infosecn1nja
/
HELK
mirror of https://github.com/infosecn1nja/HELK.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update helk_remove script 

this commit makes the following changes to the script:
- use docker-compose to remove containers, network and volumes
- made sure the script runs on different platforms
- use compose file to remove the helk installation
updates_os_and_scripts
tcastron 2020-01-15 14:49:52 +01:00 committed by GitHub
parent 0aab44da0d
commit bb1828d65d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
docker/helk_remove_containers.sh
View File

@ -6,6 +6,8 @@
# Author: Roberto Rodriguez (@Cyb3rWard0g)
# License: GPL-3.0
LABEL="[HELK-REMOVE-CONTAINERS]"
# *********** Check if user is root ***************
if [[ $EUID -ne 0 ]]; then
echo "[HELK-INSTALLATION-INFO] YOU MUST BE ROOT TO RUN THIS SCRIPT!!!"
@ -19,30 +21,42 @@ echoerror() {
echo -e "\nPlease see more information in the log file: $LOGFILE\n"
}
echo "[HELK-REMOVE-CONTAINERS] Stopping all running containers.."
docker stop $(docker ps --format '{{.Names}}' | grep -E '^helk\-') >> $LOGFILE 2>&1
ERROR=$?
if [ $ERROR -ne 0 ]; then
echoerror "Could not stop running containers.."
# *********** Get installation compose-file ***********
while true; do
read -e -p "$LABEL What config did you use for installation? " -i "helk-kibana-analysis-basic.yml" INSTALL_FILE
case "$INSTALL_FILE" in
helk-kibana-analysis-basic.yml|helk-kibana-analysis-trial.yml)
break;;
helk-kibana-analysis-alert-basic.yml|helk-kibana-analysis-alert-trial.yml)
break;;
helk-kibana-notebook-analysis-basic.yml|helk-kibana-notebook-analysis-trial.yml)
break;;
helk-kibana-notebook-analysis-alert-basic.yml|helk-kibana-notebook-analysis-alert-trial.yml)
break;;
*)
echo "The config file you entered does not exist..."
echo "Please provide a valid config file."
esac
done
# *********** Stop, remove containers, volumes and network ***********
echo "$LABEL Using docker-compose to remove installation..."
if [ "$(docker-compose version; echo $?)" != 0 ]; then
/usr/local/bin/docker-compose -f $INSTALL_FILE down --rmi all -v >> $LOGFILE 2>&1 # try to force command
else
docker-compose -f $INSTALL_FILE down --rmi all -v >> $LOGFILE 2>&1
fi
if [ $? -ne 0 ]; then
echoerror "Error while trying to use the docker-compose command.."
exit 1
fi
echo "[HELK-REMOVE-CONTAINERS] Removing all containers.."
docker rm $(docker ps -a --format '{{.Names}}' | grep -E '^helk\-') >> $LOGFILE 2>&1
ERROR=$?
if [ $ERROR -ne 0 ]; then
echoerror "Could not remove containers.."
exit 1
fi
echo "[HELK-REMOVE-CONTAINERS] Removing all images.."
docker rmi $(docker images -a | awk '{ print $1,$3 }' | grep 'cyb3rward0g\|helk' | awk '{print $2}') >> $LOGFILE 2>&1
docker rmi $(docker images -a | awk '{ print $1,$3 }' | grep cp-ksql | awk '{print $2}') >> $LOGFILE 2>&1
docker rmi $(docker images -a | awk '{ print $1,$3 }' | grep 'logstash\|kibana\|elasticsearch' | awk '{print $2}') >> $LOGFILE 2>&1
echo "$LABEL Removing all images..."
docker rmi $(docker images -a | awk '{ print $1,$3 }' | grep 'cyb3rward0g\|helk\|logstash\|kibana\|elasticsearch\|cp-ksql' | awk '{ print $2 }') >> $LOGFILE 2>&1
ERROR=$?
if [ $ERROR -ne 0 ]; then
echoerror "Could not remove images.."
exit 1
fi
echo "[HELK-REMOVE-CONTAINERS] You have successfully removed HELK containers.."
echo "$LABEL You have successfully removed HELK containers.."