filebeat

scripts/services/scirius/files/filebeat.docker.yml

@@ -0,0 +1,17 @@
+filebeat.config:
+  modules:
+    path: ${path.config}/modules.d/*.yml
+    reload.enabled: false
+
+filebeat.autodiscover:
+  providers:
+    - type: docker
+      hints.enabled: true
+
+processors:
+- add_cloud_metadata: ~
+
+output.elasticsearch:
+  hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
+  username: '${ELASTICSEARCH_USERNAME:}'
+  password: '${ELASTICSEARCH_PASSWORD:}'

scripts/services/scirius/init.sh

@@ -54,3 +54,7 @@ fi
 # sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
 # sudo chown root:root /etc/rsyslog.d/20-suricata.conf
 # sudo systemctl restart rsyslog
+
+IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
+sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yml
+sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata

scripts/services/scirius/suricata_start.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+systemctl start suricata
+systemctl enable suricata

scripts/services/scirius/suricata_stop.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+systemctl stop suricata
+systemctl disable suricata