Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-01 12:32:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

bump ewsposter to 1.2.0, elk stack to 7.13.2

Browse source
This commit is contained in:
t3chn0m4g3 2021-06-28 16:30:40 +00:00
parent b6be931641
commit 4cb84166c5
6 changed files with 19 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
docker/elk/elasticsearch/Dockerfile
View file

@ -1,8 +1,9 @@
FROM alpine:3.13
FROM alpine:3.14
#
# VARS
ENV ES_VER=7.13.1 \
ENV ES_VER=7.13.2 \
ES_JAVA_HOME=/usr/lib/jvm/java-16-openjdk
# Include dist
ADD dist/ /root/dist/
#
@ -13,7 +14,6 @@ RUN apk -U --no-cache add \
bash \
curl \
nss && \
# openjdk16-jre && \
apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing openjdk16-jre && \
#
# Get and install packages
@ -21,6 +21,10 @@ RUN apk -U --no-cache add \
mkdir -p /usr/share/elasticsearch/ && \
aria2c -s 16 -x 16 https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-$ES_VER-linux-x86_64.tar.gz && \
tar xvfz elasticsearch-$ES_VER-linux-x86_64.tar.gz --strip-components=1 -C /usr/share/elasticsearch/ && \
rm -rf /usr/share/elasticsearch/jdk && \
rm -rf /usr/share/elasticsearch/modules/x-pack-ml && \
# For some reason Alpine 3.14 does not report the -x flag correctly and thus elasticsearch does not find java
sed -i 's/! -x/! -e/g' /usr/share/elasticsearch/bin/elasticsearch-env && \
#
# Add and move files
cd /root/dist/ && \
@ -31,8 +35,6 @@ RUN apk -U --no-cache add \
addgroup -g 2000 elasticsearch && \
adduser -S -H -s /bin/ash -u 2000 -D -g 2000 elasticsearch && \
chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/ && \
rm -rf /usr/share/elasticsearch/jdk && \
rm -rf /usr/share/elasticsearch/modules/x-pack-ml && \
#
# Clean up
apk del --purge aria2 && \

5
docker/elk/head/Dockerfile
View file

@ -1,11 +1,12 @@
FROM alpine:3.13
FROM alpine:3.14
#
# Setup env and apt
RUN apk -U add \
curl \
git \
nodejs \
nodejs-npm && \
#nodejs-npm && \
npm && \
#
# Get and install packages
mkdir -p /usr/src/app/ && \

2
docker/elk/kibana/Dockerfile
View file

@ -1,7 +1,7 @@
FROM node:14.16.1-alpine
#
# VARS
ENV KB_VER=7.13.1
ENV KB_VER=7.13.2
#
# Include dist
ADD dist/ /root/dist/

7
docker/elk/logstash/Dockerfile
View file

@ -1,7 +1,7 @@
FROM alpine:3.13
FROM alpine:3.14
#
# VARS
ENV LS_VER=7.13.1
ENV LS_VER=7.13.2
# Include dist
ADD dist/ /root/dist/
#
@ -15,7 +15,6 @@ RUN apk -U --no-cache add \
libc6-compat \
libzmq \
nss && \
# openjdk16-jre && \
apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing openjdk16-jre && \
#
# Get and install packages
@ -29,6 +28,8 @@ RUN apk -U --no-cache add \
aria2c -s 16 -x 16 https://artifacts.elastic.co/downloads/logstash/logstash-$LS_VER-linux-x86_64.tar.gz && \
tar xvfz logstash-$LS_VER-linux-x86_64.tar.gz --strip-components=1 -C /usr/share/logstash/ && \
rm -rf /usr/share/logstash/jdk && \
# For some reason Alpine 3.14 does not report the -x flag correctly and thus elasticsearch does not find java
sed -i 's/! -x/! -e/g' /usr/share/logstash/bin/logstash.lib.sh && \
/usr/share/logstash/bin/logstash-plugin install logstash-filter-translate && \
/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog && \
#

4
docker/elk/logstash/dist/logstash.conf vendored
View file

@ -512,12 +512,12 @@ if "_grokparsefailure" in [tags] { drop {} }
geoip {
cache_size => 10000
source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.1.2-java/vendor/GeoLite2-City.mmdb"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.1.3-java/vendor/GeoLite2-City.mmdb"
}
geoip {
cache_size => 10000
source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.1.2-java/vendor/GeoLite2-ASN.mmdb"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.1.3-java/vendor/GeoLite2-ASN.mmdb"
}
translate {
refresh_interval => 86400

4
docker/ews/Dockerfile
View file

@ -1,4 +1,4 @@
FROM alpine:3.13
FROM alpine:3.14
#
# Include dist
ADD dist/ /root/dist/
@ -25,7 +25,7 @@ RUN apk -U --no-cache add \
# Setup ewsposter
git clone https://github.com/telekom-security/ewsposter /opt/ewsposter && \
cd /opt/ewsposter && \
git checkout b0633af849687128171be1c7be7a43f3709a93ed && \
git checkout 4783c4bf9a5ea78da7203c5ccdc5711d811a708d && \
mkdir -p /opt/ewsposter/spool /opt/ewsposter/log && \
#
# Setup user and groups