CenturyLinkLabs/panamax-contest-templates — pull request #48 by strcrzy (2014-08-25 00:48:17+00:00)
Title: new template + examples: scope (bro/suricata, ELK), gitlab_scoped, wordpress_scoped

scope
=====
scope is a collection of containers containing a suite of network
security monitoring software, including:

- bro
- suricata
- elasticsearch, logstash, kibana
- initial logstash configs for suricata and bro

scope is a distribution of two containers: `sensor` and `sink`.
you can monitor whatever container(s) you like with it, and you can
mix other templates into this one by including its images and attaching
the appropriate sensors to the template's images as is done here with
`scoped`.

the `sensor` container has two flavors (tags): `suricata` and `bro`
each sensor should be run with the flags:

- `--volumes-from=sink`
- `--net=container:`
- `--privileged`*

(you can pass these with the custom docker run `command`)

(*) note that when panamax ships with docker 1.2.0, you will be able to drop the
`--privileged` argument to the sensor container, and pass the more granular
`--cap-add=NET_RAW --cap-add=NET_ADMIN` instead

bro and suricata are configured to log to a shared volume, `/sink`, which
the `sink` container consumes via logstash into elasticsearch.

the `sink` container exposes kibana on port 8080. it has two rudimentary custom
dashboards installed at `/#/dashboard/file/bro-basic.json` and for bro and
`/#/dashboard/file/suricata.json` for suricata.

you will have to map this port and expose it yourself.