Merge branch 'logging-v2' into v2.0

.gitignore

@@ -1,3 +1,3 @@
-Logging/splunk/quick-fleet
-Logging/splunk/zeek/zeek-logs/*
+Logging/Config/splunk/zeek/zeek-logs/*
 *.log
+*.code-workspace

Logging/splunk/.env → Logging/.env

@@ -2,9 +2,5 @@
 # This allows us to update the docker-compose files without breaking containers like splunk
 
 PORTAINER_VER=latest
-SPLUNK_VER=8.2.0
 JUPYTER_VER=latest
-HIVE_VER=latest
-CORTEX_VER=latest
-TRAEFIK_VER=v2.4.8
-ELASTIC_VER=7.12.1
+TRAEFIK_VER=v2.8.3

Logging/Config/elasticstack/.env

@@ -0,0 +1,29 @@
+# Password for the 'elastic' user (at least 6 characters)
+ELASTIC_PASSWORD=
+
+# Password for the 'kibana_system' user (at least 6 characters)
+KIBANA_PASSWORD=
+
+# Version of Elastic products
+STACK_VERSION=8.3.3
+
+# Set the cluster name
+CLUSTER_NAME=Marvel-Lab
+
+# Set to 'basic' or 'trial' to automatically start the 30-day trial
+LICENSE=basic
+#LICENSE=trial
+
+# Port to expose Elasticsearch HTTP API to the host
+ES_PORT=9200
+#ES_PORT=127.0.0.1:9200
+
+# Port to expose Kibana to the host
+KIBANA_PORT=5601
+#KIBANA_PORT=80
+
+# Increase or decrease based on the available host memory (in bytes)
+MEM_LIMIT=1073741824
+
+# Project namespace (defaults to the current folder name if not set)
+#COMPOSE_PROJECT_NAME=myproject

Logging/Config/elasticstack/elasticstack-compose.yml

@@ -0,0 +1,131 @@
+# Taken from:
+# https://elastic.co/guide/en/elasticsearch/reference/current/docker.html
+
+
+services:
+  setup:
+    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+    volumes:
+      - ./certs:/usr/share/elasticsearch/config/certs
+    user: "0"
+    command: >
+      bash -c '
+        if [ x${ELASTIC_PASSWORD} == x ]; then
+          echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
+          exit 1;
+        elif [ x${KIBANA_PASSWORD} == x ]; then
+          echo "Set the KIBANA_PASSWORD environment variable in the .env file";
+          exit 1;
+        fi;
+        if [ ! -f config/certs/ca.zip ]; then
+          echo "Creating CA";
+          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
+          unzip config/certs/ca.zip -d config/certs;
+        fi;
+        if [ ! -f config/certs/certs.zip ]; then
+          echo "Creating certs";
+          echo -ne \
+          "instances:\n"\
+          "  - name: es01\n"\
+          "    dns:\n"\
+          "      - es01\n"\
+          "      - localhost\n"\
+          "    ip:\n"\
+          "      - 127.0.0.1\n"\
+          > config/certs/instances.yml;
+          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
+          unzip config/certs/certs.zip -d config/certs;
+        fi;
+        echo "Setting file permissions"
+        chown -R root:root config/certs;
+        find . -type d -exec chmod 750 \{\} \;;
+        find . -type f -exec chmod 640 \{\} \;;
+        echo "Waiting for Elasticsearch availability";
+        until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
+        echo "Setting kibana_system password";
+        until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" https://es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;
+        echo "All done!";
+      '
+    healthcheck:
+      test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
+      interval: 1s
+      timeout: 5s
+      retries: 120
+
+  es01:
+    depends_on:
+      setup:
+        condition: service_healthy
+    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+    volumes:
+      - ./certs:/usr/share/elasticsearch/config/certs
+      - esdata01:/usr/share/elasticsearch/data
+    ports:
+      - ${ES_PORT}:9200
+    environment:
+      - node.name=es01
+      - cluster.name=${CLUSTER_NAME}
+      - cluster.initial_master_nodes=es01
+      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+      - bootstrap.memory_lock=true
+      - xpack.security.enabled=true
+      - xpack.security.http.ssl.enabled=true
+      - xpack.security.http.ssl.key=certs/es01/es01.key
+      - xpack.security.http.ssl.certificate=certs/es01/es01.crt
+      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.http.ssl.verification_mode=certificate
+      - xpack.security.transport.ssl.enabled=true
+      - xpack.security.transport.ssl.key=certs/es01/es01.key
+      - xpack.security.transport.ssl.certificate=certs/es01/es01.crt
+      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.transport.ssl.verification_mode=certificate
+      - xpack.license.self_generated.type=${LICENSE}
+    mem_limit: ${MEM_LIMIT}
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
+        ]
+      interval: 10s
+      timeout: 10s
+      retries: 120
+    restart: always
+
+  kibana:
+    depends_on:
+      es01:
+        condition: service_healthy
+    image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
+    volumes:
+      - ./certs:/usr/share/kibana/config/certs
+      - kibanadata:/usr/share/kibana/data
+    ports:
+      - ${KIBANA_PORT}:5601
+    environment:
+      - SERVERNAME=kibana
+      - ELASTICSEARCH_HOSTS=https://es01:9200
+      - ELASTICSEARCH_USERNAME=kibana_system
+      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
+      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
+    mem_limit: ${MEM_LIMIT}
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
+        ]
+      interval: 10s
+      timeout: 10s
+      retries: 120
+    restart: always
+
+volumes:
+  esdata01:
+    driver: local
+  kibanadata:
+    driver: local

Logging/Config/splunk/.env

@@ -0,0 +1 @@
+SPLUNK_VER=8.2.7

Logging/Config/splunk/splunk-compose.yml

@@ -0,0 +1,53 @@
+services:
+  splunk:
+    container_name: splunk
+    image: splunk/splunk:${SPLUNK_VER}
+    ports:
+      - 9997:9997
+      - 8089:8089
+    environment:
+      SPLUNK_PASSWORD: 'Changeme1!'
+      SPLUNK_START_ARGS: '--accept-license'
+      #SPLUNK_UPGRADE: 'true' # Only use when upgrading splunk. Modify SPLUNK_VER in .env to the version you want
+    volumes:
+      - splunk_etc:/opt/splunk/etc
+      - splunk_var:/opt/splunk/var
+      - ./Config/splunk/web.conf:/opt/splunk/etc/system/local/web.conf
+      - ./Config/zeek/zeek-logs/:/logs/zeek-logs/
+    labels:
+      - "traefik.http.routers.splunk.rule=PathPrefix(`/splunk`)"
+      - "traefik.http.routers.splunk.middlewares=https-redirect"
+      - "traefik.http.routers.splunk-secure.tls=true"
+      - "traefik.http.routers.splunk-secure.rule=PathPrefix(`/splunk`)"
+      - "traefik.http.services.splunk.loadbalancer.server.port=8000"
+    restart: unless-stopped
+
+  jupyter-notebooks:
+    container_name: jupyter-notebooks
+    image: jupyter/all-spark-notebook:${JUPYTER_VER}
+    ports:
+      - "8888:8888"
+    environment:
+      - NB_UID=1001
+      - NB_GID=1001
+      - JUPYTER_ENABLE_LAB=yes
+      - NB_USER=splunk
+      - CHOWN_EXTRA=/home/splunk
+    depends_on:
+      - "splunk"
+    volumes:
+      - splunk_etc:/home/splunk/etc
+      - splunk_var:/home/splunk/var
+      - jupyter-notebooks:/home/jovyan
+    labels:
+      - "traefik.http.routers.jupyter.rule=PathPrefix(`/jupyter`)"
+      - "traefik.http.routers.jupyter.middlewares=https-redirect"
+      - "traefik.http.routers.jupyter-secure.tls=true"
+      - "traefik.http.routers.jupyter-secure.rule=PathPrefix(`/jupyter`)"
+      - "traefik.http.services.jupyter.loadbalancer.server.port=8888"
+    restart: always
+
+volumes:
+  jupyter-notebooks:
+  splunk_etc:
+  splunk_var:

Logging/Config/zeek/.env

@@ -0,0 +1 @@
+INTERFACE=

Logging/Config/zeek/zeek-compose.yml

@@ -0,0 +1,13 @@
+services:
+    zeek:
+        container_name: zeek
+        image: blacktop/zeek:latest
+        restart: always
+        network_mode: host
+        cap_add:
+          - NET_RAW
+        volumes:
+          - ./zeek-logs/:/pcap:rw
+          - ./__load__.zeek:/usr/local/zeek/share/zeek/base/bif/__load__.zeek
+        command:
+          - -i ${INTERFACE} -C

Logging/docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  portainer:
+    container_name: portainer
+    image: portainer/portainer-ce:${PORTAINER_VER}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - portainer:/data
+    labels:
+      - "traefik.http.routers.portainer.rule=PathPrefix(`/portainer/`)"
+      - "traefik.http.routers.portainer.middlewares=https-redirect"
+      - "traefik.http.routers.portainer-secure.tls=true"
+      - "traefik.http.routers.portainer-secure.rule=PathPrefix(`/portainer/`)"
+      - "traefik.http.routers.portainer-secure.middlewares=portainer-stripprefix"
+      - "traefik.http.middlewares.portainer-stripprefix.stripprefix.prefixes=/portainer/"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
+    restart: always
+
+  traefik:
+    container_name: traefik
+    image: traefik:${TRAEFIK_VER}
+    command:
+      - --providers.docker=true 
+      - --serversTransport.insecureSkipVerify=true
+      - --entrypoints.web.address=:80
+      - --entrypoints.web-secure.address=:443
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - .:/files
+    labels:
+      - "traefik.http.routers.api.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
+      - "traefik.http.routers.api.service=api@internal"
+      - "traefik.http.routers.api.middlewares=https-redirect"
+      - "traefik.http.routers.api-secure.tls=true"
+      - "traefik.http.routers.api-secure.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
+      - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
+    restart: always
+
+volumes:
+  portainer: