This pack provides actions for integrating with CloudShark, a tool for easily sharing and viewing packet captures.
It has been tested with the SaaS version of CloudShark, but should also work with the Enterprise version.
Copy the example configuration in cloudshark.yaml.example
to /opt/stackstorm/configs/cloudshark.yaml and edit as required.
It must contain:
host- Either https://www.cloudshark.org/ for the SaaS version, or your appliance addressapikey- A CloudShark API token.
To obtain a CloudShark API token, see the docs here.
You can also use dynamic values from the datastore. See the docs for more info.
Note : When modifying the configuration in /opt/stackstorm/configs/ please
remember to tell StackStorm to load these new values by running
st2ctl reload --register-configs
upload- Upload a file to CloudShark. Provide the path to a PCAP file. The result object will include a link to view the decoded file. You can optionally attach tags to the packet capture.