README
¶
Emitto
About
Emitto is a service which provides a robust and targeted way to manage, store, and administer Suricata intrusion detection system (IDS) rules to a distributed network sensor monitoring deployment.
Building
-
Install Bazel
-
Download the source code
-
Build the project:
cd emitto/
bazel build //...
Docker
Both the sever and sensor client can be built with the Bazel Docker rules located in their respective BUILD files.
For example, to build and run the sensor client locally in Docker:
bazel --bazelrc=.bazelrc build --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 source/sensor:sensor_image.tar
docker load -i bazel-bin/source/sensor/sensor_image.tar
docker run bazel/source/sensor:sensor_image
The current go_image rule uses a distroless
runtime base image, and will run using the default Go binary flag values. The container_image rule can be extended to support a custom env and other image attributes.
Bazel supports the ability to push an image to a remote repository, and also to pull a remote image to be used as a custom base dependency. More information about Bazel Docker rules can be found here.
Prerequisites
The following services and products must be established and configured before running Emitto.
Fleetspeak
Emitto leverages Fleetspeak for reliable, multi-homed communication between the server and network sensors.
While this code is working internally with an internal deployment of Fleetspeak, the open source version is still in development. See the Fleetspeak status section for more information and updates.
Please read the Fleetspeak disclaimer.
Google Cloud Platform
By default, Emitto uses Google Cloud Datastore and Google Cloud Storage for object and rule file storage, respectively.
Discussions & Announcements
The Emitto Google Groups forum will be used for community discussions and announcements.
DISCLAIMER
This is not an officially supported Google product.
Directories
¶
| Path | Synopsis |
|---|---|
|
source
|
|
|
filestore
Package filestore contains functionality to store Emitto rule files.
|
Package filestore contains functionality to store Emitto rule files. |
|
resources
Package resources contains common objects and conversion functions.
|
Package resources contains common objects and conversion functions. |
|
sensor
Package main initializes and starts the Emitto sensor client.
|
Package main initializes and starts the Emitto sensor client. |
|
sensor/client
Package client contains sensor client functionality.
|
Package client contains sensor client functionality. |
|
sensor/fleetspeak
Package fleetspeak provides functionality for network sensors to communicate with the Emitto service via Fleetspeak.
|
Package fleetspeak provides functionality for network sensors to communicate with the Emitto service via Fleetspeak. |
|
sensor/host
Package host provides functionality to obtain basic host information for a host.
|
Package host provides functionality to obtain basic host information for a host. |
|
sensor/suricata
Package suricata contains functionality to control and monitor Suricata.
|
Package suricata contains functionality to control and monitor Suricata. |
|
sensor/suricata/socket
Package socket contains functionality to send commands to Suricata via its Unix socket.
|
Package socket contains functionality to send commands to Suricata via its Unix socket. |
|
server
Package main initializes and starts the Emitto service.
|
Package main initializes and starts the Emitto service. |
|
server/client
Package client contains Emitto client functionality.
|
Package client contains Emitto client functionality. |
|
server/fleetspeak
Package fleetspeak provides administrative functionality for Fleetspeak.
|
Package fleetspeak provides administrative functionality for Fleetspeak. |
|
server/service
Package service provides the implementation of the Emitto service.
|
Package service provides the implementation of the Emitto service. |
|
server/store
Package store contains functionality to store objects.
|
Package store contains functionality to store objects. |