tweaking

ELK 7.6.0 is not ready for production, however it works if APM is enabled (disabled in config, so image wont build as precaution)
Remove SISSDEN from ewsposter, suricata
Bump suricata to 5.0.1
Alpine now support suricata incl. enabled JA3 support, move back to Alpine install

docker/suricata/Dockerfile

@@ -1,90 +1,17 @@
-FROM alpine
+FROM alpine:latest
 #
 # Include dist
 ADD dist/ /root/dist/
 #
 # Install packages
-#RUN sed -i 's/dl-cdn/dl-2/g' /etc/apk/repositories && \
-RUN    apk -U add \
+RUN apk -U --no-cache add \
                  ca-certificates \
                  curl \
                  file \
-                 geoip \
-                 hiredis \
-                 jansson \
-                 libcap-ng \
-                 libmagic \
-		 libmaxminddb \
-                 libnet \
-                 libnetfilter_queue \
-                 libnfnetlink \
-                 libpcap \
-                 luajit \
-                 lz4-libs \
-                 musl \
-                 nspr \
-                 nss \
-                 pcre \
-                 yaml \
-                 wget \
-                 automake \
-                 autoconf \
-                 build-base \
-                 cargo \
-                 file-dev \
-                 geoip-dev \
-                 hiredis-dev \
-                 jansson-dev \
-                 libtool \
-                 libcap-ng-dev \
-                 luajit-dev \
-		 libmaxminddb-dev \
-                 libpcap-dev \
-                 libnet-dev \
-                 libnetfilter_queue-dev \
-                 libnfnetlink-dev \
-                 lz4-dev \
-                 nss-dev \
-                 nspr-dev \
-                 pcre-dev \
-                 python3 \
-                 rust \
-                 yaml-dev && \
-#
-# We need latest libhtp[-dev] which is only available in community
-    apk -U add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community \
-               libhtp \
-               libhtp-dev && \
-#
-# Upgrade pip, install suricata-update to meet deps, however we will not be using it 
-# to reduce image (no python needed) and use the update script.
-    pip3 install --no-cache-dir --upgrade pip && \
-    pip3 install --no-cache-dir suricata-update && \
-#
-# Get and build Suricata
-    mkdir -p /opt/builder/ && \
-    wget https://www.openinfosecfoundation.org/download/suricata-5.0.0.tar.gz && \
-    tar xvfz suricata-5.0.0.tar.gz --strip-components=1 -C /opt/builder/ && \
-    rm suricata-5.0.0.tar.gz && \
-    cd /opt/builder && \
-    ./configure \
-	--prefix=/usr \
-	--sysconfdir=/etc \
-	--mandir=/usr/share/man \
-	--localstatedir=/var \
-	--enable-non-bundled-htp \
-	--enable-nfqueue \
-        --enable-rust \
-	--disable-gccmarch-native \
-	--enable-hiredis \
-	--enable-geoip \
-	--enable-gccprotect \
-	--enable-pie \
-	--enable-luajit && \
-    make && \
-    make check && \
-    make install && \
-    make install-full && \
+                 libcap \
+                 wget && \
+    apk -U add --repository http://dl-cdn.alpinelinux.org/alpine/edge/community \
+                 suricata && \
 #
 # Setup user, groups and configs
     addgroup -g 2000 suri && \
@@ -92,8 +19,6 @@ RUN    apk -U add \
     chmod 644 /etc/suricata/*.config && \
     cp /root/dist/suricata.yaml /etc/suricata/suricata.yaml && \
     cp /root/dist/*.bpf /etc/suricata/ && \
-    mkdir -p /etc/suricata/rules && \
-    cp /opt/builder/rules/* /etc/suricata/rules/ && \
 #
 # Download the latest EmergingThreats ruleset, replace rulebase and enable all rules
     cp /root/dist/update.sh /usr/bin/ && \
@@ -101,32 +26,6 @@ RUN    apk -U add \
     update.sh OPEN && \
 #
 # Clean up
-    apk del --purge \
-                 automake \
-                 autoconf \
-                 build-base \
-                 cargo \
-                 file-dev \
-                 geoip-dev \
-                 hiredis-dev \
-                 jansson-dev \
-                 libtool \
-                 libhtp-dev \
-                 libcap-ng-dev \
-                 luajit-dev \
-                 libpcap-dev \
-		 libmaxminddb-dev \
-                 libnet-dev \
-                 libnetfilter_queue-dev \
-                 libnfnetlink-dev \
-                 lz4-dev \
-                 nss-dev \
-                 nspr-dev \
-                 pcre-dev \
-		 python3 \
-                 rust \
-                 yaml-dev && \
-    rm -rf /opt/builder && \
     rm -rf /root/* && \
     rm -rf /tmp/* && \
     rm -rf /var/cache/apk/*