search

orlikoski / Skadi

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux
https://www.skadivm.com
GNU General Public License v3.0
489 stars 71 forks source link

Using cdqr in latest skadi OVA system can't see zip file #119

Closed slacker-kb closed 5 years ago

slacker-kb commented 5 years ago

In doing some testing with skadi_server-2019.3.ova I have user CyLR to capture data from my linux host (kubuntu 18.04). Ran CyLR -u skadi -p skadi -s to get the zip to the skadi server vm. Confirmed its there, it is (beast5.zip). When I run: cdqr -p lin --max_cpu beast5.zip --es_kb beast5_sample I get this error: ERROR: "beast5.zip" cannot be found by the system.

Am I messing up the command? I looked at the python code and found where the error comes from, lines 1219-1232 (https://github.com/orlikoski/CDQR/blob/master/src/cdqr.py). I have tried adding the full directory, "/home/skadi/beast5.zip", same error.

All I want to do is use cdqr to process the zip so I can add into kibana. Thanks.

orlikoski commented 5 years ago

Hi @slacker-kb and thank you for asking.

Starting in Skadi 2019.3 the CDQR functions are accomplished using the aorlikoski/CDQR docker. In order to facilitate this transition a CDQR Docker Helper script was created and stored in /usr/local/bin/cdqr. So that script is what you're calling when cdqr is typed at the terminal and then it does some translations and then creates the correct docker run command required to process the data.

There is a slight difference in the command line arguments between cdqr.py and the cdqr helper script. I believe this is what is causing the issue you're having.

I've added links in this response to facilitate research on the script. Here is the modified command, based on your example. That should work

cdqr -p lin --max_cpu in:beast5.zip out:Results --es_kb beast5_sample

slacker-kb commented 5 years ago

Thanks so much! Worked like a charm.