Skip to content
Snippets Groups Projects
Commit cbdbff71 authored by Bozidar Proevski's avatar Bozidar Proevski
Browse files

Revised README

parent 288c4563
No related branches found
No related tags found
No related merge requests found
SOCTools
=========
SOCTools is a set of tools that can be used by a SOC for collecting and analyzing security data, incident handling and threat intelligence.
Installation
------------
Edit soctools-inventory and add the desired docker containers to be deployed. The playbook has been tested on CentOS 7.
Run the ansible playbook:
`ansible-playbook -i soctools-inventory soctools.yml -t start` to start the cluster.
`ansible-playbook -i soctools-inventory soctools.yml -t stop` to stop the cluster.
The NiFi interface should now be available on port 443 on the server.
This will install the following docker images:
* zookeeper:latest
* nginx:latest
* apache/nifi:latest
Building images
---------------
Images that are not offical Docker images can be built from scratch by running:
`ansible-playbook -i inventories/build/hosts.yml build_images.yml`
Edit the files under inventories/deploy/group_vars to specify that built images should be used. Currently only NiFi is built from scratch.
License
-------
BSD
Author Information
------------------
GEANT WP8
...@@ -6,21 +6,21 @@ SOCTools is a set of tools that can be used by a SOC for collecting and analyzin ...@@ -6,21 +6,21 @@ SOCTools is a set of tools that can be used by a SOC for collecting and analyzin
Installation Installation
------------ ------------
Edit inventories/deploy/hosts.yml and change "host1" to the fqdn or IP address of the server where the tools should be installed. The playbook has been tested on Debian Stretch and CentOS 7. Edit soctools-inventory and add the desired docker containers to be deployed. The playbook has been tested on CentOS 7.
The role soctools_server makes sure that docker is properly installed on the server. To prevent the playbook to make any changes to the server besides setting up docker networks and containers, this role can be removed.
Run the ansible playbook: Run the ansible playbook:
`ansible-playbook -i inventories/deploy/hosts.yml deploy.yml`
The NiFi interface should now be available on port 80 on the server. `ansible-playbook -i soctools-inventory soctools.yml -t start` to start the cluster.
`ansible-playbook -i soctools-inventory soctools.yml -t stop` to stop the cluster.
The NiFi interface should now be available on port 443 on the server.
This will install the following docker images: This will install the following docker images:
* zookeeper:latest * zookeeper:latest
* haproxy:latest * nginx:latest
* apache/nifi:latest * apache/nifi:latest
While the ansible playbook supports multiple servers, the current configuration of NiFi and haproxy only supports a single server.
Building images Building images
--------------- ---------------
...@@ -39,4 +39,4 @@ BSD ...@@ -39,4 +39,4 @@ BSD
Author Information Author Information
------------------ ------------------
GEANT WP8 GEANT WP8
\ No newline at end of file
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment