Skip to content
This repository has been archived by the owner on Nov 3, 2021. It is now read-only.

Commit

Permalink
Update manual installation format of docs
Browse files Browse the repository at this point in the history
  • Loading branch information
pwnbus committed Jan 3, 2020
1 parent 170e517 commit 8430e11
Show file tree
Hide file tree
Showing 8 changed files with 23 additions and 37 deletions.
1 change: 1 addition & 0 deletions docs/source/installation/manual.rst
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,6 @@ This installation process has been tested on CentOS 7.
.. toctree::
:maxdepth: 2

manual/initial_setup
manual/external_services
manual/mozdef_services
2 changes: 2 additions & 0 deletions docs/source/installation/manual/external_services.rst
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,7 @@ MozDef uses multiple external open source services to store data. These services
:maxdepth: 2

external_services/elasticsearch
external_services/kibana
external_services/rabbitmq
external_services/mongodb
external_services/nginx
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@ RabbitMQ

RabbitMQ requires `EPEL repos`_ so we need to first install that::

yum -y install epel-release
yum -y install epel-release

Download and install Rabbitmq::

wget https://www.rabbitmq.com/releases/rabbitmq-server/v3.6.1/rabbitmq-server-3.6.1-1.noarch.rpm
rpm --import https://www.rabbitmq.com/rabbitmq-signing-key-public.asc
yum install rabbitmq-server-3.6.1-1.noarch.rpm
yum install -y rabbitmq-server-3.6.1-1.noarch.rpm

Start Service::

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ Initial Setup
System Setup
************

Create the user::
Create the user::

adduser mozdef -d /opt/mozdef
mkdir /opt/mozdef/envs
Expand Down Expand Up @@ -45,6 +45,14 @@ Copy over mozdef syslog file::

cp /opt/mozdef/envs/mozdef/config/50-mozdef-filter.conf /etc/rsyslog.d/50-mozdef-filter.conf


Ensure log directory is created::

mkdir -p /var/log/mozdef/supervisord
chown -R mozdef:mozdef /var/log/mozdef


Restart rsyslog::

systemctl restart rsyslog

22 changes: 9 additions & 13 deletions docs/source/installation/manual/mozdef_services.rst
Original file line number Diff line number Diff line change
Expand Up @@ -4,37 +4,33 @@ MozDef Services
MozDef services can be broken up into 3 different groups (Alert, Ingest, Web). Each group of services should be run on the same machine, with all of the Ingest services able to run on N number of machines, allowing for a more distrubuted environment.

+------------------+------------------------+------------------------------------------+
| MozDef Service | Group | External Service |
| MozDef Service | Service Type | Required Service(s) |
+==================+========================+==========================================+
| Alerts | Alert Services | Elasticsearch, RabbitMQ, MozdefRestAPI |
| Alerts | Alert | Elasticsearch, RabbitMQ, MozdefRestAPI |
+------------------+------------------------+------------------------------------------+
| Alert Actions | Alert Services | RabbitMQ |
| Alert Actions | Alert | RabbitMQ |
+------------------+------------------------+------------------------------------------+
| Bot | Alert Services | RabbitMQ |
| Bot | Alert | RabbitMQ |
+------------------+------------------------+------------------------------------------+
| Loginput | Ingest Services | RabbitMQ |
| Loginput | Ingest | RabbitMQ, Nginx |
+------------------+------------------------+------------------------------------------+
| MQ Workers | Ingest Services | Elasticsearch, RabbitMQ |
| MQ Workers | Ingest | Elasticsearch, RabbitMQ |
+------------------+------------------------+------------------------------------------+
| Meteor | Web Services | Mongodb |
| RestAPI | Web | Elasticsearch, Mongodb, Nginx |
+------------------+------------------------+------------------------------------------+
| RestAPI | Web Services | Elasticsearch, Mongodb |
| Meteor | Web | Mongodb, MozdefRestAPI, Nginx |
+------------------+------------------------+------------------------------------------+
| Kibana | Web Services | Elasticsearch |
| Kibana | Web | Elasticsearch, Nginx |
+------------------+------------------------+------------------------------------------+

.. toctree::
:maxdepth: 2

mozdef_services/initial_setup
mozdef_services/web
mozdef_services/restapi
mozdef_services/kibana
mozdef_services/alerts
mozdef_services/alertactions
mozdef_services/bot
mozdef_services/cron
mozdef_services/loginput
mozdef_services/mq_workers
mozdef_services/nginx
mozdef_services/final_steps
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,6 @@ Copy over systemd file::
cp /opt/mozdef/envs/mozdef/systemdfiles/alert/mozdefalertactions.service /usr/lib/systemd/system/mozdefalertactions.service


Ensure log directory is created::

mkdir -p /var/log/mozdef/supervisord
chown -R mozdef:mozdef /var/log/mozdef


Start alert actions service::

systemctl start mozdefalertactions
Expand Down
6 changes: 0 additions & 6 deletions docs/source/installation/manual/mozdef_services/alerts.rst
Original file line number Diff line number Diff line change
Expand Up @@ -25,12 +25,6 @@ Copy over systemd file::
cp /opt/mozdef/envs/mozdef/systemdfiles/alert/mozdefalerts.service /usr/lib/systemd/system/mozdefalerts.service


Ensure log directory is created::

mkdir -p /var/log/mozdef/supervisord
chown -R mozdef:mozdef /var/log/mozdef


Start alerts service::

systemctl start mozdefalerts
Expand Down

This file was deleted.

0 comments on commit 8430e11

Please sign in to comment.