nickwallen

Follow these steps to create a vertical bar chart in Kibana.

• Click on Visualize
• Select a Search Source
• Use a New Search on the Bro Index
• Click X-Axis
• Choose 'Data Histogram'
• Click the 'Apply' Green Arrow

nickwallen

1

Launch "Quick Dev" then stop all sensors and topologies.

service monit stop
service elasticsearch stop
storm kill bro
storm kill snort

nickwallen

Number of Alerts by Host

{
  "profile": "alerts-by-host",
  "onlyif": "source.type == 'snort'",
  "foreach": "ip_src_addr",
  "init": {
    "alerts": "0"

nickwallen

Sensor Stubs

A service has been created to simulate the behavior of a sensor by sending canned telemetry data to a Kafka topic. These "Sensor Stubs" consume fewer resources than the actual sensor that they replace.

(Q) How do the sensor stubs work?

The stubs are installed with a set of canned data for each sensor type. A subset of this canned data is randomly selected and sent to the Kafka topic in batches. The timestamp of each message is updated to match current system time.

(Q) How do I configure the message rate?

nickwallen

===Private IPv4 address spaces

RFC1918 name	IP address range	number of addresses
24-bit block	10.0.0.0 - 10.255.255.255	16,777,216
20-bit block	172.16.0.0 - 172.31.255.255	1,048,576
16-bit block	192.168.0.0 - 192.168.255.255	65,536

nickwallen

• If you are testing in the "Quick Dev" environment, increase the number of slots available to at least 5. This can be done within Ambari by editing Storm's supervisor.slots.ports property.

supervisor.slots.ports = [6700, 6701, 6702, 6703, 6704]

• Alter the Profiler topology settings at config/profiler.properties to use a 1 minute period duration. This is not necessary, but is useful for the impatient.

profiler.period.duration=1
profiler.period.duration.units=MINUTES

nickwallen

TASK [metron-rpms : Copy Metron RPMs] ******************************************
changed: [node1] => (item=/Users/nallen/tmp/incubator-metron/metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-common-0.3.1-201703071322.noarch.rpm)
changed: [node1] => (item=/Users/nallen/tmp/incubator-metron/metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-data-management-0.3.1-201703071322.noarch.rpm)
changed: [node1] => (item=/Users/nallen/tmp/incubator-metron/metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-elasticsearch-0.3.1-201703071322.noarch.rpm)
changed: [node1] => (item=/Users/nallen/tmp/incubator-metron/metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-enrichment-0.3.1-201703071322.noarch.rpm)
changed: [node1] => (item=/Users/nallen/tmp/incubator-metron/metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-indexing-0.3.1-201703071322.noarch.rpm)
changed: [node1] => (item=/Users/nallen/tmp/incubator-metron/m

nickwallen

Cluster was up and running. Ansible had previously failed while waiting for the Ambari deployment to complete. Re-ran the script and ran into this issue.

TASK [ambari_gather_facts : Ask Ambari: zookeeper_tag] *************************
ok: [ec2-35-165-60-74.us-west-2.compute.amazonaws.com] => {"_content_encoding": "gzip", "changed": false, "content": "{\n  \"href\" : \"http://ec2-35-165-60-74.us-west-2.compute.amazonaws.com:8080/api/v1/clusters/metron/hosts/ec2-52-42-251-93.us-west-2.compute.amazonaws.com/host_components/ZOOKEEPER_SERVER\",\n  \"HostRoles\" : {\n    \"cluster_name\" : \"metron\",\n    \"component_name\" : \"ZOOKEEPER_SERVER\",\n    \"desired_stack_id\" : \"HDP-2.5\",\n    \"desired_state\" : \"STARTED\",\n    \"display_name\" : \"ZooKeeper Server\",\n    \"hdp_version\" : \"HDP-2.5.3.0-37\",\n    \"host_name\" : \"ec2-52-42-251-93.us-west-2.compute.amazonaws.com\",\n    \"maintenance_state\" : \"OFF\",\n    \"public_host_name\" : \"ec2-52-42-251-93.us-west-2.compute.amazonaws.com\",\n   

nickwallen

#
# kafka global settings
#
[kafka-global]

# Protocol used to communicate with brokers.
# Type: enum value { plaintext, ssl, sasl_plaintext, sasl_ssl }
#security.protocol = PLAINTEXT

# Initial list of brokers as a CSV list of broker host or host:port.

nickwallen

• THP
• DPDK
• Librdkafka
• Kafka
• Fastcapa
• Pycapa
• Replay
• Test Results
• Notes