Good afternoon! I’m very grateful that this project exists.
I have one question:
I’ve been thinking about proposing an idea to you to add some features to the project. That is, if we could make this project even more interesting by transforming it into a system for protecting against targeted attacks (Anti-APT), it would monitor and mirror traffic using Packetbeat and display network logs in a separate data view, as well as collect telemetry from hosts using tools like osquery, etc. I think it would be interesting to implement such a system as an open-source alternative to paid systems.
I planned to implement this, but I’m having trouble with containers; I’ve already implemented it locally, but I’d like to automate the process for myself to save time. Could you help with the setup or integration into the Docker Compose code?
The task involves integrating or enabling Packetbeat and Osquery.
I’d like to view network traffic using Packetbeat in a separate index or data view.
But I’m having trouble integrating Packetbeat, its dashboards, and Osquery into the code and getting it to run.
How can this be implemented?
Thanks in advance.
Good afternoon! I’m very grateful that this project exists.
I have one question:
I’ve been thinking about proposing an idea to you to add some features to the project. That is, if we could make this project even more interesting by transforming it into a system for protecting against targeted attacks (Anti-APT), it would monitor and mirror traffic using Packetbeat and display network logs in a separate data view, as well as collect telemetry from hosts using tools like osquery, etc. I think it would be interesting to implement such a system as an open-source alternative to paid systems.
I planned to implement this, but I’m having trouble with containers; I’ve already implemented it locally, but I’d like to automate the process for myself to save time. Could you help with the setup or integration into the Docker Compose code?
The task involves integrating or enabling Packetbeat and Osquery.
I’d like to view network traffic using Packetbeat in a separate index or data view.
But I’m having trouble integrating Packetbeat, its dashboards, and Osquery into the code and getting it to run.
How can this be implemented?
Thanks in advance.