/docker-snort

Snort + Pulledpork + Websnort in Docker!

Primary LanguageDockerfile

docker-snort

Includes Snort + PulledPork + WebSnort (exposes port 8080)

The project is to assit in initial stage triage of a potentially malicious pcap. It runs all the rules it can against a pcap attempting to highlight sessions of interest.

Processing of the PCAP does take a while due to the number of rules being utilised!

Thanks to:

To use:

NB Oink code required if not using customintel.sh script. Can be obtained from: https://www.snort.org/oinkcodes

1. Build with either (2nd option doesn't require git clone);

docker build -t snortweb . --build-arg PPORK_OINKCODE=<your-oink-code-from-snort.org>
docker build -t snortweb . --build-arg PPORK_OINKCODE=<your-oink-code-from-snort.org> https://github.com/geekscrapy/docker-snort.git

2. Run with:

docker run -P8080:8080 snortweb

Once running, visit http://localhost:8080/

3. Update the rules:

docker exec snortweb bash update-rules.sh <oink_code>

4. (optional) Custom intel rules (customintel.sh):

This custom script enables rules to be pulled from any source when update-rules.sh is run. Create a scipt named customintel.sh in the current directory before building, or, alternativley the script can be created/modified once the container has been created

Requirements:

  • The customintel.sh script must output rules to stdout - output is inserted into /etc/snort/rules/customintel.rules which is loaded by snort

Additional whitelists/blacklists:

To update local.rules, white_list.rules or black_list.rules, modify the file and build the image.

Options

The following variables can be added to customise the build (values shown are the defaults):

Option Build argument
PulledPork Oink code: PPORK_OINKCODE=<your-oink-code-from-snort.org>
Snort version: SNORT_VER=2.9.11.1
DAQ version: DAQ_VER=daq-2.0.6
PulledPork version: PPORK_VERSION=0.7.3
Snort HOME_NET variable: SNORT_HOME_NET="192.168.0.0/16,172.16.0.0/12,10.0.0.0/8"