Skip to content

Instantly share code, notes, and snippets.

@chapinb
Created February 15, 2020 12:40
Show Gist options
  • Save chapinb/128f5aef5e42e56149ecf1de98a9057e to your computer and use it in GitHub Desktop.
Save chapinb/128f5aef5e42e56149ecf1de98a9057e to your computer and use it in GitHub Desktop.
Script to pull honeypot PCAP data into Moloch
#!/bin/bash
## Please insert the appropriate User and IP address values
## You may also need to edit the path to where your PCAPs
## exist on the remote system
echo ===== Pulling remote pcap data
rsync -a <USER>@<IP>:/data/rdp.*.pcap* /data/pcap/
echo rsync exit code: $?
## This script is available at:
## https://github.com/piesecurity/docker-moloch/blob/master/scripts/moloch-parse-pcap-folder.sh
echo ===== Processing new pcaps
/data/moloch-parse-pcap-folder.sh
echo indexer exit code: $?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment