shane/threatline
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Shane
2019-01-11 15:58:12 +00:00
parent 7d23097423
commit fcbbda71ef
1 changed files with 19 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
README.md
View File

@@ -1,28 +1,27 @@
# Stages
**Normalize**: Touch-up/rename fields, etc.
**Enrich**: Enrich and part of the message.
**Check**: Checks parts of message (now enriched) against known bad stuff.
**Archive**: Push document into elasticsearch. Can also log to file.
## Installation on FreeBSD
# Configure Kafka topics (run on one kafka node)
doc/kafka_topics.sh
### Configure Kafka topics (run on one kafka node)
`doc/kafka_topics.sh`
# Initialize elasticsearch
curl -X PUT 'http://<elasticsearch>:9200/threatline' -d@doc/es_mapping.json
### Initialize elasticsearch
`curl -X PUT 'http://<elasticsearch>:9200/threatline' -d@doc/es_mapping.json`
# Install service file
cp doc/threatline /usr/local/etc/rc.d/threatline
### Install service file
`cp doc/threatline /usr/local/etc/rc.d/threatline`
# Enable threatline
sysrc threatline_enable=YES
sysrc threatline_agents="normalize enrich check archive"
### Enable threatline
`sysrc threatline_enable=YES`
`sysrc threatline_agents="normalize enrich check archive"`
# Start threatline
service threatline start
### Start threatline
`service threatline start`
# Monitor logs
tail -f /tmp/tl_worker.log
# Stages
Normalize: Touch-up/rename fields, etc.
Enrich: Enrich and part of the message.
Check: Checks parts of message (now enriched) against known bad stuff.
Archive: Push document into elasticsearch. Can also log to file.
### Monitor logs
`tail -f /tmp/tl_worker.log`