infosecn1nja
/
HELK
mirror of https://github.com/infosecn1nja/HELK.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #418 from troplolBE/master 

Updated scripts + corrected fault
updates_os_and_scripts
Nate Guagenti 2020-01-25 14:50:38 -05:00 committed by GitHub
parent aae4ae47f5 0d23090f2e
commit 5001102358
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
docker/helk_install.sh
View File

@ -251,8 +251,6 @@ install_docker() {
chmod +x get-docker.sh >>$LOGFILE 2>&1 chmod +x get-docker.sh >>$LOGFILE 2>&1
./get-docker.sh >>$LOGFILE 2>&1 ./get-docker.sh >>$LOGFILE 2>&1
if [ "$LSB_DIST" == "centos" ]; then if [ "$LSB_DIST" == "centos" ]; then
# Link docker-compose so can be used with sudo
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
systemctl enable docker.service systemctl enable docker.service
systemctl start docker.service systemctl start docker.service
fi fi
@ -282,13 +280,9 @@ install_docker_compose() {
COMPOSE_VERSION=$(curl -s https://api.github.com/repos/docker/compose/releases/latest | grep 'tag_name' | cut -d\" -f4) COMPOSE_VERSION=$(curl -s https://api.github.com/repos/docker/compose/releases/latest | grep 'tag_name' | cut -d\" -f4)
curl -L https://github.com/docker/compose/releases/download/"$COMPOSE_VERSION"/docker-compose-"$(uname -s)"-"$(uname -m)" -o /usr/local/bin/docker-compose >>$LOGFILE 2>&1 curl -L https://github.com/docker/compose/releases/download/"$COMPOSE_VERSION"/docker-compose-"$(uname -s)"-"$(uname -m)" -o /usr/local/bin/docker-compose >>$LOGFILE 2>&1
chmod +x /usr/local/bin/docker-compose >>$LOGFILE 2>&1 chmod +x /usr/local/bin/docker-compose >>$LOGFILE 2>&1
if [[ "$LSB_DIST" == "centos" ]]; then if [ "$LSB_DIST" == "centos" ]; then
if ! [[ $PATH == *"/usr/local/bin"* ]]; then # small check not to have it 2 times # Link docker-compose so can be used with sudo
export PATH=$PATH:/usr/local/bin ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
else
echo "[INFO] /usr/local/bin is already in PATH environment variable !"
fi
docker-compose version
fi fi
ERROR=$? ERROR=$?
if [ $ERROR -ne 0 ]; then if [ $ERROR -ne 0 ]; then

4
docker/helk_remove_containers.sh
View File

@ -115,7 +115,9 @@ fi
echo -e "${CYAN}${HELK_INFO_TAG}${STD} Removing all images..." echo -e "${CYAN}${HELK_INFO_TAG}${STD} Removing all images..."
# HELK Images # HELK Images
#docker rmi "$(docker images -a | awk '{ print $1,$3 }' | grep 'otrf\|cyb3rward0g\|helk' | awk '{ print $2 }')" >> $LOGFILE 2>&1 #docker rmi "$(docker images -a | awk '{ print $1,$3 }' | grep 'otrf\|cyb3rward0g\|helk' | awk '{ print $2 }')" >> $LOGFILE 2>&1
docker rmi "$(docker images -a | awk '{ print $1,$3 }' | grep 'otrf\|cyb3rward0g\|helk\|logstash\|kibana\|elasticsearch\|cp-ksql' | awk '{ print $2 }')" >> $LOGFILE 2>&1 if [ "$(docker images -a | grep 'otrf\|cyb3rward0g\|helk\|logstash\|kibana\|elasticsearch\|cp-ksql' > /dev/null; echo $?)" == 0 ]; then
docker rmi "$(docker images -a | awk '{ print $1,$3 }' | grep 'otrf\|cyb3rward0g\|helk\|logstash\|kibana\|elasticsearch\|cp-ksql' | awk '{ print $2 }')" >> $LOGFILE 2>&1
fi
#TODO: these get removed in docker compose remove, but at some point may be good to implement this.. either: 1) create custom HELK ELK and KSQL images and this won't be an issue/thing or.. 2) figure out how to give option even though using compose.. However, this is really low hanging fruit, not worried about it for now 2019-01-25 #TODO: these get removed in docker compose remove, but at some point may be good to implement this.. either: 1) create custom HELK ELK and KSQL images and this won't be an issue/thing or.. 2) figure out how to give option even though using compose.. However, this is really low hanging fruit, not worried about it for now 2019-01-25
# ELastic/Confluent Images, so give user option to remove them...as the user may be using those for other things on their system # ELastic/Confluent Images, so give user option to remove them...as the user may be using those for other things on their system
#echo -e "${CYAN}${HELK_INFO_TAG}${STD} You may be using the official, upstream, Elastic (ELK) and Confluent(KSQL) docker images for other components on your machine..." #echo -e "${CYAN}${HELK_INFO_TAG}${STD} You may be using the official, upstream, Elastic (ELK) and Confluent(KSQL) docker images for other components on your machine..."