irt/docker_hayabusa
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Move back to ubuntu as base for takajo

Browse Source
This commit is contained in:
kle
2024-06-13 13:41:34 +02:00
parent 5b6d1b8bec
commit 2b69f1feb2
2 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
Dockerfile
View File

@@ -1,16 +1,18 @@
FROM alpine as builder FROM alpine as builder
ADD 'https://github.com/Yamato-Security/hayabusa/releases/download/v2.10.1/hayabusa-2.10.1-all-platforms.zip' /hayabusa.zip ADD 'https://github.com/Yamato-Security/hayabusa/releases/download/v2.16.0/hayabusa-2.16.0-linux-intel.zip' /hayabusa.zip
ADD 'https://github.com/Yamato-Security/takajo/releases/download/v2.5.0/takajo-2.5.0-linux.zip' /takajo.zip
RUN apk add -U unzip git RUN apk add -U unzip git
RUN mkdir /opt/hayabusa && cd /opt/hayabusa && unzip /hayabusa.zip RUN mkdir /opt/hayabusa && cd /opt/hayabusa && unzip /hayabusa.zip && unzip /takajo.zip
RUN chmod +x /opt/hayabusa/hayabusa-2.10.1-lin-musl RUN chmod +x /opt/hayabusa/*
RUN ln /opt/hayabusa/hayabusa-2.10.1-lin-musl /opt/hayabusa/hayabusa RUN ln /opt/hayabusa/hayabusa-2.16.0-lin-x64-gnu /opt/hayabusa/hayabusa
RUN chmod +x /opt/hayabusa/hayabusa RUN chmod +x /opt/hayabusa/hayabusa
RUN /opt/hayabusa/hayabusa update-rules -r /opt/hayabusa/rules/ RUN /opt/hayabusa/hayabusa-2.16.0-lin-x64-musl update-rules -r /opt/hayabusa/rules/
From alpine
From ubuntu
COPY --from=0 /opt/hayabusa /opt/hayabusa COPY --from=0 /opt/hayabusa /opt/hayabusa
ENV PATH="${PATH}:/opt/hayabusa" ENV PATH="${PATH}:/opt/hayabusa"
RUN apk add -U bash RUN apt update && apt install -y bash libcurl4 libpcre3 && rm -rf /var/lib/apt/lists/*
WORKDIR /data WORKDIR /data
RUN mkdir /output && touch /output/notmounted RUN mkdir /output && touch /output/notmounted
ADD start.sh /root/start.sh ADD start.sh /root/start.sh

3
start.sh
View File

@@ -29,7 +29,10 @@ else
fi fi
#set output-destination #set output-destination
outdir="${output}"
output="${output}/hayabusa_$(date +%s)" output="${output}/hayabusa_$(date +%s)"
echo "output is goint to : ${output}" echo "output is goint to : ${output}"
hayabusa csv-timeline -p timesketch-verbose -r /opt/hayabusa/rules/ -w -m low -U -H "${output}".html -o "${output}.ts.csv" -C -d /data hayabusa csv-timeline -p timesketch-verbose -r /opt/hayabusa/rules/ -w -m low -U -H "${output}".html -o "${output}.ts.csv" -C -d /data
hayabusa json-timeline -p verbose -r /opt/hayabusa/rules/ -w -L -o "${output}_takajo.jsonl" -d /data
takajo automagic -t "${output}_takajo.jsonl" -o "${outdir}/takajo"