29 lines
711 B
Markdown
29 lines
711 B
Markdown
## Installation on FreeBSD
|
|
|
|
# Configure Kafka topics (run on one kafka node)
|
|
doc/kafka_topics.sh
|
|
|
|
# Initialize elasticsearch
|
|
curl -X PUT 'http://<elasticsearch>:9200/threatline' -d@doc/es_mapping.json
|
|
|
|
# Install service file
|
|
cp doc/threatline /usr/local/etc/rc.d/threatline
|
|
|
|
# Enable threatline
|
|
sysrc threatline_enable=YES
|
|
sysrc threatline_agents="normalize enrich check archive"
|
|
|
|
# Start threatline
|
|
service threatline start
|
|
|
|
# Monitor logs
|
|
tail -f /tmp/tl_worker.log
|
|
|
|
|
|
# Stages
|
|
Normalize: Touch-up/rename fields, etc.
|
|
Enrich: Enrich and part of the message.
|
|
Check: Checks parts of message (now enriched) against known bad stuff.
|
|
Archive: Push document into elasticsearch. Can also log to file.
|
|
|