modubs ids

.devcontainer/virtual/docker-compose.yml

@@ -1,3 +1,18 @@
+volumes:
+ certs:
+   driver: local
+ esdata01:
+   driver: local
+ kibanadata:
+   driver: local
+ metricbeatdata01:
+   driver: local
+ filebeatdata01:
+   driver: local
+ logstashdata01:
+   driver: local
+
+
 services:
   attack:
     image: mniedermaier1337/cybicsattack:latest
@@ -14,7 +29,7 @@ services:
       - $DOCKER_ENV_DIR/.bash_history:/home/docker/.bash_history
     user: ${HOST_UID:-1000}:${HOST_UID:-1000}
     networks:
-      virt-cybics:
+      br-cybics:
         ipv4_address: 172.18.0.100
 
   openplc:
@@ -28,7 +43,7 @@ services:
       - 8080:8080
       - 502:502
     networks:
-      virt-cybics:
+      br-cybics:
         ipv4_address: 172.18.0.3
 
   opcua:
@@ -42,7 +57,7 @@ services:
     depends_on:
     - openplc
     networks:
-      virt-cybics:
+      br-cybics:
         ipv4_address: 172.18.0.5
 
   s7com:
@@ -56,7 +71,7 @@ services:
     depends_on:
     - openplc
     networks:
-      virt-cybics:
+      br-cybics:
         ipv4_address: 172.18.0.6
 
   fuxa:
@@ -70,7 +85,7 @@ services:
     depends_on:
     - openplc
     networks:
-      virt-cybics:
+      br-cybics:
         ipv4_address: 172.18.0.4
 
   hwio:
@@ -84,15 +99,211 @@ services:
     depends_on:
     - openplc
     networks:
-      virt-cybics:
+      br-cybics:
         ipv4_address: 172.18.0.2
 
+  suricata:
+    image: jasonish/suricata:7.0
+    restart: always
+    cap_add:
+    - net_admin
+    - net_raw
+    - sys_nice
+    volumes:
+    - ../../software/suricata/config:/etc/suricata
+    - ../../software/suricata/lib:/var/lib/suricata
+    - ../../software/suricata/log:/var/log/suricata
+    environment:
+      SURICATA_OPTIONS: "-c /etc/suricata/suricata.yaml -i br-cybics"
+    network_mode: host
+
+  setup-es01:
+   image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+   volumes:
+     - certs:/usr/share/elasticsearch/config/certs
+   user: "0"
+   command: >
+     bash -c '
+       if [ x${ELASTIC_PASSWORD} == x ]; then
+         echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
+         exit 1;
+       elif [ x${KIBANA_PASSWORD} == x ]; then
+         echo "Set the KIBANA_PASSWORD environment variable in the .env file";
+         exit 1;
+       fi;
+       if [ ! -f config/certs/ca.zip ]; then
+         echo "Creating CA";
+         bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
+         unzip config/certs/ca.zip -d config/certs;
+       fi;
+       if [ ! -f config/certs/certs.zip ]; then
+         echo "Creating certs";
+         echo -ne \
+         "instances:\n"\
+         "  - name: es01\n"\
+         "    dns:\n"\
+         "      - es01\n"\
+         "      - localhost\n"\
+         "    ip:\n"\
+         "      - 127.0.0.1\n"\
+         "  - name: kibana\n"\
+         "    dns:\n"\
+         "      - kibana\n"\
+         "      - localhost\n"\
+         "    ip:\n"\
+         "      - 127.0.0.1\n"\
+         > config/certs/instances.yml;
+         bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
+         unzip config/certs/certs.zip -d config/certs;
+       fi;
+       echo "Setting file permissions"
+       chown -R root:root config/certs;
+       find . -type d -exec chmod 750 \{\} \;;
+       find . -type f -exec chmod 640 \{\} \;;
+       echo "Waiting for Elasticsearch availability";
+       until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
+       echo "Setting kibana_system password";
+       until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" https://es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;
+       echo "All done!";
+     '
+   healthcheck:
+     test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
+     interval: 1s
+     timeout: 5s
+     retries: 120
+
+  es01:
+   depends_on:
+     setup-es01:
+       condition: service_healthy
+   image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+   labels:
+     co.elastic.logs/module: elasticsearch
+   volumes:
+     - certs:/usr/share/elasticsearch/config/certs
+     - esdata01:/usr/share/elasticsearch/data
+   ports:
+     - ${ES_PORT}:9200
+   environment:
+     - node.name=es01
+     - cluster.name=${CLUSTER_NAME}
+     - discovery.type=single-node
+     - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+     - bootstrap.memory_lock=true
+     - xpack.security.enabled=true
+     - xpack.security.http.ssl.enabled=true
+     - xpack.security.http.ssl.key=certs/es01/es01.key
+     - xpack.security.http.ssl.certificate=certs/es01/es01.crt
+     - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
+     - xpack.security.transport.ssl.enabled=true
+     - xpack.security.transport.ssl.key=certs/es01/es01.key
+     - xpack.security.transport.ssl.certificate=certs/es01/es01.crt
+     - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
+     - xpack.security.transport.ssl.verification_mode=certificate
+     - xpack.license.self_generated.type=${LICENSE}
+   mem_limit: ${ES_MEM_LIMIT}
+   ulimits:
+     memlock:
+       soft: -1
+       hard: -1
+   healthcheck:
+     test:
+       [
+         "CMD-SHELL",
+         "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
+       ]
+     interval: 10s
+     timeout: 10s
+     retries: 120
+
+  kibana:
+   depends_on:
+     es01:
+       condition: service_healthy
+   image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
+   labels:
+     co.elastic.logs/module: kibana
+   volumes:
+     - certs:/usr/share/kibana/config/certs
+     - kibanadata:/usr/share/kibana/data
+   ports:
+     - ${KIBANA_PORT}:5601
+   environment:
+     - SERVERNAME=kibana
+     - ELASTICSEARCH_HOSTS=https://es01:9200
+     - ELASTICSEARCH_USERNAME=kibana_system
+     - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
+     - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
+     - XPACK_SECURITY_ENCRYPTIONKEY=${ENCRYPTION_KEY}
+     - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=${ENCRYPTION_KEY}
+     - XPACK_REPORTING_ENCRYPTIONKEY=${ENCRYPTION_KEY}
+   mem_limit: ${KB_MEM_LIMIT}
+   healthcheck:
+     test:
+       [
+         "CMD-SHELL",
+         "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
+       ]
+     interval: 10s
+     timeout: 10s
+     retries: 120
+
+  metricbeat01:
+   depends_on:
+     es01:
+       condition: service_healthy
+     kibana:
+       condition: service_healthy
+   image: docker.elastic.co/beats/metricbeat:${STACK_VERSION}
+   user: root
+   volumes:
+     - certs:/usr/share/metricbeat/certs
+     - metricbeatdata01:/usr/share/metricbeat/data
+     - "../../software/elastic/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml:ro"
+     - "/var/run/docker.sock:/var/run/docker.sock:ro"
+     - "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
+     - "/proc:/hostfs/proc:ro"
+     - "/:/hostfs:ro"
+   environment:
+     - ELASTIC_USER=elastic
+     - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+     - ELASTIC_HOSTS=https://es01:9200
+     - KIBANA_HOSTS=http://kibana:5601
+     - LOGSTASH_HOSTS=http://logstash01:9600
+
+  filebeat01:
+    depends_on:
+        es01:
+          condition: service_healthy
+    image: docker.elastic.co/beats/filebeat:${STACK_VERSION}
+    user: root
+    volumes:
+        - certs:/usr/share/filebeat/certs
+        - filebeatdata01:/usr/share/filebeat/data
+        - "../../software/suricata/log/:/usr/share/filebeat/ingest_data/"
+        - "../../software/elastic/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
+        - "/var/lib/docker/containers:/var/lib/docker/containers:ro"
+        - "/var/run/docker.sock:/var/run/docker.sock:ro"
+    environment:
+        - ELASTIC_USER=elastic
+        - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+        - ELASTIC_HOSTS=https://es01:9200
+        - KIBANA_HOSTS=http://kibana:5601
+        - LOGSTASH_HOSTS=http://logstash01:9600
+
+
 networks:
-  virt-cybics:
+  br-cybics:
     driver: bridge
+    name: br-cybics
+    driver_opts:
+      com.docker.network.bridge.name: br-cybics
     ipam:
       driver: default
       config:
         - subnet: 172.18.0.0/24
           gateway: 172.18.0.1
 
+  default: 
+    name: elastic 
+    external: false

software/elastic/filebeat.yml

@@ -0,0 +1,29 @@
+filebeat.inputs:
+- type: filestream
+  id: default-filestream
+  paths:
+   - ingest_data/fast.log
+
+
+filebeat.autodiscover:
+ providers:
+   - type: docker
+     hints.enabled: true
+
+
+processors:
+- add_docker_metadata: ~
+
+
+setup.kibana:
+ host: ${KIBANA_HOSTS}
+ username: ${ELASTIC_USER}
+ password: ${ELASTIC_PASSWORD}
+
+
+output.elasticsearch:
+ hosts: ${ELASTIC_HOSTS}
+ username: ${ELASTIC_USER}
+ password: ${ELASTIC_PASSWORD}
+ ssl.enabled: true
+ ssl.certificate_authorities: "certs/ca/ca.crt"

software/elastic/metricbeat.yml

@@ -0,0 +1,62 @@
+metricbeat.config.modules:
+ path: ${path.config}/modules.d/*.yml
+ reload.enabled: false
+
+
+metricbeat.modules:
+- module: elasticsearch
+  xpack.enabled: true
+  period: 10s
+  hosts: ${ELASTIC_HOSTS}
+  ssl.certificate_authorities: "certs/ca/ca.crt"
+  ssl.certificate: "certs/es01/es01.crt"
+  ssl.key: "certs/es01/es01.key"
+  username: ${ELASTIC_USER}
+  password: ${ELASTIC_PASSWORD}
+  ssl.enabled: true
+
+
+- module: logstash
+  xpack.enabled: true
+  period: 10s
+  hosts: ${LOGSTASH_HOSTS}
+
+
+- module: kibana
+  metricsets:
+    - stats
+  period: 10s
+  hosts: ${KIBANA_HOSTS}
+  username: ${ELASTIC_USER}
+  password: ${ELASTIC_PASSWORD}
+  xpack.enabled: true
+
+
+- module: docker
+  metricsets:
+   - "container"
+   - "cpu"
+   - "diskio"
+   - "healthcheck"
+   - "info"
+   #- "image"
+   - "memory"
+   - "network"
+  hosts: ["unix:///var/run/docker.sock"]
+  period: 10s
+  enabled: true
+
+
+processors:
+ - add_host_metadata: ~
+ - add_docker_metadata: ~
+
+
+output.elasticsearch:
+ hosts: ${ELASTIC_HOSTS}
+ username: ${ELASTIC_USER}
+ password: ${ELASTIC_PASSWORD}
+ ssl:
+   certificate: "certs/es01/es01.crt"
+   certificate_authorities: "certs/ca/ca.crt"
+   key: "certs/es01/es01.key"