shunkino

'use strict'

const promisify = require('promisify-es6')
const EventEmitter = require('events')
const eos = require('end-of-stream')
const isNode = require('detect-node')
const setImmediate = require('async/setImmediate')
const PubsubMessageStream = require('./utils/pubsub-message-stream')
const stringlistToArray = require('./utils/stringlist-to-array')
const moduleConfig = require('./utils/module-config')

shunkino

network.host: 0.0.0.0
http.cors.allow-credentials: true
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-headers: Access-Control-Allow-Headers,X-Requested-With,X-Auth-Token,Content-Type,Content-Length,Authorization

shunkino

version: '2.2'
services:
  kibana:
    image: docker.elastic.co/kibana/kibana:5.6.9
    container_name: kibana
    volumes:
      - ./kibana.yml:/usr/share/kibana/config/kibana.yml
    ports:
      - 5601:5601
    networks:

shunkino

mkdir ${HOME}/es_storage
cd ${HOME}/es_storage
mkdir esdata1
mkdir esdata2
mkdir esdata3
mkdir esdata4

shunkino

version: '2'
services:
  kibana:
    image: docker.elastic.co/kibana/kibana:6.4.2
    container_name: kibana
    volumes:
      - ./kibana.yml:/usr/share/kibana/config/kibana.yml
    ports:
      - 5601:5601
    networks:

shunkino

About

11/3に行うRAMにて実施するTutorialです．

Index

全体の流れは以下に示すとおりです．

• Dockerを使ってElasticsearch
• Dockerを使ってMoloch
• Molochでpcapを解析
• 解析結果を眺める

shunkino

name: base
channels:
  - anaconda
  - activisiongamescience
  - conda-forge
  - defaults
dependencies:
  - geoip2=2.2.0=py36_0
  - libmaxminddb=1.1.4=0
  - maxminddb=1.2.0=py36_0

shunkino

server.host: "0.0.0.0"
elasticsearch.url: "http://elasticsearch:9200"

shunkino

from elasticsearch import Elasticsearch
es = Elasticsearch(['elasticsearch:9200'])
response = es.search(
        index="sessions2-181016",
        body={
  "size": 0,
  "query": {
    "bool": {
      "filter": {
        "bool": {

shunkino

import plotly.graph_objs as go
from plotly.offline import download_plotlyjs, init_notebook_mode, plot, iplot
import numpy as np
import colorlover as cl
def convert_colorscale_format(colorscale):
    plotly_colorscale = []
    for index, sec_value in enumerate(np.linspace(0, 1, len(colorscale))):
        plotly_colorscale.append([sec_value, colorscale[index]])
    return plotly_colorscale
# %%