alphasoc / nfr

A lightweight tool to score network traffic and flag anomalies
https://alphasoc.com
Other
122 stars 19 forks source link

Update README #31

Closed ioj closed 7 years ago

ioj commented 7 years ago

Update README with a more comprehensive installation guide.

ioj commented 7 years ago

I improved it a bit, but it lacks a thorough description what namescore actually is, its purpose, what's AlphaSOC, etc. Ideally, README should be a great landing page which leaves no unanswered questions between cloning the repo and successfully running namescore.

Some examples of good readme files in my opinion:

chrisforce1 commented 7 years ago

I need:

  1. foolproof and full installation steps (including libpcap-dev installation)
  2. instructions for generating an API key
  3. instructions for how to get data in from disk/file (not sniffing)
  4. output of the status command as code, as we should use that instead of a screenshot
  5. remove references to /home/phob0s as that seems unprofessional
ioj commented 7 years ago

@chrisforce1 please branch off develop to your own branch (i.e. chris/readme) and make all necessary changes there. README in develop is already updated (compared to master).

If you can, please also make a vagrant instance with ubuntu or debian and follow the installation steps. Then you'll know how the registration flow looks like and you'll be able to create relevant shell snippets.

ioj commented 7 years ago

Oh, also regarding (3) -- the new namescore can't parse logs, it works like DDI Guard Agent now, so sniffing only and (5) It's already gone in develop branch.

chrisforce1 commented 7 years ago

Take a look. I assume the govendor sync line is obsolete?

Please adjust and I think we're good to make this public, thanks.

chrisforce1 commented 7 years ago

Please take a look and let's prepare this README for public release, thanks.