adjustments to how Zeek intel files get generated among Malcolm's containers

[mmguero]

The issue is right now all of the Zeek containers attempt to generate the intel file, although it's shared amongst all of them.

This is exacerbated in a Kubernetes deployment where you scale up the number of zeek-live containers.

Here are the changes we need to make:

1. Make the zeek-live containers not run the intel update at all. Just have them start up and start collecting, and in zeekdeploy.sh they'll notice updates to the intel files made externally to them and restart automatically. We need to not unilaterally remove the intel generation from zeek-deploy (since that's what the hedgehogs use as well) but will need to distinguish which of those two scenarios we're in.
2. Make the zeek-offline container the only one in charge of doing the intel update. Whether this happens in the entrypoint (as is the case now) or cron-based is up for debate.
3. move the working directory for creating the intel files to a temporary directory so that even if we did get two working on it at once they're not stepping on each others' toes

[mmguero]

in mmguero-dev/Malcolm@97ebeef, I did the following:

• remove ZEEK_CRON variable
• moved ZEEK_INTEL_REFRESH_CRON_EXPRESSION variable to zeek-offline.env for zeek-offline container only
• added ZEEK_INTEL_REFRESH_ON_ENTRYPOINT=false and ZEEK_INTEL_REFRESH_ON_DEPLOY=false
  • ZEEK_INTEL_REFRESH_ON_ENTRYPOINT is set to true for the zeek-offline container only
  • ZEEK_INTEL_REFRESH_ON_DEPLOY is only set to true on Hedgehog Linux installations (where we're not using Docker), in control_vars.conf
• zeek_intel_setup.sh now only sets up the crontab file for the container if ZEEK_INTEL_REFRESH_CRON_EXPRESSION is set
• zeek_deploy.sh checks ZEEK_INTEL_REFRESH_ON_DEPLOY before running zeek_intel_setup.sh
• zeek/scripts/docker_entrypoint.sh checks ZEEK_INTEL_REFRESH_ON_ENTRYPOINT before running zeek_intel_setup.sh
• supercronic runs in both containers, but only actually gets set up for Zeek intel pull when ZEEK_INTEL_REFRESH_CRON_EXPRESSION is set
  • this is because there may be other things we want cron to do here in the future, for now with an empty crontab the zeek-live one will just sleep