{"action":"created","issue":{"url":"https://api.github.com/repos/dunbarcyber/cyphondock/issues/2","repository_url":"https://api.github.com/repos/dunbarcyber/cyphondock","labels_url":"https://api.github.com/repos/dunbarcyber/cyphondock/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/dunbarcyber/cyphondock/issues/2/comments","events_url":"https://api.github.com/repos/dunbarcyber/cyphondock/issues/2/events","html_url":"https://github.com/dunbarcyber/cyphondock/issues/2","id":223930618,"number":2,"title":"Several install questions","user":{"login":"DigiAngel","id":947191,"avatar_url":"https://avatars3.githubusercontent.com/u/947191?v=3","gravatar_id":"","url":"https://api.github.com/users/DigiAngel","html_url":"https://github.com/DigiAngel","followers_url":"https://api.github.com/users/DigiAngel/followers","following_url":"https://api.github.com/users/DigiAngel/following{/other_user}","gists_url":"https://api.github.com/users/DigiAngel/gists{/gist_id}","starred_url":"https://api.github.com/users/DigiAngel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DigiAngel/subscriptions","organizations_url":"https://api.github.com/users/DigiAngel/orgs","repos_url":"https://api.github.com/users/DigiAngel/repos","events_url":"https://api.github.com/users/DigiAngel/events{/privacy}","received_events_url":"https://api.github.com/users/DigiAngel/received_events","type":"User","site_admin":false},"labels":[{"id":571396113,"url":"https://api.github.com/repos/dunbarcyber/cyphondock/labels/bug","name":"bug","color":"ee0701","default":true},{"id":591560933,"url":"https://api.github.com/repos/dunbarcyber/cyphondock/labels/documentation","name":"documentation","color":"5319e7","default":false},{"id":571396118,"url":"https://api.github.com/repos/dunbarcyber/cyphondock/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":{"login":"lhadjchikh","id":5034226,"avatar_url":"https://avatars3.githubusercontent.com/u/5034226?v=3","gravatar_id":"","url":"https://api.github.com/users/lhadjchikh","html_url":"https://github.com/lhadjchikh","followers_url":"https://api.github.com/users/lhadjchikh/followers","following_url":"https://api.github.com/users/lhadjchikh/following{/other_user}","gists_url":"https://api.github.com/users/lhadjchikh/gists{/gist_id}","starred_url":"https://api.github.com/users/lhadjchikh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lhadjchikh/subscriptions","organizations_url":"https://api.github.com/users/lhadjchikh/orgs","repos_url":"https://api.github.com/users/lhadjchikh/repos","events_url":"https://api.github.com/users/lhadjchikh/events{/privacy}","received_events_url":"https://api.github.com/users/lhadjchikh/received_events","type":"User","site_admin":false},"assignees":[{"login":"lhadjchikh","id":5034226,"avatar_url":"https://avatars3.githubusercontent.com/u/5034226?v=3","gravatar_id":"","url":"https://api.github.com/users/lhadjchikh","html_url":"https://github.com/lhadjchikh","followers_url":"https://api.github.com/users/lhadjchikh/followers","following_url":"https://api.github.com/users/lhadjchikh/following{/other_user}","gists_url":"https://api.github.com/users/lhadjchikh/gists{/gist_id}","starred_url":"https://api.github.com/users/lhadjchikh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lhadjchikh/subscriptions","organizations_url":"https://api.github.com/users/lhadjchikh/orgs","repos_url":"https://api.github.com/users/lhadjchikh/repos","events_url":"https://api.github.com/users/lhadjchikh/events{/privacy}","received_events_url":"https://api.github.com/users/lhadjchikh/received_events","type":"User","site_admin":false}],"milestone":null,"comments":12,"created_at":"2017-04-24T19:46:00Z","updated_at":"2017-04-26T17:28:06Z","closed_at":null,"body":"Ok I think I have three :)  My understanding so far is that cyphon and cyclops are two distinct apps.  I have two VM's set up, one for each.  First:\r\n\r\nPer [this](https://cyphon-ui.readthedocs.io/en/latest/getting-started/docker-install.html) I'd like to install via Docker....put this just points to the cyphon Docker install.\r\n\r\nSecond, after following the Docker install for cyphon, starting in dev mode fails with:\r\n~~~\r\n@cyphon:/opt/cyphon/cyphondock$ sudo docker-compose -f docker-compose.yml -f docker-compose.dev.yml up\r\nERROR: build path /opt/cyphon/cyphon either does not exist, is not accessible, or is not a valid URL.\r\n~~~\r\n\r\nThird, starting in production gets me the below open services:\r\n~~~\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name\r\ntcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1056/sshd\r\ntcp        0      0 127.0.0.1:6010          0.0.0.0:*               LISTEN      5977/0\r\ntcp6       0      0 :::5044                 :::*                    LISTEN      19180/docker-proxy\r\ntcp6       0      0 :::5045                 :::*                    LISTEN      19168/docker-proxy\r\ntcp6       0      0 :::22                   :::*                    LISTEN      1056/sshd\r\ntcp6       0      0 :::15672                :::*                    LISTEN      18539/docker-proxy\r\ntcp6       0      0 ::1:6010                :::*                    LISTEN      5977/0\r\ntcp6       0      0 :::443                  :::*                    LISTEN      20985/docker-proxy\r\ntcp6       0      0 :::5601                 :::*                    LISTEN      18992/docker-proxy\r\ntcp6       0      0 :::80                   :::*                    LISTEN      21010/docker-proxy\r\ntcp6       0      0 :::8080                 :::*                    LISTEN      18059/docker-proxy\r\nudp        0      0 0.0.0.0:57733           0.0.0.0:*                           527/systemd-timesyn\r\nudp6       0      0 :::5000                 :::*                                19190/docker-proxy\r\n~~~\r\n\r\nand docker ps -a:\r\n~~~\r\nCONTAINER ID        IMAGE                        COMMAND                  CREATED             STATUS              PORTS                                                                     NAMES\r\nbb9a18f1fe43        dunbar/cyclops:latest        \"/bin/sh -c 'npm r...\"   About an hour ago   Up About an hour    3000/tcp                                                                  cyphondock_cyclops_1\r\n524966c98fb5        dunbar/cyphon:latest         \"../entrypoints/ru...\"   About an hour ago   Up About an hour    8000/tcp                                                                  cyphondock_celerybeat_1\r\n3c5f75c6785a        dunbar/cyphon:latest         \"../entrypoints/ru...\"   About an hour ago   Up About an hour    8000/tcp                                                                  cyphondock_receiver_1\r\n2623cad5b268        dunbar/cyphon:latest         \"../entrypoints/ru...\"   About an hour ago   Up About an hour    8000/tcp                                                                  cyphondock_celeryworker_1\r\n1659ee0c984e        nginx:1.11                   \"nginx -g 'daemon ...\"   About an hour ago   Up About an hour    0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp                                  cyphondock_nginx_1\r\n0fa4d4d28850        gliderlabs/logspout:latest   \"/bin/logspout sys...\"   About an hour ago   Up About an hour    80/tcp                                                                    cyphondock_logspout_1\r\naa407612a915        dunbar/cyphon:latest         \"/bin/sh -c $CYPHO...\"   About an hour ago   Up About an hour    8000/tcp                                                                  cyphondock_cyphon_1\r\nc4f4856c450f        logstash:5.2                 \"/docker-entrypoin...\"   About an hour ago   Up About an hour    0.0.0.0:5000->5000/udp, 0.0.0.0:5044-5045->5044-5045/tcp                  cyphondock_logstash_1\r\n5b4fd896228d        kibana:5.2                   \"/docker-entrypoin...\"   About an hour ago   Up About an hour    0.0.0.0:5601->5601/tcp                                                    cyphondock_kibana_1\r\nf0b40f995a4c        rabbitmq:3.6-management      \"docker-entrypoint...\"   About an hour ago   Up About an hour    4369/tcp, 5671-5672/tcp, 15671/tcp, 25672/tcp, 0.0.0.0:15672->15672/tcp   cyphondock_rabbit_1\r\n8f4e1587ade4        mongo:3.4                    \"docker-entrypoint...\"   About an hour ago   Up About an hour    27017/tcp                                                                 cyphondock_mongo_1\r\n516a326ac9da        mdillon/postgis:9.6          \"docker-entrypoint...\"   About an hour ago   Up About an hour    5432/tcp                                                                  cyphondock_postgres_1\r\n2ba905215393        elasticsearch:5.2            \"/docker-entrypoin...\"   About an hour ago   Up About an hour    9200/tcp, 9300/tcp                                                        cyphondock_elasticsearch_1\r\n701e1323e3d7        google/cadvisor:latest       \"/usr/bin/cadvisor...\"   About an hour ago   Up About an hour    0.0.0.0:8080->8080/tcp                                                    cyphondock_cadvisor_1\r\nbaa5100bd419        dunbar/geoip                 \"crond -f -d 8\"          About an hour ago   Up About an hour                                                                              cyphondock_geoip_1\r\n~~~\r\n\r\nSo far only port 80, 5601, 8080, and 15672 are working.  I can login to port 80 with the login that I created, but so far I can see only Dashboard and Alerts, nothing more.  The RabbutMQ port 15672 works, but I don't know the login.  8080, cAdvisor appears to work fine.  5601 Kibana works ok, but I'm stuck at the index pattern screen.\r\n\r\nLastly, per [this](https://cyphon.readthedocs.io/en/latest/user-manual/data-storage.html) I can make changes via the main admin page.  How do I get to the main admin page?  Thank you!"},"comment":{"url":"https://api.github.com/repos/dunbarcyber/cyphondock/issues/comments/297483743","html_url":"https://github.com/dunbarcyber/cyphondock/issues/2#issuecomment-297483743","issue_url":"https://api.github.com/repos/dunbarcyber/cyphondock/issues/2","id":297483743,"user":{"login":"DigiAngel","id":947191,"avatar_url":"https://avatars3.githubusercontent.com/u/947191?v=3","gravatar_id":"","url":"https://api.github.com/users/DigiAngel","html_url":"https://github.com/DigiAngel","followers_url":"https://api.github.com/users/DigiAngel/followers","following_url":"https://api.github.com/users/DigiAngel/following{/other_user}","gists_url":"https://api.github.com/users/DigiAngel/gists{/gist_id}","starred_url":"https://api.github.com/users/DigiAngel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DigiAngel/subscriptions","organizations_url":"https://api.github.com/users/DigiAngel/orgs","repos_url":"https://api.github.com/users/DigiAngel/repos","events_url":"https://api.github.com/users/DigiAngel/events{/privacy}","received_events_url":"https://api.github.com/users/DigiAngel/received_events","type":"User","site_admin":false},"created_at":"2017-04-26T17:28:06Z","updated_at":"2017-04-26T17:28:06Z","body":"Awesome thanks...before I ask anymore questions I'll keep reading the \nUser Guide :)  This is pretty sweet...nice work!!!\n\nOn 2017-04-26 11:17, Leila Hadj-Chikh wrote:\n> Yes, that's essentially how we’re using it. You can send Bro logs\n> directly to Elasticsearch via Logstash, and as long as Cyphon knows\n> where the data is and what it looks like (by creating “shell”\n> Distilleries for those logs), it can run Context searches for you (and\n> of course you can still search the data through Kibana as well).\n> \n> If you have an IDS that’s sending alerts to syslog, just pipe that\n> to RabbitMQ in your Logstash config, and Cyphon can parse those logs\n> and create Alerts from them. This pipeline is demonstrated in the\n> logstash/conf/3-output.conf.\n> \n> You shouldn’t have any problem dropping in your current Logstash\n> configuration. I broke up the example Logstash configuration into\n> separate files so it’d be easier to swap components in and out. The\n> essential thing to remember is to send your IDS alerts to Cyphon via\n> RabbitMQ, and send all the related logs directly to Elasticsearch so\n> Cyphon doesn’t have to waste processing time on them. Then just make\n> sure you have Distilleries that model the related logs, and Contexts\n> that allow you to search them when you get Alerts.\n> \n> I know all this can be kind of confusing, so let me know if you need\n> more clarification. :-)\n> \n> BTW, I’m in the process of adding example fixtures for Nessus scans,\n> so that will be available soon if you’re interested.\n> \n> --\n> You are receiving this because you authored the thread.\n> Reply to this email directly, view it on GitHub [1], or mute the\n> thread [2].\n> \n> \t*\n> \n> Links:\n> ------\n> [1] \n> https://github.com/dunbarcyber/cyphondock/issues/2#issuecomment-297480889\n> [2]\n> https://github.com/notifications/unsubscribe-auth/AA5z98AYpvUBCjwwLGF-DKoHyql673_yks5rz3w8gaJpZM4NGn9r\n"}}
{"actor":{"display_login":"DigiAngel"}}