https://github.com/StamusNetworks/suricata-analytics

https://github.com/StamusNetworks/suricata-analytics

Last synced: 3 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/StamusNetworks/suricata-analytics
• Owner: StamusNetworks
• Created: 2022-03-16T13:45:51.000Z (almost 3 years ago)
• Default Branch: main
• Last Pushed: 2023-12-06T13:40:19.000Z (about 1 year ago)
• Last Synced: 2024-04-15T02:10:13.336Z (9 months ago)
• Language: Jupyter Notebook
• Size: 1.14 MB
• Stars: 20
• Watchers: 7
• Forks: 8
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-suricata - Suricata Analytics - Various resources that are useful when interacting with Suricata data. (Analysis Tools)

README

        
# Suricata Analytics

## Summary

This repository contains various resources that are useful when interacting with Suricata data.

## Content

The repository is organized into directories. Each one contains data for the associated software.

## Jupyter

[Project Jupyter](https://jupyter.org/) provides a interactive data analytics environment. We provide threat hunting and data exploration notebooks which are located under `jupyter/Notebooks`. Those notebooks are designed to interact with [Scirius](https://github.com/StamusNetworks/scirius) REST API endpoints using the `python/surianalytics` data connectors.

### Getting started

#### Docker build

We provide a docker image that encapsulates all dependencies needed by the notebooks. Easiest way to get started is using `docker-compose`. Firstly, use `.env.example` as reference for setting up SELKS / SSP connection variables.

```

cp .env.example .env

```

Edit the `.env` file.

```

# This is the scirius API token you can generate under Account Settings -> Edit Token

SCIRIUS_TOKEN=

# This points to SELKS / Scirius / SSP manager instance

SCIRIUS_HOST=

# Set to "no" if your SELKS / Scirius / SSP manager uses self-signed HTTPS certificate

SCIRIUS_TLS_VERIFY=yes

```

Build the docker image.

```

docker-compose build

```

Execute the docker image.

```

docker-compose up

```

Copy the jupyter connection string from container log messages and paste into your chosen web browser. Connection string should look like `http://127.0.0.1:8888/lab?token=`.