History

Jean-Louis Huynen 5a3e299332 add: [filerwatcher] enable by_uuid / date filing		2021-02-18 14:37:43 +01:00
..
analyzer	fix: [Analyzer - close socket] use shutdown fct	2020-03-17 17:58:13 +01:00
configs	fix: [Flask server] change default host	2020-09-04 09:22:14 +02:00
documentation	…
gen_cert	…
lib	fic: [Sensors monitoring] fix reload list of sensors to monitor	2020-11-10 15:04:45 +01:00
update	chg: [Analyzer Queue] add template: edit queue	2020-03-03 14:14:35 +01:00
web	fix: [Flask] fix flask host	2020-11-10 16:12:09 +01:00
workers	add: [filerwatcher] enable by_uuid / date filing	2021-02-18 14:37:43 +01:00
.gitignore	…
Dockerfile.analyzer-d4-passivedns	…
Dockerfile.d4-server	…
LAUNCH.sh	chg: [Sensors API + UI] add sensors monitoring	2020-11-10 11:11:23 +01:00
README.md	fix: [README]	2020-03-12 11:15:35 +01:00
docker-compose.yml	…
install_server.sh	fix: [install script] cp default config	2019-12-03 10:29:15 +01:00
requirement.txt	…
sensors_manager.py	fic: [Sensors monitoring] typo	2020-11-10 15:09:12 +01:00
server.py	chg: [Sensors API + UI] add sensors monitoring	2020-11-10 11:11:23 +01:00

README.md

D4 core

D4 core server

D4 core server is a complete server to handle clients (sensors) including the decapsulation of the D4 protocol, control of sensor registrations, management of decoding protocols and dispatching to adequate decoders/analysers.

Requirements

Python 3.6
GNU/Linux distribution

Installation

Install D4 server

cd server
./install_server.sh

Create or add a pem in d4-core/server :

cd gen_cert
./gen_root.sh
./gen_cert.sh
cd ..

Launch D4 server

./LAUNCH.sh -l

The web interface is accessible via http://127.0.0.1:7000/

Updating web assets

To update javascript libs run:

cd web
./update_web.sh

API

API Documentation

Notes

All server logs are located in d4-core/server/logs/
Close D4 Server: ./LAUNCH.sh -k

D4 core server

Dashboard:

Connected Sensors:

Sensors Status:

Server Management:

analyzer Queues:

Troubleshooting

Worker 1, tcpdump: Permission denied

Could be related to AppArmor:

sudo cat /var/log/syslog | grep denied

Run the following command as root:

aa-complain /usr/sbin/tcpdump