Skip to content

Instantly share code, notes, and snippets.

@mmguero
Created January 12, 2022 19:42
Show Gist options
  • Select an option

  • Save mmguero/08d3dcc81d84d9c48bbba2a5bd7519f4 to your computer and use it in GitHub Desktop.

Select an option

Save mmguero/08d3dcc81d84d9c48bbba2a5bd7519f4 to your computer and use it in GitHub Desktop.
pull zeek intel feeds for Malcolm zeek in Docker
#!/usr/bin/env bash
[[ "$(uname -s)" = 'Darwin' ]] && REALPATH=grealpath || REALPATH=realpath
[[ "$(uname -s)" = 'Darwin' ]] && DIRNAME=gdirname || DIRNAME=dirname
if ! (type "$REALPATH" && type "$DIRNAME") > /dev/null; then
echo "$(basename "${BASH_SOURCE[0]}") requires $REALPATH and $DIRNAME"
exit 1
fi
SCRIPT_PATH="$($DIRNAME $($REALPATH -e "${BASH_SOURCE[0]}"))"
pushd "$SCRIPT_PATH" >/dev/null 2>&1
rm -rf ./Zeek-Intelligence-Feeds/ ./loose/ ./__load__.zeek
touch ./__load__.zeek
git clone --depth=1 --single-branch --recurse-submodules --shallow-submodules --no-tags \
https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds ./Zeek-Intelligence-Feeds
pushd ./Zeek-Intelligence-Feeds >/dev/null 2>&1
sed -i "s@/usr/local/zeek@/opt/zeek@g" *
popd >/dev/null 2>&1
mkdir -p ./loose
pushd ./loose >/dev/null 2>&1
curl -L -J -O "https://raw.githubusercontent.com/CriticalPathSecurity/Zeek-Intelligence-File-Names/main/Zeek-Intelligence-File-Names.txt"
popd >/dev/null 2>&1
pushd .. >/dev/null 2>&1
docker-compose exec --user $(id -u) zeek /usr/local/bin/entrypoint.sh ls -l /opt/zeek/share/zeek/site/intel/
popd >/dev/null 2>&1
popd >/dev/null 2>&1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment