docker-prelude-siem

From Docker hub:

$ docker run -h prelude-manager.foo --name prelude -p 8000:8000 2xyo/prelude-siem

From source:

$ cd /home/yoyo/projects/
$ git clone https://github.com/2xyo/docker-prelude-siem.git
$ cd docker-prelude-siem
$ docker build -t prelude .
$ docker run -h prelude-manager.foo -d --name prelude -p 8000:8000 \
    -v /home/yoyo/projects/docker-prelude-siem/data/logs/apache2:/var/log/apache2 \
    -v /home/yoyo/projects/docker-prelude-siem/data/conf:/usr/local/etc/prelude/profile/ \
    -v /home/yoyo/projects/docker-prelude-siem/data/db:/srv/prelude/db/ \
    -v /home/yoyo/projects/docker-prelude-siem/data/logs/prelude:/var/log/prelude/ \
    prelude

Or interactive start:

$  docker run -h prelude-manager.foo --name prelude -it -p 8000:8000  \
    -v /home/yoyo/projects/docker-prelude-siem/data/logs/apache2:/var/log/apache2 \
    -v /home/yoyo/projects/docker-prelude-siem/data/conf:/usr/local/etc/prelude/profile/ \
    -v /home/yoyo/projects/docker-prelude-siem/data/db:/srv/prelude/db/ \
    -v /home/yoyo/projects/docker-prelude-siem/data/logs/prelude:/var/log/prelude/ \
    --entrypoint=/bin/bash prelude 
# /docker-entrypoint.sh

Then open http://127.0.0.1:8000

Test prelude-lml:

$ echo '[Sat Mar 12 22:48:24 2005] [error] [client 127.0.0.1] Directory index forbidden by rule: /var/www/sample/' >> ./data/logs/apache2/error_log

More logs:

$ docker exec prelude egrep ^#LOG /usr/local/etc/prelude-lml/ruleset/httpd.rules | awk -F'#LOG:' '{print $2}'
[Sat Mar 12 22:56:12 2005] [error] [client 127.0.0.1] File does not exist: /var/www/favicon.ico
[Sat Mar 12 22:56:13 2005] [error] [client 127.0.0.1] Premature end of script headers: /var/www/sample/index.pl
[Sat Mar 12 22:48:24 2005] [error] [client 127.0.0.1] Directory index forbidden by rule: /var/www/sample/
[Sat Mar 12 22:38:41 2005] [error] [client 127.0.0.1] client denied by server configuration: /var/www/sample/
[Sun Jan  2 22:42:47 2005] [error] [client 127.0.0.1] request failed: error reading the headers
[Sun Jan  2 23:48:19 2005] [error] [client 127.0.0.1] request failed: URI too long
[Sat Apr 16 14:30:12 2005] [error] [client ::1] File does not exist: /var/www/favicon.ico
Apr 17 12:58:51 mail httpd: OK: Pass Phrase Dialog successful.
Apr 17 12:58:48 mail httpd: Apache:mod_ssl:Error: Pass phrase incorrect (5 more retries permitted).
Apr 17 14:00:48 mail httpd: Apache:mod_ssl:Error: Pass phrase incorrect.
Apr 17 14:00:13 mail httpd: httpd shutdown succeeded
Apr 17 14:02:41 mail httpd: httpd startup succeeded

Or execute the following command a few times to trigger a correlation alert:

$ docker exec prelude /bin/sh -c "echo -e\
'Dec  9 19:00:39 itguxweb2 sshd[24541]: Failed password for root from 12.34.56.79 port 1806\n'\
'Dec  9 19:00:40 itguxweb2 sshd[24541]: Failed password for root from 12.34.56.79 port 1807\n'\
'Dec  9 19:00:41 itguxweb2 sshd[24541]: Failed password for root from 12.34.56.79 port 1808\n'\
'Dec  9 19:00:42 itguxweb2 sshd[24541]: Failed password for root from 12.34.56.79 port 1809\n'\
'Dec  9 19:00:43 itguxweb2 sshd[24541]: Failed password for root from 12.34.56.79 port 1810\n'\
'Dec  9 19:00:44 itguxweb2 sshd[24541]: Failed password for root from 12.34.56.79 port 1811\n'\
>> /var/log/messages"

Play inside the container:

$ docker exec -it prelude /bin/bash 

Clean data

$ sudo rm -rf ./data/db/prelude.db \
    ./data/db/prewikka.db \
    ./data/db/nodes \
    ./data/conf/prelude-manager \
    ./data/conf/prelude-correlator \
    ./data/conf/prelude-lml 
$ sudo echo "" > data/logs/apache2/access_log