nrdcs / tpot2csv

This docker creates CSV feed from the T-POT collected data in the ElasticSearch database

tpot2csv

This docker creates CSV feed from the T-POT collected data in the ElasticSearch database.

Docker is based on official apache2.4 alpine docker image with python install and cron job configured. tpot2csv.py connects to elasticsearch service (being on the same network as t-pot containers), retrieves data based on saved query (query.json file), saves timestamp and source IP columns into CSV file. query.json is adjusted in a way query aggregates data for each unique IP with the latest timestamp seen. Content for the query.json can be taken from Kibana interface Inspect screen.

Usage:

Use .env.dist to create actual .env file (adjust virtual host name and email address for Apache configuration) and run install.sh to build and launch container.

cp .env.dist .env
vi .env
./install.sh
systemctl start tpot2csv

Notes:

• t-pot's nginx SSL certificate is being used from files /data/nginx/cert/nginx.{crt,key}. Restart container if you replacing certificate.

docker restart tpot2csv

• apache service logs goes to /data/tpot2csv/log

tpot2csv's Issues

etc_default in default docker installation doesn't exists

default docker service doesn't has etc_default network

suggestion- before docker-compose in install.sh file to add something like:
tmp_kint=docker network ls | grep etc_default | wc -l
if [ $tmp_kint -eq 0 ]; then
docker network create etc_default
fi

cis benchmark

acording to docker cis benchmark
rootfs should be mounted as read only
healthcheck should be used