assocrypt0n/oris-backend repository overview

⁠ORIS — Security Incident Response Tool

ORIS is a self-hosted, collaborative platform designed for cybersecurity teams (CERT, SOC, CSIRT). It enables you to efficiently manage security investigations, model attacks (Diamond Model, MITRE ATT&CK Kill Chain), and leverage STIX 2.1 native knowledge within a secure, isolated environment.

⁠🚀 Quick Start

ORIS relies on three main components:

• Frontend (assocrypt0n/oris-frontend): The innovative web user interface and PWA.
• Backend (assocrypt0n/oris-backend): The core REST API, fine-grained Role-Based Access Control (RBAC), and STIX engine.
• Database (arangodb:3.12): A powerful multi-model database (graph + document).

⁠1. The Docker Compose File

Create a docker-compose.yml file and copy the following content to easily deploy the entire stack:

services:
  arangodb:
    image: arangodb:3.12
    restart: unless-stopped
    ports:
      - "127.0.0.1:8529:8529" # Optional: ArangoDB Admin UI access
    environment:
      ARANGO_ROOT_PASSWORD: ${ARANGO_ROOT_PASSWORD}
    volumes:
      - oris_arangodata:/var/lib/arangodb3
      - oris_arangoapps:/var/lib/arangodb3-apps
    healthcheck:
      test: [ "CMD", "arangosh", "--server.endpoint", "tcp://127.0.0.1:8529", "--server.password", "${ARANGO_ROOT_PASSWORD}", "--javascript.execute-string", "db._version()" ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  backend:
    image: assocrypt0n/oris-backend:latest
    environment:
      - PORT=3001
      - NODE_ENV=production
      - ARANGO_URL=http://arangodb:8529
      - ARANGO_DB=oris
      - ARANGO_USER=root
      - ARANGO_PASSWORD=${ARANGO_ROOT_PASSWORD}
      - JWT_SECRET=${JWT_SECRET}
      - FRONTEND_URL=http://frontend:80
    volumes:
      - oris_uploads:/app/uploads
      - oris_backups:/app/data/backups
      - oris_avatars:/app/avatars
    depends_on:
      arangodb:
        condition: service_healthy
    healthcheck:
      test: [ "CMD", "node", "-e", "fetch('http://localhost:3001/api/health').then(r => { if (!r.ok) process.exit(1) }).catch(() => process.exit(1))" ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    restart: unless-stopped

  frontend:
    image: assocrypt0n/oris-frontend:latest
    ports:
      - "${ORIS_PORT:-3456}:80"
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped

volumes:
  oris_arangodata:
  oris_arangoapps:
  oris_uploads:
  oris_backups:
  oris_avatars:

⁠2. Environment Variables (.env)

In the same directory, create an .env file with the required credentials to secure your instance:

ORIS_PORT=3456
ARANGO_ROOT_PASSWORD=your_complex_arango_password
JWT_SECRET=your_very_long_and_random_jwt_secret

You can generate a randomly secure JWT_SECRET using this Linux/macOS command:

node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"

⁠3. Launch the Application

Run the following command to start the entire platform:

docker compose up -d

Navigate to http://localhost:3456⁠ in your browser. During your very first login, the ORIS initialization wizard will guide you to set up the platform, deploy the knowledge base, and create your administrator account.

⁠🛠 Data and Persistence

ORIS images are built to strictly operate with declared Docker volumes in order to preserve the integrity of your investigation data:

• oris_arangodata: Retains the platform configuration, structure, and all STIX 2.1 relational knowledge graphs.
• oris_uploads: Task attachments, case files, and secure exported reports.
• oris_avatars: User profile pictures.
• oris_backups: Complete archive zip files generated by the built-in backup orchestrator.

⁠🤝 Learn More

• License: AGPL-3.0
• Documentation & APIs: Interactive REST API documentation (Swagger) is directly embedded and accessible within your ORIS instance (from the API Docs menu).