docker-snort

KO | EN

gitlite — search

#javascript #llm #golang #rust #deep-learning #java #windows #awesome #cli #kubernetes #awesome-list #pytorch #ios #openai

(★ 22)

Snort + Pulledpork + Websnort in Docker!

docker-snort Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# docker-snort
 
Includes Snort + PulledPork + WebSnort (exposes port 8080)

The project is to assit in initial stage triage of a potentially malicious pcap. It runs all the rules it can against a pcap attempting to highlight sessions of interest.

*Processing of the PCAP does take a while due to the number of rules being utilised!*

Thanks to:
- Cisco / Sourcefire / Snort team for Snort
- PulledPork project: https://github.com/shirkdog/pulledpork
- WebSnort project for the Snort frontend: https://github.com/shendo/websnort

## To use:

*NB* Oink code required if not using customintel.sh script. Can be obtained from: https://www.snort.org/oinkcodes

### 1. Build with either (2nd option doesn't require git clone);
 
    docker build -t snortweb . --build-arg PPORK_OINKCODE=<your-oink-code-from-snort.org>
    docker build -t snortweb . --build-arg PPORK_OINKCODE=<your-oink-code-from-snort.org> https://github.com/geekscrapy/docker-snort.git
    
### 2. Run with:

docker run -P8080:8080 snortweb
    
Once running, visit http://localhost:8080/

### 3. Update the rules:

docker exec snortweb bash update-rules.sh <oink_code>

### 4. (optional) Custom intel rules (customintel.sh):

This custom script enables rules to be pulled from any source when update-rules.sh is run.
Create a scipt named customintel.sh in the current directory before building, or, alternativley the script can be created/modified once the container has been created
    
Requirements:
- The customintel.sh script must output rules to stdout - output is inserted into ```/etc/snort/rules/customintel.rules``` which is loaded by snort

### Additional whitelists/blacklists: 
To update local.rules, white_list.rules or black_list.rules, modify the file and build the image.

### Options
The following variables can be added to customise the build (values shown are the defaults):
 
| Option                   | Build argument                                                 |
|--------------------------|----------------------------------------------------------------|
| PulledPork Oink code:    | ```PPORK_OINKCODE=<your-oink-code-from-snort.org>```           |
| Snort version:           | ```SNORT_VER=2.9.11.1```                                       |
| DAQ version:             | ```DAQ_VER=daq-2.0.6```                                        |
| PulledPork version:      | ```PPORK_VERSION=0.7.3```                                      |
| Snort HOME_NET variable: | ```SNORT_HOME_NET="192.168.0.0/16,172.16.0.0/12,10.0.0.0/8"``` |

docker-snort

docker-snort Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

docker-snort

docker-snort Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README