amsterdam 1.0

Introduction

Amsterdam is SELKS and Docker using Compose. The result of Amsterdam is a set of containers providing a complete Suricata IDS/NSM ecosystem:

• Suricata

• Elasticsearch

• Logstash

• Kibana

• Scirius

• Evebox (https://github.com/jasonish/evebox)

The ELK stack is created using the official docker images. Communication between logstash and suricata is done via a share directory (from the host). The same applies to scirius and suricata where the /etc/suricata/rules directory is shared.

Installation

sudo python setup.py install

sudo pip install amsterdam

sudo apt-get install docker.io docker-compose python-pip
sudo pip install amsterdam

sudo apt-get install docker.io python-pip
sudo pip install amsterdam

Usage

To sniff the wlan0 interface and store data and config in the ams directory, you can run

amsterdam -d ams -i wlan0 setup
amsterdam -d ams start

As of now the start command will take really long on first run as it will fetch from Docker hub all the necessary images and build some custom containers.

Subsequent run should take less than 1 minute.

You can then connect to:

• https://localhost/ on scirius with scirius/scirius as login/password

• https://localhost/kibana/ on kibana

• https://localhost/evebox/ on evebox

The HTTPS server is accessible from outside so you can connect to IP or hostname from there. So don’t forget to change the default password.

To stop the amsterdam instance, run

amsterdam -d ams stop

To remove an amsterdam instance in directory hacklu, run

amsterdam -d ~/builds/amsterdam/hacklu/ rm

and remove the data directory if you want to delete data.

Updating

git pull
sudo python setup.py install

pip install --upgrade --no-deps amsterdam

amsterdam -d ams -i eth0 update

amsterdam -d ams restart

amsterdam -d ams -f -i eth0 update

Tuning and coding

The configuration are stored in the config directory. For now only scirius, logstash and suricata are configured that way.

amsterdam -d ams restart

docker exec ams_scirius_1 python /opt/selks/scirius/manage.py migrate

Backup

Backups in the scirius container are shared with the host. /var/backups directory is shared in $basepath/backups on the host.

To start a backup, run

docker exec ams_scirius_1 python /opt/selks/scirius/manage.py scbackup

To restore a backup and erase all your data, you can run

docker exec ams_scirius_1 python /opt/selks/scirius/manage.py screstore
docker exec ams_scirius_1 python /opt/selks/scirius/manage.py migrate

This will restore the latest backup. To choose another backup, indicate a backup filename as first argument. To get list of available backup, use

docker exec ams_scirius_1 python /opt/selks/scirius/manage.py listbackups

You can not restore a backup to a scirius which is older than the one where the backup has been done.