A cross-platform tool for collecting security events information on Servers (Windows, Free-BSD, Ubuntu, Raspberry (Debian) and other Linux versions) for further processing and aggregating in dhound.io (Lightweight Intrusion Detection System for Internet facing systems).
Some additional information about dhound-agent configuration can be found here.
These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See deployment for notes on how to deploy the project on a live system.
What things you need to install the software and how to install them.
- install go v1.9.4 and higher - https://golang.org/doc/install
wget https://dl.google.com/go/go1.9.4.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.9.4.linux-amd64.tar.gz
- Set into ~/.profile
export PATH=$PATH:/usr/local/go/bin
export GOROOT=/usr/local/go
- Install dependencies on Linux
sudo apt-get install libpcap0.8-dev
- IDE: LiteIDE
Build options for LIteIDE (Build Confiration -> TARGETARGS):
-config-dir config -log-file dhound.log -verbose
For profiling use additional parameter (profile available by address http://localhost:5061/debug/pprof/)
-pprof :5061
- Configure iptables to track output traffic ip addresses Linux
iptables -I OUTPUT -m state -p tcp --state NEW --syn -j LOG --log-prefix "OUT TCP: " --log-level 4 -m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 1 --hashlimit-mode dstip --hashlimit-name dhoundtcpout --hashlimit-htable-expire 3600000 --hashlimit-htable-size 1000 -m comment --comment "dhound: Log OUT Tcp Connections to syslog"
Windows
Windows Defender Firewall with Advanced Security -> Properties -> Public Profile -> Customize... -> Log successfull connections = true
- Download go packages
go get gopkg.in/yaml.v2
go get gopkg.in/natefinch/lumberjack.v2
go get github.com/judwhite/go-svc/svc
go get github.com/google/gopacket
go get github.com/google/gopacket/layers
go get github.com/google/gopacket/pcap
go get golang.org/x/text/encoding
Build dhound-agent
cd <project>
go build
Linux
dhound-agent -config-dir config -verbose
Windows
dhound-agent -config-dir config -verbose
Version specified in 2 files:
- Makefile
- version.go
This project is licensed under the Apache 2.0 License - see the LICENSE.md file for details
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent