certunlp/intelmq repository overview

⁠IntelMQ

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol. It's a software developed by Enisa, you can find it in https://github.com/certtools/intelmq⁠

⁠What we do?

In CERTUNLP we just take the software from Enisa and dockerize it, spliting the configuration.

You can see source code in https://github.com/CERTUNLP/intelmq-docker⁠ and the Dockerfile in https://github.com/CERTUNLP/intelmq-docker/blob/master/intelmq/Dockerfile⁠

⁠How to use it?

You need to work with docker-compose to start both, intelmq and redis:

docker-compose.yml :

version: '2'
volumes:
  cert-intelmq-bots-output:
    driver: local
  cert-intelmq-bots:
    driver: local
services:
  redis:
    image: redis
    volumes:
    - ./redis:/usr/local/etc/redis/
    command:
    - redis-server
    - /usr/local/etc/redis/redis.conf
  intelmq:
    image: certunlp/intelmq:1.3
    environment:
      REDIS_SERVER: redis
      REPO_UPDATE: https://github.com/CERTUNLP/intelmq-bots.git
    volumes:
    - cert-intelmq-bots-output:/opt/intelmq/var/lib/bots/file-output/
    - cert-intelmq-bots:/opt/intelmq/etc
    links:
    - redis:redis
    ports:
        - 8081:80

This images need at least redis-server to work, so you need to tell wich is the redis server, for a initial use we suggest to use docker-composer.yml provider in github.com

• REDIS_SERVER: name_of_redis_server

The second option you need to pass is the intelmq-bots source repo to clone, for example:

• REPO_UPDATE: https://github.com/CERTUNLP/intelmq-bots.git⁠

⁠For a complete cofig file take a look to:

⁠Simplest: https://github.com/CERTUNLP/intelmq-docker/blob/master/docker-compose.yml⁠

⁠With grafana y elasticsearch: https://github.com/CERTUNLP/intelmq-docker/blob/master/docker-compose-eg.yml⁠

⁠MORE info

https://github.com/CERTUNLP/intelmq-docker/blob/master/README.md⁠