search

secureworks / dalton

Suricata, Snort and Zeek IDS rule and pcap testing system
Apache License 2.0
455 stars 91 forks source link

be able to configure and test dalton_agent without rebuilding agent images #223

Open rkoumis opened 1 week ago

rkoumis commented 1 week ago

Currently, any changes to dalton-agent.conf or dalton-agent.py require rebuilding the agent containers.

It would be nice if we could mount the dalton-agent.py and dalton-agent.conf into the container.

One tricky area is this line in the suricata Dockerfile:

RUN sed -i 's/REPLACE_AT_DOCKER_BUILD-VERSION/'"${SURI_VERSION}"'/' /opt/dalton-agent/dalton-agent.conf