mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
Start cleaning up and update documentation
This commit is contained in:
Marco Ochse
@ -1,33 +1,20 @@
|
||||
# dockerized elk stack
|
||||
# Elasticsearch
|
||||
[](https://microbadger.com/images/dtagdevsec/elasticsearch:1710 "Get your own version badge on microbadger.com") [](https://microbadger.com/images/dtagdevsec/elasticsearch:1710 "Get your own image badge on microbadger.com")
|
||||
|
||||
# Logstash
|
||||
[](https://microbadger.com/images/dtagdevsec/logstash:1710 "Get your own version badge on microbadger.com") [](https://microbadger.com/images/dtagdevsec/logstash:1710 "Get your own image badge on microbadger.com")
|
||||
|
||||
[elk](http://www.elasticsearch.org/overview/) is a stack combining elasticsearch, logstash and the kibana dashboard. It is used to structure and vizualize data in realtime.
|
||||
# Kibana
|
||||
[](https://microbadger.com/images/dtagdevsec/kibana:1710 "Get your own version badge on microbadger.com") [](https://microbadger.com/images/dtagdevsec/kibana:1710 "Get your own image badge on microbadger.com")
|
||||
|
||||
This repository contains the necessary files to create a *dockerized* version of the elk stack.
|
||||
# elk stack
|
||||
|
||||
[elk](http://www.elasticsearch.org/overview/) is a stack combining elasticsearch, logstash and the kibana dashboard. It is used to structure and visualize data in realtime.
|
||||
|
||||
This dockerized version is part of the **[T-Pot community honeypot](http://dtag-dev-sec.github.io/)** of Deutsche Telekom AG.
|
||||
|
||||
The `Dockerfile` contains the blueprint for the dockerized elk stack and will be used to setup the docker image.
|
||||
|
||||
Further, `elasticsearch.yml`, `logstash.conf`, `elkbase.tar.gz`, `elk.ico` and `kibana.svg`, are all tailored to fit the T-Pot environment.
|
||||
|
||||
The `supervisord.conf` is used to start elk under supervision of supervisord.
|
||||
|
||||
Using systemd, copy the `systemd/elk.service` to `/etc/systemd/system/elk.service` and start using
|
||||
|
||||
```
|
||||
systemctl enable elk
|
||||
systemctl start elk
|
||||
```
|
||||
|
||||
This will make sure that the docker container is started with the appropriate permissions and port mappings. Further, it autostarts during boot.
|
||||
|
||||
Starting with T-Pot 16.10 you can simply access the kibana dashboard by browsing to ``https://<your.ip>:64297`` and enter your web user credentials.
|
||||
|
||||
Note: The kibana dashboard can be customized to fit your needs.
|
||||
|
||||
By default all data will be persistently stored in `/data/elk/`. Indexed events older than 90 days will be deleted. You can adjust this behavior in `/etc/crontab` to fit your needs, but be advised to provide enough RAM and free disk-space if you wish to do so.
|
||||
The `Dockerfiles` contain the blueprint for the dockerized elk stack and will be used to setup the docker images.
|
||||
|
||||
# T-Pot Dashboard
|
||||
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 910 KiB After Width: | Height: | Size: 591 KiB |
@ -11,8 +11,8 @@ RUN apk -U upgrade && \
|
||||
# Get and install packages
|
||||
cd /root/dist/ && \
|
||||
mkdir -p /usr/share/elasticsearch/ && \
|
||||
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.1.tar.gz && \
|
||||
tar xvfz elasticsearch-5.6.1.tar.gz --strip-components=1 -C /usr/share/elasticsearch/ && \
|
||||
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.3.tar.gz && \
|
||||
tar xvfz elasticsearch-5.6.3.tar.gz --strip-components=1 -C /usr/share/elasticsearch/ && \
|
||||
|
||||
# Add and move files
|
||||
cd /root/dist/ && \
|
||||
|
||||
@ -11,8 +11,8 @@ RUN apk -U upgrade && \
|
||||
# Get and install packages
|
||||
cd /root/dist/ && \
|
||||
mkdir -p /usr/share/kibana/ && \
|
||||
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.1-linux-x86_64.tar.gz && \
|
||||
tar xvfz kibana-5.6.1-linux-x86_64.tar.gz --strip-components=1 -C /usr/share/kibana/ && \
|
||||
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.3-linux-x86_64.tar.gz && \
|
||||
tar xvfz kibana-5.6.3-linux-x86_64.tar.gz --strip-components=1 -C /usr/share/kibana/ && \
|
||||
|
||||
# Kibana's bundled node does not work in alpine
|
||||
rm /usr/share/kibana/node/bin/node && \
|
||||
@ -47,6 +47,6 @@ RUN apk -U upgrade && \
|
||||
# Healthcheck
|
||||
HEALTHCHECK --retries=10 CMD curl -s -XGET 'http://127.0.0.1:5601'
|
||||
|
||||
# Start kibana
|
||||
# Start kibana
|
||||
USER kibana
|
||||
CMD ["/usr/share/kibana/bin/kibana"]
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
Binary file not shown.
@ -12,9 +12,9 @@ RUN apk -U upgrade && \
|
||||
git clone https://github.com/dtag-dev-sec/listbot /etc/listbot && \
|
||||
cd /root/dist/ && \
|
||||
mkdir -p /usr/share/logstash/ && \
|
||||
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.6.1.tar.gz && \
|
||||
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.6.3.tar.gz && \
|
||||
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN.tar.gz && \
|
||||
tar xvfz logstash-5.6.1.tar.gz --strip-components=1 -C /usr/share/logstash/ && \
|
||||
tar xvfz logstash-5.6.3.tar.gz --strip-components=1 -C /usr/share/logstash/ && \
|
||||
/usr/share/logstash/bin/logstash-plugin install logstash-filter-translate && \
|
||||
/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog && \
|
||||
tar xvfz GeoLite2-ASN.tar.gz --strip-components=1 -C /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.3.1-java/vendor/ && \
|
||||
@ -34,5 +34,5 @@ RUN apk -U upgrade && \
|
||||
# Healthcheck
|
||||
HEALTHCHECK --retries=10 CMD curl -s -XGET 'http://127.0.0.1:9600'
|
||||
|
||||
# Start logstash
|
||||
# Start logstash
|
||||
CMD update.sh && /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf
|
||||
|
||||
Reference in New Issue
Block a user