Skip to content

This is a sample cloud ids implementation using CloudLens, Snort and ELK. This sample complements the 3 part cloud ids blog series in https://www.ixiacom.com/company/blog/sample-cloud-ids-solution-part-3-series

License

Notifications You must be signed in to change notification settings

OpenIxia/sample-cloud-ids

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Sample Cloud IDS

This repository holds the source code you need to bring up a setup locally on a Docker host, which mirrors the example described in part 3 of the Cloud IDS blog series.

sample scenario

Repository layout

  • app: contains docker compose definition to bring up the app and CloudLens to monitor packets
  • sensor: contains docker compose definition to bring up the logical ids sensor application consisting of Snort, CloudLens agent and Filebeat.
  • events_ui: contains docker compose definition to bring up ELK to serve event aggregation and end user presentation.

Requirements

Quick start instructions

  1. set up cloudlens account, create project and obtain project key
  2. go into events_ui directory, follow the instructions there to start ELK.
  3. with the ELK hostname/IP from (2) and cloudlens project key: go into sensor directory, follow the instructions there to start Snort sensor
  4. with the cloudlens project key: go into app directory, follow the instructions there to start the vulnerable app.
  5. create the vulnerable app and the snort sensor groups in CloudLens, and connect them.
  6. analyze via Kibana.

About

This is a sample cloud ids implementation using CloudLens, Snort and ELK. This sample complements the 3 part cloud ids blog series in https://www.ixiacom.com/company/blog/sample-cloud-ids-solution-part-3-series

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published