diff --git a/docs/usage/index.md b/docs/usage/index.md index 60b7133..5e167ec 100644 --- a/docs/usage/index.md +++ b/docs/usage/index.md @@ -11,15 +11,15 @@ As a workaround, you can [manually add and Always Trust](https://support.apple.c --- -The generated credentials are in the home directory of the user created at install: +The generated credentials are in the home directory of the user created at install:
-`~/KIBANA_CREDS.README` +`~/KIBANA_CREDS.README` ### Docket - `https://localhost/app/docket/` -Docket - web interface for pulling PCAP from the sensor (must be enabled in config) +Docket - web interface for pulling PCAP from the sensor (must be enabled in config)
-> localhost **or** IP of the management interface of the box +> localhost **or** IP of the management interface of the box ## Update Suricata Updating the IDS rules is paramount. @@ -36,7 +36,7 @@ Since the sensor is offline, we can't use `suricata-update` to download the rule From a system that has Internet access ``` -curl -OL https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz +curl -fsSLO https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz scp emerging.rules.tar.gz user@sensorIP: ``` Now connect to the sensors and update locally. @@ -53,44 +53,44 @@ rm -r rules emerging.rules.tar.gz ### Cluster Health Check to see that the ES cluster says it's green: ``` -curl -s localhost:9200/_cluster/health?pretty +curl -fsS localhost:9200/_cluster/health?pretty ``` ### Document Check See how many documents are in the indexes. The count should be non-zero: ``` -curl -s localhost:9200/_all/_count?pretty +curl -fsS localhost:9200/_all/_count?pretty ``` ### Testing with PCAP You can fire some traffic across the sensor at this point to see if it's collecting. This requires that you upload your own test PCAP to the box. PCAP is -typically huge, so if you don't have any just lying around, here's a quick test: +typically huge, so if you don't have any just lying around, here's a quick test: - Download a small test file from the folks who brought us `tcpreplay` -[here](http://tcpreplay.appneta.com/wiki/captures.html): +[here](http://tcpreplay.appneta.com/wiki/captures.html): ``` -curl -LO https://s3.amazonaws.com/tcpreplay-pcap-files/smallFlows.pcap +curl -fsSLO https://s3.amazonaws.com/tcpreplay-pcap-files/smallFlows.pcap ``` -- Replay the PCAP file across your _monitor interface_: +- Replay the PCAP file across your _monitor interface_: ``` -sudo tcpreplay -i [your-monitor-interface] /path/to/smallflow.pcap +sudo tcpreplay -i [your-monitor-interface] /path/to/smallflow.pcap ``` - After a few moments, the document count should go up. This can again be validated with: ``` -curl -s localhost:9200/_all/_count?pretty +curl -fsS localhost:9200/_all/_count?pretty ``` -- You should have plain text bro logs showing up in /data/bro/logs/current/: +- You should have plain text bro logs showing up in /data/bro/logs/current/: ``` -ls -ltr /data/bro/logs/current/ +ls -ltr /data/bro/logs/current/ ``` ## Rockctl -The basic service management functions are accomplished with: +The basic service management functions are accomplished with: `sudo rockctl status` - get the status of ROCK services