SOCTools

SOCTools is a set of tools that can be used by a SOC for collecting and analyzing security data, incident handling and threat intelligence.

Installation

Edit soctools-inventory and add the desired docker containers to be deployed. The playbook has been tested on CentOS 7.

Run the ansible playbook:

ansible-playbook -i soctools-inventory soctools.yml -t start to start the cluster. ansible-playbook -i soctools-inventory soctools.yml -t stop to stop the cluster.

The NiFi interface should now be available on port 443 on the server.

This will install the following docker images:

• zookeeper:latest
• nginx:latest
• apache/nifi:latest

Building images

Images that are not offical Docker images can be built from scratch by running:

ansible-playbook -i inventories/build/hosts.yml build_images.yml

Edit the files under inventories/deploy/group_vars to specify that built images should be used. Currently only NiFi is built from scratch.

License

BSD

Author Information

GEANT WP8