awesome-inc / docker-selks Goto Github PK
View Code? Open in Web Editor NEWDocker based Suricata, Elasticsearch, Logstash, Kibana, Scirius aka SELKS.
Docker based Suricata, Elasticsearch, Logstash, Kibana, Scirius aka SELKS.
The data saved in suricata's eve.json or elasticsearch needs to be converted in such a way a framework can work with it.
Test multiple machine learning frameworks. Ideas right now:
In the future, we want to use them for low-code environments, so look for "easy-to-click" environments.
It would be nice if we had the network communications inside a graph. At first, a simple "A communicates with B" is sufficient.
It seems like ArangoDB is easy to use for importing our EVE JSON and seems like a good fit for playing around with graph databases. In the long term, we will probably want to use Neo4j.
Use any machine learning framework to produce a model that reproduces the correlations from #2.
As a first step, get to know the data, look for correlations in both time and space.
The current scirius docker image does not work correctly; Django exceptions are thrown regarding static files (leading to no css being loaded) as well as TypeErrors.
We could try to either use another docker image than stamus/scirius:latest
, if publicly available or build our own.
See #1. The current docker container with suricata does not have profiling enabled, which is needed for pcap analysis. Suricata is taken from the alpine linux edge repository. Build details of it can be found here:
https://pkgs.alpinelinux.org/package/edge/community/x86/suricata
What information in our EVE files is really relevant to us? Right now, we have a minimal logstash filter, only getting the geo ip of either source or destination. Exploration into relevant fields and what to do with them should be done.
There is an error with this repository's WhiteSource configuration file that needs to be fixed. As a precaution, scans will stop until it is resolved.
Errors:
With the current configuration, suricata does not utter alerts when profiling packets. However, it should.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.