telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of https://github.com/telekom-security/tpotce

Browse Source
This commit is contained in:
t3chn0m4g3
2021-12-21 11:37:18 +00:00
parent daf41b4b71 0bca794fe7
commit ef1a1fa057
14 changed files with 390 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docker/elk/elasticsearch/Dockerfile
View File

@ -1,7 +1,7 @@
FROM alpine:3.14
#
# VARS
ENV ES_VER=7.15.1 \
ENV ES_VER=7.16.2 \
ES_JAVA_HOME=/usr/lib/jvm/java-16-openjdk
# Include dist
@ -14,7 +14,7 @@ RUN apk -U --no-cache add \
bash \
curl \
nss && \
apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing openjdk16-jre && \
apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/community openjdk16-jre && \
#
# Get and install packages
cd /root/dist/ && \

4
docker/elk/kibana/Dockerfile
View File

@ -1,7 +1,7 @@
FROM node:14.17.6-alpine3.14
FROM node:16.13.0-alpine3.14
#
# VARS
ENV KB_VER=7.15.1
ENV KB_VER=7.16.2
#
# Include dist
ADD dist/ /root/dist/

25
docker/elk/logstash/dist/logstash.conf vendored
View File

@ -147,6 +147,13 @@ input {
type => "Ipphoney"
}
# Log4pot
file {
path => ["/data/log4pot/log/log4pot.log"]
codec => json
type => "Log4pot"
}
# Mailoney
file {
path => ["/data/mailoney/log/commands.log"]
@ -564,6 +571,20 @@ filter {
}
}
# Log4pot
if [type] == "Log4pot" {
date {
match => [ "timestamp", "ISO8601" ]
}
mutate {
rename => {
"server_port" => "dest_port"
"port" => "src_port"
"client" => "src_ip"
}
}
}
# Mailoney
if [type] == "Mailoney" {
date {
@ -649,12 +670,12 @@ if "_jsonparsefailure" in [tags] { drop {} }
geoip {
cache_size => 10000
source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.3-java/vendor/GeoLite2-City.mmdb"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-City.mmdb"
}
geoip {
cache_size => 10000
source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.3-java/vendor/GeoLite2-ASN.mmdb"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-ASN.mmdb"
}
translate {
refresh_interval => 86400