ID>",
        "client_id": "<AZURE_CLIENT_ID>",
        "client_secret": "<AZURE_CLIENT_SECRET>",
        "workspace_id": "<LOG_ANALYTICS_WORKSPACE_ID>",
        "table_name": "Syslog"
      }
    }
  }' | jq '.'

SENTINEL_OUTPUT_ID="<id-from-response-or-existing>"

OUTPUT_NODE_ID=$(cat /proc/sys/kernel/random/uuid)

curl -s -X PATCH \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  -H "Content-Type: application/json" \
  "${MONAD_API_URL}/v2/${MONAD_ORG_ID}/pipelines/${PIPELINE_ID}" \
  -d "$(jq -n \
    --arg input_node "$INPUT_NODE_ID" \
    --arg output_node "$OUTPUT_NODE_ID" \
    --arg output_id "$SENTINEL_OUTPUT_ID" \
    '{
      nodes: [{
        id: $output_node,
        slug: ("output-" + ($output_node | split("-")[0])),
        component_id: $output_id,
        component_type: "output",
        enabled: true
      }],
      edges: [{
        name: "always",
        from_node_instance_id: $input_node,
        to_node_instance_id: $output_node,
        conditions: { operator: "always" }
      }]
    }')" | jq '.'

{
  "conditions": {
    "operator": "and",
    "rules": [{
      "field": "message",
      "operator": "contains",
      "value": "%ASA-"
    }]
  }
}

curl -s -X PATCH \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  -H "Content-Type: application/json" \
  "${MONAD_API_URL}/v1/${MONAD_ORG_ID}/pipelines/${PIPELINE_ID}" \
  -d '{"enabled": true}' | jq '{id, name, enabled}'

curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v2/${MONAD_ORG_ID}/pipelines/${PIPELINE_ID}" | \
  jq '{
    name, enabled,
    nodes: [.nodes[] | {slug, component_type, enabled}],
    edges: [.edges[] | {name, from: .from_node_instance_id[:8], to: .to_node_instance_id[:8]}]
  }'

curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v1/${MONAD_ORG_ID}/logs/pipelines/${PIPELINE_ID}" | \
  jq '.logs[:10] | .[] | {timestamp, level, message}'

curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v1/${MONAD_ORG_ID}/logs/pipelines/${PIPELINE_ID}" | \
  jq '{
    total_logs: (.logs | length),
    errors: [.logs[] | select(.level == "error")] | length,
    latest: .logs[0].timestamp
  }'

# Queue spool files — if these exist, messages are buffered (Monad was/is unreachable)
ls -lh /var/spool/rsyslog/monad-fwd.* 2>/dev/null || echo "No queue files (good — messages flowing)"

# rsyslog internal stats (if impstats is enabled)
grep 'monad-fwd' /var/log/rsyslog-stats.log 2>/dev/null | tail -5

# Quick health: is rsyslog forwarding or queuing?
sudo journalctl -u rsyslog --since "10 min ago" --no-pager | \
  awk '/monad|queue|suspend|resume/'

# Enable impstats if not already (add to /etc/rsyslog.conf)
# module(load="impstats" interval="60" format="cee" log.syslog="on")
# Then:
sudo grep -c 'monad-fwd' /var/log/syslog && echo "Queue stats present"

! On the ASA CLI — generate a syslog event
logging message 199999 level 6
! Or simply make a minor config change and revert

# On CHLXSYSLOG01
sudo tail -f /var/log/syslog | awk '/%ASA/{print; count++; if(count>=3) exit}'

# On your workstation — check Monad pipeline logs (allow 60s for propagation)
sleep 60 && curl -s -X GET \
  -H "X-API-Key: ${MONAD_API_KEY}" \
  "${MONAD_API_URL}/v1/${MONAD_ORG_ID}/logs/pipelines/${PIPELINE_ID}" | \
  jq '.logs[:5]'

// In Log Analytics workspace — Sentinel
Syslog
| where TimeGenerated > ago(10m)
| where SyslogMessage contains "%ASA-"
| take 10