Tools Docker Container

cross-platform-container.md

Blue Team Toolkit — Docker Container Prompt

Paste this prompt into Claude to generate a cross-platform Docker container with your favorite security analysis tools.

---

The Prompt

Build me a cross-platform Docker container (amd64 + arm64) called "blue-toolkit" that bundles the following security analyst tools. Use a multi-stage build to keep the final image lean. Base it on Ubuntu 24.04.

### Tools to include:

**Windows Event Log Analysis:**
- Hayabusa (latest release from GitHub — pick the right linux binary per arch)
- Chainsaw (latest release from GitHub — pick the right linux binary per arch)
- Include their bundled rule sets

**Network Analysis:**
- tshark / wireshark CLI
- tcpdump
- nmap
- ngrep

**Malware / File Analysis:**
- yara (build from source with OpenSSL + magic modules)
- capa (Mandiant — latest GitHub release binary)
- floss (Mandiant — latest GitHub release binary)

**Memory Forensics:**
- volatility3 (pip install)

**Reverse Engineering:**
- radare2 (build from source for full plugin support)

**Log / Data Wrangling:**
- jq
- sigma-cli (pip install, include splunk backend)
- csvkit

**Detection Engineering:**
- python3 + pip
- git (for cloning rule repos)

**General Utilities:**
- curl, wget, unzip, file, strings, xxd, less, vim-tiny

### Requirements:
1. Multi-stage build: use a "builder" stage for compiling, copy only binaries/libs to final stage
2. Use TARGETARCH so `docker buildx` handles amd64/arm64 automatically
3. Pin tool versions in ENV vars at the top for easy updates
4. Add a /cases mount point for working with evidence files
5. Add a /rules mount point and pre-populate it with Hayabusa + Chainsaw rules
6. Set WORKDIR to /cases
7. Add a simple entrypoint script that prints installed tool versions when you run the container with no arguments
8. Add health checks that verify the key binaries exist

After generating the Dockerfile, also give me:
- The `docker buildx` commands to build for both platforms
- A test script that builds the container, runs it, and verifies every tool is functional (not just present — actually run each tool with a basic command like --version or --help and check exit codes)
- Keep the test script POSIX-compatible so it runs on both macOS and Linux

---

Build Commands (what Claude should generate)

# Create builder (one time)
docker buildx create --name blue-toolkit-builder --use

# Build for both platforms and load locally (single platform)
docker buildx build --platform linux/amd64 -t blue-toolkit:latest --load .

# Build and push multi-arch to a registry
docker buildx build --platform linux/amd64,linux/arm64 -t yourregistry/blue-toolkit:latest --push .

Run Examples

# Interactive shell with evidence mounted
docker run -it --rm -v $(pwd)/evidence:/cases -v $(pwd)/rules:/rules blue-toolkit

# Quick hayabusa scan
docker run --rm -v $(pwd)/evtx-files:/cases blue-toolkit hayabusa csv-timeline -d /cases -o /cases/timeline.csv

# Quick chainsaw hunt
docker run --rm -v $(pwd)/evtx-files:/cases blue-toolkit chainsaw hunt /cases -s /rules/chainsaw/sigma --mapping /rules/chainsaw/mappings/sigma.yml

# Run capa on a suspicious binary
docker run --rm -v $(pwd)/samples:/cases blue-toolkit capa /cases/suspect.exe

# Yara scan
docker run --rm -v $(pwd)/samples:/cases -v $(pwd)/rules:/rules blue-toolkit yara /rules/my-rules.yar /cases/

# Volatility3 memory analysis
docker run --rm -v $(pwd)/memory:/cases blue-toolkit vol -f /cases/memdump.raw windows.pslist