rocknsm / rock

Automated deployment scripts for the RockNSM network hunting distribution.

http://rocknsm.io

Apache License 2.0

446 stars 97 forks source link

Remove FSF role #574

Open spartan782 opened 3 years ago

spartan782 commented 3 years ago

FSF is a python2 project and deprecated. For now I would like to remove the role and look into other projects that could be a better fit. Possibly https://github.com/target/strelka?

koelslaw commented 2 years ago

Here is the progress I have made so far with strelka.

Replacement of FSF with Strelka

sudo yum install mock yum-utils rpmbuild epel-release yara wget
From there I added my user, admin , to the mock group that was created during the installation. sudo usermod -a -G mock admin
Grabbed Go wget https://golang.org/dl/go1.17.2.linux-amd64.tar.gz3
sudo tar -C /usr/local -xzf go1.17.2.linux-amd64.tar.gz. Golang needs to be added to the path export PATH=$PATH:/usr/local/go/bin
git clone strelka repo

Create Directories for Some Stuff

sudo mkdir -p /etc/strelka
sudo mkdir -p /var/log/strelka
sudo mkdir -p /etc/yara

Config Files

mv ~/strelka/configs/go/fileshot/fileshot.yaml /etc/strelka/

Initial stab @ config file

conn:
server: '127.0.0.1:57314'
cert: ''
timeout:
dial: 5s
file: 1m
throughput:
concurrency: 8
chunk: 32768
delay: 0s
files:
patterns:
- '/glob/to/your/files/*'
delete: false
gatekeeper: true
response:
log: 'strelka.log'

repeat for other Golang components.
Working on python components now