Skip to content

Latest commit

 

History

History
54 lines (44 loc) · 1.79 KB

README.md

File metadata and controls

54 lines (44 loc) · 1.79 KB
Raw

Event Monitor

  • Snort3 IPS/IDS
  • Django Rest Framework
  • Angular
  • PostgreSQL

Quick Start

Clone the Repository

Clone the repository to your local machine:

git clone --recurse-submodules https://github.com/LLkaia/event-monitor-snort3.git
cd event-monitor-snort3

Run the Docker Compose

docker compose up

Open user interface:

localhost:8080

Check openapi.yml for RESTAPI documentation

API is available on localhost:8000

Managing Daemons

To control daemons within the Snort container, open another bash window:

docker exec -it snort bash

Use the following commands to manage processes::

supervisorctl status
supervisorctl status process_name
supervisorctl restart process_name
supervisorctl stop process_name
supervisorctl start process_name

Notice, that we have 4 processes:

  • server - DRF and WSGI with RESTAPI functionalities
  • snort - Snort3 IDS which looks for traffic on eth0 interface and logs suspicious traffic into alert_json.txt
  • watcher - python script which looks for changes in alert_json.txt and adds them in a database
  • performance - python script which looks for changes in perf_monitor_base.json and adds them in a database
  • cron - runs cron with script for auto clearing table with events in database weekly (00:00 of Monday)

Testing with a .pcap File

  1. Download it: .pcap file
  2. Uncomment volumes in docker-compose.yml.
  3. Up docker compose.
  4. Open bash in snort container, stop snort process and run it:
snort -c /usr/local/etc/snort/snort.lua -r /root/snort/test.pcap --plugin-path=/usr/local/etc/so_rules/ -k none -l /var/log/snort --tweaks custom