tulip/docker-compose-suricata.yml at master · OpenAttackDefenseTools/tulip · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
version: "3.5"
services:
  timescale:
    build: services/timescale
    image: tulip-timescale:latest
    restart: unless-stopped
    volumes:
    - timescale-data:/var/lib/postgresql/data
    - ./services/schema/system.sql:/docker-entrypoint-initdb.d/100_system.sql:ro
    - ./services/schema/functions.sql:/docker-entrypoint-initdb.d/101_functions.sql:ro
    - ./services/schema/schema.sql:/docker-entrypoint-initdb.d/102_schema.sql:ro
    networks:
      - internal
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust
      POSTGRES_USER: tulip
      POSTGRES_DB: tulip
    # This does not need to be adjusted, unless you actually want to limit it
    # Postgres uses shared memory for caching, and docker assigns just 64 MB by default
    shm_size: '128g'

  frontend:
    build:
      context: frontend
      dockerfile: Dockerfile-frontend
    image: tulip-frontend:latest
    restart: unless-stopped
    ports:
      - "3000:3000"
    expose:
      - 3000
    depends_on:
      - timescale
      - api
    networks:
      - internal
    environment:
      API_SERVER_ENDPOINT: http://api:5000/
      VIRTUAL_HOST: tulip.h4xx.eu

  api:
    build:
      context: services/api
      dockerfile: Dockerfile-api
    image: tulip-api:latest
    restart: unless-stopped
    depends_on:
      - timescale
    networks:
      - internal
    volumes:
      - ${TRAFFIC_DIR_HOST}:${TRAFFIC_DIR_DOCKER}:ro
    environment:
      TIMESCALE: ${TIMESCALE}
      TULIP_TRAFFIC_DIR: ${TRAFFIC_DIR_DOCKER}
      FLAG_REGEX: ${FLAG_REGEX}
      TICK_START: ${TICK_START}
      TICK_LENGTH: ${TICK_LENGTH}
      VM_IP: ${VM_IP}

  flagids:
    restart: unless-stopped
    build:
      context: services/flagids
    image: tulip-flagids:latest
    depends_on:
      - timescale
    networks:
      - internal
    environment:
      TIMESCALE: ${TIMESCALE}
      TICK_START: ${TICK_START}
      TICK_LENGTH: ${TICK_LENGTH}
      FLAGID_SCRAPE: ${FLAGID_SCRAPE}
      TEAM_ID: ${TEAM_ID}
      FLAGID_ENDPOINT: ${FLAGID_ENDPOINT}
      VISUALIZER_URL: ${VISUALIZER_URL}
      DUMP_PCAPS: ${DUMP_PCAPS}

  assembler:
    build:
      context: services/go-importer
      dockerfile: Dockerfile-assembler
    image: tulip-assembler:latest
    restart: unless-stopped
    depends_on:
      - timescale
    networks:
      - internal
    volumes:
      - ${TRAFFIC_DIR_HOST}:${TRAFFIC_DIR_DOCKER}:ro,z
    # Command line flags most likely to fix a tulip issue:
    # - -http-session-tracking: enable HTTP session tracking
    # - -dir: directory to read traffic from
    # - -skipchecksum: skip checksum validation
    # - -flush-after: i.e. 2m Not needed in pcap rotation mode
    # - -disable-converters: disable converters
    # - -discard-extra-data: dont split large flow items, just discard them
    command: "./assembler -http-session-tracking -skipchecksum -disable-converters -dir ${TRAFFIC_DIR_DOCKER}"
    environment:
      TIMESCALE: ${TIMESCALE}
      FLAG_REGEX: ${FLAG_REGEX}
      TICK_START: ${TICK_START}
      TICK_LENGTH: ${TICK_LENGTH}
      FLAGID_SCAN: ${FLAGID_SCAN}
      FLAG_LIFETIME: ${FLAG_LIFETIME}
      FLAG_VALIDATOR_TYPE: ${FLAG_VALIDATOR_TYPE}
      FLAG_VALIDATOR_TEAM: ${FLAG_VALIDATOR_TEAM}
      PCAP_OVER_IP: ${PCAP_OVER_IP}
      DUMP_PCAPS: ${DUMP_PCAPS}
      DUMP_PCAPS_INTERVAL: ${DUMP_PCAPS_INTERVAL}
      DUMP_PCAPS_FILENAME: ${DUMP_PCAPS_FILENAME}
      BPF: ${BPF}
    extra_hosts:
      - "host.docker.internal:host-gateway"

  enricher:
    build:
      context: services/go-importer
      dockerfile: Dockerfile-enricher
    image: tulip-enricher:latest
    restart: unless-stopped
    depends_on:
      - timescale
    networks:
      - internal
    volumes:
      - ${SURICATA_DIR_HOST}/log:/suricata
      - ${TRAFFIC_DIR_HOST}:${TRAFFIC_DIR_DOCKER}:ro
    command: "./enricher -eve /suricata/eve.json"
    environment:
      TIMESCALE: ${TIMESCALE}

  suricata:
    image: jasonish/suricata:7.0
    restart: unless-stopped
    volumes:
      - ${TRAFFIC_DIR_HOST}:${TRAFFIC_DIR_DOCKER}:ro
      - ${SURICATA_DIR_HOST}/log:/var/log/suricata
      - ${SURICATA_DIR_HOST}/etc:/etc/suricata
      - ${SURICATA_DIR_HOST}/lib:/var/lib/suricata
    environment:
      SURICATA_OPTIONS: "-l /var/log/suricata -v -r ${TRAFFIC_DIR_DOCKER} --pcap-file-continuous"

volumes:
  timescale-data:

networks:
  internal: