Awesome

ELKFH (Elastic, Logstash, Kibana, Filebeat and Honeypot) system for monitoring security tools that interact with (HTTP, HTTPS, SSH, RDP, VNC, Redis, MySQL, MONGO, SMB, LDAP)

Kibana Interface

General Features

Logs are accessible via Kibana
All services running in one container using supervisord
Ingress sniffer, layers and packet parser

Install and run

On Ubuntu 18 or 19 System (Auto-configure)

git clone https://github.com/qeeqbox/seahorse.git
cd seahorse
chmod +x ./run.sh
./run.sh auto_configure

Wait ~2-10 mins until the web browser opens up (until seahorse_initializer_1 exit with 0) - username is elastic and password is changeme

Current Servers

HTTP (Apache)
HTTPS (Apache)
SSH (Custom OpenSSH)
FTP (vsftpd)
SMB (samba)
ldap (slapd)
VNC (tightvncserver)
RDP (xrdp)
Redis (redis-server)
Mysql (mysql-community-server)

Changes

2020.V.01.01

Roadmap

Add more services

Resources

elastic, scapy

Other Licenses

By using this framework, you are accepting the license terms of all these packages: elasticsearch, logstash, kibana, filebeat, openbsd, openbsd, Zlib, build-essential, libssl-dev, lsof, supervisord, rsyslog, openldap, mysql, redis, mongodb, Samba, Vsftpd, db-util, tvnserver, xrdp, apache, iptables, tcpdump, nmap, iputils-ping, python, Pip, psycopg, psmisc, dnsutils, python-ldap, FreeRDP, net-tools, sshpass, paramiko, connector-python, mongo-python-driver, pysmb, vncdotool, requests, cryptography

Disclaimer\Notes

Do not deploy without proper configuration
Setup some security group rules and remove default credentials
Please let me know if i missed a resource or dependency