mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-04-29 03:38:51 +00:00
f11ad6b523
ELK 7.6.0 is not ready for production, however it works if APM is enabled (disabled in config, so image wont build as precaution) Remove SISSDEN from ewsposter, suricata Bump suricata to 5.0.1 Alpine now support suricata incl. enabled JA3 support, move back to Alpine install
35 lines
1.1 KiB
Docker
35 lines
1.1 KiB
Docker
FROM alpine:latest
|
|
#
|
|
# Include dist
|
|
ADD dist/ /root/dist/
|
|
#
|
|
# Install packages
|
|
RUN apk -U --no-cache add \
|
|
ca-certificates \
|
|
curl \
|
|
file \
|
|
libcap \
|
|
wget && \
|
|
apk -U add --repository http://dl-cdn.alpinelinux.org/alpine/edge/community \
|
|
suricata && \
|
|
#
|
|
# Setup user, groups and configs
|
|
addgroup -g 2000 suri && \
|
|
adduser -S -H -u 2000 -D -g 2000 suri && \
|
|
chmod 644 /etc/suricata/*.config && \
|
|
cp /root/dist/suricata.yaml /etc/suricata/suricata.yaml && \
|
|
cp /root/dist/*.bpf /etc/suricata/ && \
|
|
#
|
|
# Download the latest EmergingThreats ruleset, replace rulebase and enable all rules
|
|
cp /root/dist/update.sh /usr/bin/ && \
|
|
chmod 755 /usr/bin/update.sh && \
|
|
update.sh OPEN && \
|
|
#
|
|
# Clean up
|
|
rm -rf /root/* && \
|
|
rm -rf /tmp/* && \
|
|
rm -rf /var/cache/apk/*
|
|
#
|
|
# Start suricata
|
|
STOPSIGNAL SIGINT
|
|
CMD SURICATA_CAPTURE_FILTER=$(update.sh $OINKCODE) && exec suricata -v -F $SURICATA_CAPTURE_FILTER -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:])
|