Reworked Dockerfile to be multiarch

Dockerfile

@@ -1,19 +1,71 @@
-FROM alpine as builder
-ADD 'https://github.com/Yamato-Security/hayabusa/releases/download/v2.16.0/hayabusa-2.16.0-linux-intel.zip' /hayabusa.zip
-ADD 'https://github.com/Yamato-Security/takajo/releases/download/v2.5.0/takajo-2.5.0-linux.zip' /takajo.zip
-RUN apk add -U unzip git
-RUN mkdir /opt/hayabusa && cd /opt/hayabusa && unzip /hayabusa.zip && unzip /takajo.zip
-RUN chmod +x /opt/hayabusa/*
-RUN ln /opt/hayabusa/hayabusa-2.16.0-lin-x64-gnu /opt/hayabusa/hayabusa
-RUN chmod +x /opt/hayabusa/hayabusa
-RUN /opt/hayabusa/hayabusa-2.16.0-lin-x64-musl update-rules -r /opt/hayabusa/rules/
+# Stage 1: Builder
+FROM alpine AS builder
 
+# Get the target platform
+ARG TARGETPLATFORM
+ENV HAYABUSA_VERSION=2.17.0
+ENV TAKAJO_VERSION=2.6.0
 
-From ubuntu
-COPY --from=0 /opt/hayabusa /opt/hayabusa
+# Install necessary tools
+RUN apk add --no-cache unzip wget git
+
+# Determine the correct zip files and binaries based on TARGETPLATFORM
+RUN \
+    case "$TARGETPLATFORM" in \
+    "linux/amd64") \
+        HAYABUSA_ZIP="hayabusa-${HAYABUSA_VERSION}-linux-intel.zip"; \
+        HAYABUSA_BINARY="hayabusa-${HAYABUSA_VERSION}-lin-x64-gnu"; \
+        TAKAJO_ZIP="takajo-${TAKAJO_VERSION}-linux-intel.zip"; \
+        TAKAJO_BINARY="takajo-${TAKAJO_VERSION}-lin-x64-gnu"; \
+        ;; \
+    "linux/arm64") \
+        HAYABUSA_ZIP="hayabusa-${HAYABUSA_VERSION}-linux-arm.zip"; \
+        HAYABUSA_BINARY="hayabusa-${HAYABUSA_VERSION}-lin-aarch64-gnu"; \
+        ;; \
+    *) echo "Unsupported platform: $TARGETPLATFORM"; exit 1 ;; \
+    esac && \
+    # Download Hayabusa zip
+    wget -O /hayabusa.zip "https://github.com/Yamato-Security/hayabusa/releases/download/v${HAYABUSA_VERSION}/${HAYABUSA_ZIP}" && \
+    mkdir -p /opt/hayabusa && \
+    cd /opt/hayabusa && \
+    unzip /hayabusa.zip && \
+    ln -s "$HAYABUSA_BINARY" /opt/hayabusa/hayabusa && \
+    chmod +x /opt/hayabusa/hayabusa && \
+    # Download and extract Takajo for linux/amd64 only
+    if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
+        wget -O /takajo.zip "https://github.com/Yamato-Security/takajo/releases/download/v${TAKAJO_VERSION}/${TAKAJO_ZIP}" && \
+        unzip /takajo.zip -d /opt/hayabusa && \
+        ln -s "$TAKAJO_BINARY" /opt/hayabusa/takajo && \
+        chmod +x /opt/hayabusa/takajo; \
+    fi
+
+# Clone the latest rules directly from GitHub
+RUN rm -rf /opt/hayabusa/rules
+RUN git clone --depth=1 https://github.com/Yamato-Security/hayabusa-rules.git /opt/hayabusa/rules
+
+# Stage 2: Final Image
+FROM ubuntu
+
+# Copy only the necessary files from the builder stage
+COPY --from=builder /opt/hayabusa /opt/hayabusa
+
+# Set environment variables
 ENV PATH="${PATH}:/opt/hayabusa"
-RUN apt update && apt install -y bash libcurl4 libpcre3 &&  rm -rf /var/lib/apt/lists/*
+
+# Install necessary packages
+RUN apt-get update && \
+apt-get install -y --no-install-recommends bash libcurl4 libpcre3 libsqlite3-0 && \
+rm -rf /var/lib/apt/lists/*
+
+# Set the working directory
 WORKDIR /data
-RUN mkdir /output && touch /output/notmounted
-ADD start.sh /root/start.sh
+
+# Create output directory
+RUN mkdir /output
+
+# Add the startup script
+COPY start.sh /root/start.sh
+RUN chmod +x /root/start.sh
+
+# Set the default command
 CMD ["/bin/bash", "/root/start.sh"]

start.sh

@@ -1,38 +1,44 @@
 #!/bin/sh
-#check if folder was mounted under /data
-if [[ ! -d /data ]] ; then
+# Check if folder was mounted under /data
+if [ ! -d /data ]; then
     echo "[!] No Folder was mounted to /data"
-    echo "[=] Make sure a folder containig the Windows Logs (evtx) is mounted. Example:"
+    echo "[=] Make sure a folder containing the Windows Logs (evtx) is mounted. Example:"
     echo "[=]"
     echo "[>] # docker run -it --rm --network=none -v /path/to/logfiles:/data tabledevil/hayabusa"
     exit 1
 fi
 
-#check which destination is writeable /data or /output
-if [[ ! -f /output/notmounted ]] && [[ -w /output ]] ; then
-    echo "[!] Output folder was mounted and is writeable"
+# Check which destination is writable /data or /output
+if [ -w /output ]; then
+    echo "[!] Output folder was mounted and is writable"
     echo "[>] Using /output as destination for report"
     output="/output"
-else
-    if [[ -w /data ]] ; then
+elif [ -w /data ]; then
     echo "[!] Mounted folder /data can be written"
     echo "[>] Using /data as destination for report"
     output="/data"
 else
-        echo "[!] No writeable output folder available"
+    echo "[!] No writable output folder available"
     echo "[=] Make sure either the folder mounted under /data is writable ..."
     echo "[>] # docker run -it --rm -v /path/to/logfiles:/data tabledevil/hayabusa"
     echo "[=] ... or mount a writable folder to /output"
-        echo "[>] # docker run -it --rm -v --network=none /path/to/logfiles:/data:ro -v /path/for/report:/output tabledevil/hayabusa"
+    echo "[>] # docker run -it --rm -v /path/to/logfiles:/data:ro -v /path/for/report:/output tabledevil/hayabusa"
     exit 1
 fi
-fi
 
-#set output-destination
+# Set output destination
 outdir="${output}"
-output="${output}/hayabusa_$(date +%s)"
-echo "output is goint to : ${output}"
+timestamp=$(date +%s)
+output="${output}/hayabusa_${timestamp}"
+echo "Output is going to: ${output}"
 
-hayabusa csv-timeline -p timesketch-verbose -r /opt/hayabusa/rules/ -w -m low -U -H "${output}".html -o "${output}.ts.csv" -C -d /data
-hayabusa json-timeline -p verbose -r /opt/hayabusa/rules/ -w -L -o "${output}_takajo.jsonl" -d /data
-takajo automagic -t "${output}_takajo.jsonl" -o "${outdir}/takajo"
+# Run hayabusa with the included rules
+/opt/hayabusa/hayabusa csv-timeline -p timesketch-verbose -r /opt/hayabusa/rules/ -w -m low -U -H "${output}.html" -o "${output}.ts.csv" -C -d /data
+/opt/hayabusa/hayabusa json-timeline -p verbose -r /opt/hayabusa/rules/ -w -L -o "${output}_takajo.jsonl" -d /data
+
+# Check if takajo exists before running it
+if [ -x /opt/hayabusa/takajo ]; then
+    /opt/hayabusa/takajo automagic -t "${output}_takajo.jsonl" -o "${outdir}/takajo"
+else
+    echo "[!] Takajo is not available on this platform."
+fi