Skip to content

curl: use -fsS ops consistently #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

curl: use -fsS ops consistently #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions docs/usage/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,15 @@ As a workaround, you can [manually add and Always Trust](https://support.apple.c

---

The generated credentials are in the home directory of the user created at install:
The generated credentials are in the home directory of the user created at install:
<br>
`~/KIBANA_CREDS.README`
`~/KIBANA_CREDS.README`

### Docket - `https://localhost/app/docket/`

Docket - web interface for pulling PCAP from the sensor (must be enabled in config)
Docket - web interface for pulling PCAP from the sensor (must be enabled in config)
<br>
> localhost **or** IP of the management interface of the box
> localhost **or** IP of the management interface of the box

## Update Suricata
Updating the IDS rules is paramount.
Expand All @@ -36,7 +36,7 @@ Since the sensor is offline, we can't use `suricata-update` to download the rule

From a system that has Internet access
```
curl -OL https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
curl -fsSLO https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
scp emerging.rules.tar.gz user@sensorIP:
```
Now connect to the sensors and update locally.
Expand All @@ -53,44 +53,44 @@ rm -r rules emerging.rules.tar.gz
### Cluster Health
Check to see that the ES cluster says it's green:
```
curl -s localhost:9200/_cluster/health?pretty
curl -fsS localhost:9200/_cluster/health?pretty
```

### Document Check
See how many documents are in the indexes. The count should be non-zero:
```
curl -s localhost:9200/_all/_count?pretty
curl -fsS localhost:9200/_all/_count?pretty
```

### Testing with PCAP
You can fire some traffic across the sensor at this point to see if it's
collecting. This requires that you upload your own test PCAP to the box. PCAP is
typically huge, so if you don't have any just lying around, here's a quick test:
typically huge, so if you don't have any just lying around, here's a quick test:

- Download a small test file from the folks who brought us `tcpreplay`
[here](http://tcpreplay.appneta.com/wiki/captures.html):
[here](http://tcpreplay.appneta.com/wiki/captures.html):
```
curl -LO https://s3.amazonaws.com/tcpreplay-pcap-files/smallFlows.pcap
curl -fsSLO https://s3.amazonaws.com/tcpreplay-pcap-files/smallFlows.pcap
```
- Replay the PCAP file across your _monitor interface_:
- Replay the PCAP file across your _monitor interface_:
```
sudo tcpreplay -i [your-monitor-interface] /path/to/smallflow.pcap
sudo tcpreplay -i [your-monitor-interface] /path/to/smallflow.pcap
```

- After a few moments, the document count should go up. This can again be
validated with:
```
curl -s localhost:9200/_all/_count?pretty
curl -fsS localhost:9200/_all/_count?pretty
```
- You should have plain text bro logs showing up in /data/bro/logs/current/:
- You should have plain text bro logs showing up in /data/bro/logs/current/:
```
ls -ltr /data/bro/logs/current/
ls -ltr /data/bro/logs/current/
```


## Rockctl

The basic service management functions are accomplished with:
The basic service management functions are accomplished with:

`sudo rockctl status` - get the status of ROCK services

Expand Down