PMP (Programmable Monitoring Platform)

PMP is an open source, modularly designed, programmable platform for collecting, exposing and visualising data from data sources in the Contiuum Cloud. In addition, it provides threat detection to alert and notify on anomalous behaviour by analysing network traffic. Finally, PMP uses agnostic Sigma rules to configure the tools.

🔧 Features

• 🌀 Data collection in real time
• 🔌 Automatisation process
• 🔔 Alerts and notifications
• 🔨 Dynamic configuration
• 📊 Data visualisation
• ➕ Modular
• 🚀 RESTful Public API for programmatic access
• 🐳 Dockerized deployment for easy setup

🔩 Tools

🔒 Developed

• Fluentd
• Telegraf
• Falco
• Tshark
• Filebeat
• Kafka

🚧 Future development

• Snort3
• Grafana
• Kibana
• Elasticsearch
• InfluxDB
• Sigma translator

⚙️ Installation

1. Clone the repository:

   gh repo clone CyberDataLab/ROBUST-6G_PMP

2. Navigate to the project directory:

   cd ROBUST-6G_PMP/

3. Generate modified images

   sudo docker build -f Dockerfiles/dockerfile.falco -t falco_robust6g:latest .
   sudo docker build -f Dockerfiles/dockerfile.fluentd -t fluentd_robust6g:latest .
   sudo docker build -f Dockerfiles/dockerfile.tshark -t tshark_robust6g:latest .

🕹️ Usage

1. Permissions of Filebeat configuration

   sudo chmod 644 configuration_files/filebeat.yml
   sudo chown root:root configuration_files/filebeat.yml

2. Usage and deployment using

   python3 start_containers.py

Do not use the docker-compose.yml file because the PMP needs an environment variable to uniquely identify the machine using the monitoring tools.

3. Delete containers and deployed volumes as well as generated data at the same time.

   python3 remove_containers.py

📋 Requirements

• Docker 27.5.1 or higher.
• docker-compose 1.29.2 or higher.
• Python3.12 or higher.

The tool containers already satisfy their requirements without the need of any user installation.

📜 License

PMP is open-source under the GPL-3.0 license. See the LICENSE file for details.

❗ Errors

In case filebeat.yml is showing errors, change the permissions with:

    sudo chmod 644 filebeat.yml
    sudo chown root:root filebeat.yml