mirror of https://github.com/infosecn1nja/HELK.git
testing docker compose configs
Roberto Rodriguez
parent
7a2e03032f
commit
0d7cf0f9ea
|
|
@ -1,48 +0,0 @@
|
|||
# Docker compose file for the HELK
|
||||
# HELK build version: 0.9 (BETA Script)
|
||||
# Author: Roberto Rodriguez @Cyb3rWard0g
|
||||
# ELK Version: 5x
|
||||
|
||||
version: '2'
|
||||
|
||||
services:
|
||||
|
||||
elasticsearch:
|
||||
build: elasticsearch/docker/
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
ES_JAVA_OPTS: "-Xmx256m -Xms256m"
|
||||
networks:
|
||||
- helk
|
||||
kibana:
|
||||
build: kibana/docker/
|
||||
ports:
|
||||
- "5601:5601"
|
||||
depends_on:
|
||||
- elasticsearch
|
||||
networks:
|
||||
- helk
|
||||
nginx:
|
||||
build: nginx/docker/
|
||||
ports:
|
||||
- "80:80"
|
||||
depends_on:
|
||||
- kibana
|
||||
networks:
|
||||
- helk
|
||||
logstash:
|
||||
build: logstash/docker/
|
||||
depends_on:
|
||||
- elasticsearch
|
||||
ports:
|
||||
- "5044:5044"
|
||||
environment:
|
||||
LS_JAVA_OPTS: "-Xmx256m -Xms256m"
|
||||
networks:
|
||||
- helk
|
||||
|
||||
networks:
|
||||
|
||||
helk:
|
||||
driver: bridge
|
||||
|
|
@ -10,7 +10,7 @@ services:
|
|||
elasticsearch:
|
||||
image: elasticsearch:latest
|
||||
volumes:
|
||||
- ./elasticsearch/docker/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
|
||||
- ./elasticsearch/docker/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
|
||||
environment:
|
||||
ES_JAVA_OPTS: "-Xmx256m -Xms256m"
|
||||
ports:
|
||||
|
|
@ -30,9 +30,8 @@ services:
|
|||
logstash:
|
||||
image: logstash:latest
|
||||
volumes:
|
||||
- ./logstash/docker/02-beats-input.conf:/usr/share/logstash/pipeline/02-beats-input.conf
|
||||
- ./logstash/docker/50-elasticsearch-output.conf:/usr/share/logstash/pipeline/50-elasticsearch-output.conf
|
||||
- ./logstash/docker/logstash.yml:/usr/share/logstash/config/logstash.yml
|
||||
- ./logstash/docker/pipeline:/usr/share/logstash/pipeline
|
||||
- ./logstash/docker/config/logstash.yml:/usr/share/logstash/config/logstash.yml
|
||||
depends_on:
|
||||
- elasticsearch
|
||||
ports:
|
||||
|
|
|
|||
|
|
@ -1,32 +0,0 @@
|
|||
# Dockerfile for HELK
|
||||
# Author: Roberto Rodriguez @Cyb3rWard0g
|
||||
|
||||
FROM openjdk:8-jre
|
||||
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
RUN apt-get update && \
|
||||
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add - && \
|
||||
apt-get install -y --no-install-recommends apt-transport-https && \
|
||||
echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-5.x.list && \
|
||||
apt-get install -y --no-install-recommends elasticsearch
|
||||
|
||||
RUN apt-get update && apt-get install -y kibana
|
||||
RUN apt-get install -y logstash
|
||||
RUN apt-get install -y nginx && \
|
||||
echo "helkadmin:`openssl passwd -apr1 hunting`" | tee -a /etc/nginx/htpasswd.users && \
|
||||
mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/backup_elasticsearch.yml && \
|
||||
mv /etc/kibana/kibana.yml /etc/kibana/backup_kibana.yml && \
|
||||
mv /etc/nginx/sites-available/default /etc/nginx/sites-available/backup_default
|
||||
|
||||
ADD ./elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml
|
||||
ADD ./kibana/kibana.yml /etc/kibana/kibana.yml
|
||||
ADD ./nginx/default /etc/nginx/sites-available/default
|
||||
ADD ./logstash/02-beats-input.conf /etc/logstash/conf.d/02-beats-input.conf
|
||||
ADD ./logstash50-elasticsearch-output.conf /etc/logstash/conf.d/50-elasticsearch-output.conf
|
||||
ADD start_service.sh /start.sh
|
||||
|
||||
CMD ["./start.sh"]
|
||||
|
||||
EXPOSE 80
|
||||
|
||||
|
|
@ -1,88 +0,0 @@
|
|||
# ======================== Elasticsearch Configuration =========================
|
||||
#
|
||||
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
|
||||
# Before you set out to tweak and tune the configuration, make sure you
|
||||
# understand what are you trying to accomplish and the consequences.
|
||||
#
|
||||
# The primary way of configuring a node is via this file. This template lists
|
||||
# the most important settings you may want to configure for a production cluster.
|
||||
#
|
||||
# Please consult the documentation for further information on configuration options:
|
||||
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
|
||||
#
|
||||
# ---------------------------------- Cluster -----------------------------------
|
||||
#
|
||||
# Use a descriptive name for your cluster:
|
||||
#
|
||||
#cluster.name: my-application
|
||||
#
|
||||
# ------------------------------------ Node ------------------------------------
|
||||
#
|
||||
# Use a descriptive name for the node:
|
||||
#
|
||||
#node.name: node-1
|
||||
#
|
||||
# Add custom attributes to the node:
|
||||
#
|
||||
#node.attr.rack: r1
|
||||
#
|
||||
# ----------------------------------- Paths ------------------------------------
|
||||
#
|
||||
# Path to directory where to store the data (separate multiple locations by comma):
|
||||
#
|
||||
#path.data: /path/to/data
|
||||
#
|
||||
# Path to log files:
|
||||
#
|
||||
#path.logs: /path/to/logs
|
||||
#
|
||||
# ----------------------------------- Memory -----------------------------------
|
||||
#
|
||||
# Lock the memory on startup:
|
||||
#
|
||||
#bootstrap.memory_lock: true
|
||||
#
|
||||
# Make sure that the heap size is set to about half the memory available
|
||||
# on the system and that the owner of the process is allowed to use this
|
||||
# limit.
|
||||
#
|
||||
# Elasticsearch performs poorly when the system is swapping the memory.
|
||||
#
|
||||
# ---------------------------------- Network -----------------------------------
|
||||
#
|
||||
# Set the bind address to a specific IP (IPv4 or IPv6):
|
||||
#
|
||||
network.host: localhost
|
||||
#
|
||||
# Set a custom port for HTTP:
|
||||
#
|
||||
#http.port: 9200
|
||||
#
|
||||
# For more information, consult the network module documentation.
|
||||
#
|
||||
# --------------------------------- Discovery ----------------------------------
|
||||
#
|
||||
# Pass an initial list of hosts to perform discovery when new node is started:
|
||||
# The default list of hosts is ["127.0.0.1", "[::1]"]
|
||||
#
|
||||
#discovery.zen.ping.unicast.hosts: ["host1", "host2"]
|
||||
#
|
||||
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
|
||||
#
|
||||
#discovery.zen.minimum_master_nodes: 3
|
||||
#
|
||||
# For more information, consult the zen discovery module documentation.
|
||||
#
|
||||
# ---------------------------------- Gateway -----------------------------------
|
||||
#
|
||||
# Block initial recovery after a full cluster restart until N nodes are started:
|
||||
#
|
||||
#gateway.recover_after_nodes: 3
|
||||
#
|
||||
# For more information, consult the gateway module documentation.
|
||||
#
|
||||
# ---------------------------------- Various -----------------------------------
|
||||
#
|
||||
# Require explicit names when deleting indices:
|
||||
#
|
||||
#action.destructive_requires_name: true
|
||||
|
|
@ -1,99 +0,0 @@
|
|||
# Kibana is served by a back end server. This setting specifies the port to use.
|
||||
#server.port: 5601
|
||||
|
||||
# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
|
||||
# The default is 'localhost', which usually means remote machines will not be able to connect.
|
||||
# To allow connections from remote users, set this parameter to a non-loopback address.
|
||||
server.host: "localhost"
|
||||
|
||||
# Enables you to specify a path to mount Kibana at if you are running behind a proxy. This only affects
|
||||
# the URLs generated by Kibana, your proxy is expected to remove the basePath value before forwarding requests
|
||||
# to Kibana. This setting cannot end in a slash.
|
||||
#server.basePath: ""
|
||||
|
||||
# The maximum payload size in bytes for incoming server requests.
|
||||
#server.maxPayloadBytes: 1048576
|
||||
|
||||
# The Kibana server's name. This is used for display purposes.
|
||||
#server.name: "your-hostname"
|
||||
|
||||
# The URL of the Elasticsearch instance to use for all your queries.
|
||||
#elasticsearch.url: "http://localhost:9200"
|
||||
|
||||
# When this setting's value is true Kibana uses the hostname specified in the server.host
|
||||
# setting. When the value of this setting is false, Kibana uses the hostname of the host
|
||||
# that connects to this Kibana instance.
|
||||
#elasticsearch.preserveHost: true
|
||||
|
||||
# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
|
||||
# dashboards. Kibana creates a new index if the index doesn't already exist.
|
||||
#kibana.index: ".kibana"
|
||||
|
||||
# The default application to load.
|
||||
#kibana.defaultAppId: "discover"
|
||||
|
||||
# If your Elasticsearch is protected with basic authentication, these settings provide
|
||||
# the username and password that the Kibana server uses to perform maintenance on the Kibana
|
||||
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
|
||||
# is proxied through the Kibana server.
|
||||
#elasticsearch.username: "user"
|
||||
#elasticsearch.password: "pass"
|
||||
|
||||
# Paths to the PEM-format SSL certificate and SSL key files, respectively. These
|
||||
# files enable SSL for outgoing requests from the Kibana server to the browser.
|
||||
#server.ssl.cert: /path/to/your/server.crt
|
||||
#server.ssl.key: /path/to/your/server.key
|
||||
|
||||
# Optional settings that provide the paths to the PEM-format SSL certificate and key files.
|
||||
# These files validate that your Elasticsearch backend uses the same key files.
|
||||
#elasticsearch.ssl.cert: /path/to/your/client.crt
|
||||
#elasticsearch.ssl.key: /path/to/your/client.key
|
||||
|
||||
# Optional setting that enables you to specify a path to the PEM file for the certificate
|
||||
# authority for your Elasticsearch instance.
|
||||
#elasticsearch.ssl.ca: /path/to/your/CA.pem
|
||||
|
||||
# To disregard the validity of SSL certificates, change this setting's value to false.
|
||||
#elasticsearch.ssl.verify: true
|
||||
|
||||
# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
|
||||
# the elasticsearch.requestTimeout setting.
|
||||
#elasticsearch.pingTimeout: 1500
|
||||
|
||||
# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
|
||||
# must be a positive integer.
|
||||
#elasticsearch.requestTimeout: 30000
|
||||
|
||||
# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
|
||||
# headers, set this value to [] (an empty list).
|
||||
#elasticsearch.requestHeadersWhitelist: [ authorization ]
|
||||
|
||||
# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
|
||||
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
|
||||
#elasticsearch.customHeaders: {}
|
||||
|
||||
# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
|
||||
#elasticsearch.shardTimeout: 0
|
||||
|
||||
# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.
|
||||
#elasticsearch.startupTimeout: 5000
|
||||
|
||||
# Specifies the path where Kibana creates the process ID file.
|
||||
#pid.file: /var/run/kibana.pid
|
||||
|
||||
# Enables you specify a file where Kibana stores log output.
|
||||
#logging.dest: stdout
|
||||
|
||||
# Set the value of this setting to true to suppress all logging output.
|
||||
#logging.silent: false
|
||||
|
||||
# Set the value of this setting to true to suppress all logging output other than error messages.
|
||||
#logging.quiet: false
|
||||
|
||||
# Set the value of this setting to true to log all events, including system usage information
|
||||
# and all requests.
|
||||
#logging.verbose: false
|
||||
|
||||
# Set the interval in milliseconds to sample system and process performance
|
||||
# metrics. Minimum is 100ms. Defaults to 5000.
|
||||
#ops.interval: 5000
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
input {
|
||||
beats {
|
||||
port => 5044
|
||||
add_field => { "[@metadata][source]" => "winlogbeat"}
|
||||
ssl => false
|
||||
}
|
||||
}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
server {
|
||||
listen 80;
|
||||
|
||||
server_name 127.0.0.1;
|
||||
|
||||
auth_basic "Restricted Access";
|
||||
auth_basic_user_file /etc/nginx/htpasswd.users;
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:5601;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
proxy_set_header Host $host;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
# HELK Start HELK Services (Elasticsearch, Logstash, Kibana & Nginx)
|
||||
# HELK build version: 0.9 (BETA Script)
|
||||
# Author: Roberto Rodriguez @Cyb3rWard0g
|
||||
|
||||
# Description: This script starts elasticsearch, Logstash, Kibana and Nginx after the creationg of the image
|
||||
|
||||
systemctl start elasticsearch
|
||||
systemctl restart kibana
|
||||
systemctl restart logstash
|
||||
systemctl restart nginx
|
||||
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
# Dockerfile for Elasticsearch
|
||||
# Author: Roberto Rodriguez @Cyb3rWard0g
|
||||
|
||||
FROM openjdk:8-jre
|
||||
|
||||
RUN apt-get update && \
|
||||
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add - && \
|
||||
apt-get install -y --no-install-recommends apt-transport-https && \
|
||||
echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-5.x.list && \
|
||||
apt-get install -y --no-install-recommends elasticsearch && \
|
||||
mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/backup_elasticsearch.yml
|
||||
|
||||
ADD elasticsearch.yml /etc/elasticsearch/elasticsearch.yml
|
||||
|
||||
EXPOSE 9200
|
||||
|
||||
|
|
@ -14,7 +14,8 @@
|
|||
#
|
||||
# Use a descriptive name for your cluster:
|
||||
#
|
||||
#cluster.name: my-application
|
||||
#from: https://github.com/elastic/elasticsearch-docker/blob/master/build/elasticsearch/elasticsearch.yml
|
||||
cluster.name: "docker-cluster"
|
||||
#
|
||||
# ------------------------------------ Node ------------------------------------
|
||||
#
|
||||
|
|
@ -69,7 +70,7 @@ network.host: 0.0.0.0
|
|||
#
|
||||
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
|
||||
#
|
||||
#discovery.zen.minimum_master_nodes: 3
|
||||
discovery.zen.minimum_master_nodes: 1
|
||||
#
|
||||
# For more information, consult the zen discovery module documentation.
|
||||
#
|
||||
|
|
@ -87,3 +88,14 @@ network.host: 0.0.0.0
|
|||
#
|
||||
#action.destructive_requires_name: true
|
||||
discovery.type: single-node
|
||||
|
||||
## from; https://github.com/deviantony/docker-elk/blob/master/elasticsearch/config/elasticsearch.yml
|
||||
## Disable X-Pack
|
||||
## see https://www.elastic.co/guide/en/x-pack/current/xpack-settings.html
|
||||
## https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html#xpack-enabling
|
||||
|
||||
xpack.security.enabled: false
|
||||
xpack.monitoring.enabled: false
|
||||
xpack.ml.enabled: false
|
||||
xpack.graph.enabled: false
|
||||
xpack.watcher.enabled: false
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
# Dockerfile for Kibana
|
||||
# Author: Roberto Rodriguez @Cyb3rWard0g
|
||||
|
||||
FROM ubuntu:16.04
|
||||
RUN apt-get update && apt-get install -y wget && \
|
||||
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add - && \
|
||||
apt-get install -y --no-install-recommends apt-transport-https && \
|
||||
echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-5.x.list && \
|
||||
apt-get update && apt-get install -y --no-install-recommends kibana && \
|
||||
mv /etc/kibana/kibana.yml /etc/kibana/backup_kibana.yml
|
||||
|
||||
ADD kibana.yml /etc/kibana/kibana.yml
|
||||
|
||||
EXPOSE 5601
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
input {
|
||||
beats {
|
||||
port => 5044
|
||||
add_field => { "[@metadata][source]" => "winlogbeat"}
|
||||
ssl => false
|
||||
}
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
output {
|
||||
if [@metadata][source] == "winlogbeat" {
|
||||
elasticsearch {
|
||||
hosts => ["localhost:9200"]
|
||||
sniffing => true
|
||||
manage_template => false
|
||||
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
|
||||
document_type => "%{[@metadata][type]}"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
# Dockerfile for Logstash
|
||||
# Author: Roberto Rodriguez @Cyb3rWard0g
|
||||
|
||||
FROM openjdk:8-jre
|
||||
|
||||
RUN apt-get update && \
|
||||
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add - && \
|
||||
apt-get install -y --no-install-recommends apt-transport-https && \
|
||||
echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-5.x.list && \
|
||||
apt-get update && apt-get install -y --no-install-recommends logstash
|
||||
|
||||
ADD 02-beats-input.conf /etc/logstash/conf.d/02-beats-input.conf
|
||||
ADD 50-elasticsearch-output.conf /etc/logstash/conf.d/50-elasticsearch-output.conf
|
||||
|
||||
EXPOSE 5044
|
||||
|
||||
|
|
@ -1,3 +1,11 @@
|
|||
input {
|
||||
beats {
|
||||
port => 5044
|
||||
add_field => { "[@metadata][source]" => "winlogbeat"}
|
||||
ssl => false
|
||||
}
|
||||
}
|
||||
|
||||
output {
|
||||
if [@metadata][source] == "winlogbeat" {
|
||||
elasticsearch {
|
||||
Loading…
Reference in New Issue