History

Terrtia 2bc20333a9 chg: [analyzer + flask] add maltrail worker + fix show_uuid: filter empty field		2019-09-19 11:57:18 +02:00
..
analyzer	chg: [analyzer] add export analyzer: syslog, unix, udp fix:#27	2019-09-18 17:16:45 +02:00
configs	…
documentation	fix: [Flask auth] add brute force and side-channel protection	2019-09-03 10:43:52 +02:00
gen_cert	…
lib	fix: [Flask auth] add brute force and side-channel protection	2019-09-03 10:43:52 +02:00
web	chg: [analyzer + flask] add maltrail worker + fix show_uuid: filter empty field	2019-09-19 11:57:18 +02:00
workers	chg: [analyzer + flask] add maltrail worker + fix show_uuid: filter empty field	2019-09-19 11:57:18 +02:00
.gitignore	…
Dockerfile.analyzer-d4-passivedns	…
Dockerfile.d4-server	…
LAUNCH.sh	chg: [UI] add users management	2019-09-02 16:06:46 +02:00
README.md	Update README.md	2019-09-02 16:13:40 +02:00
docker-compose.yml	…
install_server.sh	chg: [UI] add users management	2019-09-02 16:06:46 +02:00
requirement.txt	…
server.py	…

README.md

D4 core

D4 core server

D4 core server is a complete server to handle clients (sensors) including the decapsulation of the D4 protocol, control of sensor registrations, management of decoding protocols and dispatching to adequate decoders/analysers.

Requirements

Python 3.6
GNU/Linux distribution

Installation

Install D4 server

cd server
./install_server.sh

Create or add a pem in d4-core/server :

cd gen_cert
./gen_root.sh
./gen_cert.sh
cd ..

Launch D4 server

./LAUNCH.sh -l

The web interface is accessible via http://127.0.0.1:7000/

Updating web assets

To update javascript libs run:

cd web
./update_web.sh

API

API Documentation

Notes

All server logs are located in d4-core/server/logs/
Close D4 Server: ./LAUNCH.sh -k

Screenshots of D4 core server management

Troubleshooting

Worker 1, tcpdump: Permission denied

Could be related to AppArmor:

sudo cat /var/log/syslog | grep denied

Run the following command as root:

aa-complain /usr/sbin/tcpdump