Sign inSign up

cossas/soarca

By cossas

•Updated 9 days ago

SOARCA Docker build

Image
Security
0

5.3K

cossas/soarca repository overview

Automate threat and incident response workflows with CACAO security playbooks

⁠Documentation

This page is a snapshot of our documentation, for the latest documentation we refer to our Github pages⁠.

⁠Software

SOARCA is a security orchestrator that can ingest, validate and execute CACAOv2 security playbooks. These playbooks and the triggers for their execution are consumed via a JSON API. SOARCA comes with native http(s), SSH and OpenC2 capabilities to interface with external tools and data resources. These native capabilities can be extended via a dedicated MQTT interface, allowing developers to compile additional integrations according their needs.

Development is ongoing. The current version solely supports machine and command line interfaces, but a graphical user interface will be added in the foreseeable future. Furthermore, its current capability to run CACAOv2 playbooks sequentially will evolve towards the ability to run multiple playbooks in parallel. Such further developments will be announced and published on the SOARCA repository on Github.

⁠Quick run

version: '3.7'
services:
  mongodb_container:
    image: mongo:latest
    container_name: mongo_soarca_stack
    environment:
      MONGO_INITDB_ROOT_USERNAME: "root"
      MONGO_INITDB_ROOT_PASSWORD: "rootpassword"
    networks:
      - db-net
    volumes:
      - type: volume
        source: mongodb_data_container
        target: /data/db

  mosquitto:
    image: eclipse-mosquitto
    container_name: mosquitto
    volumes:
      - type: volume
        source: mosquitto_config
        target: /mosquitto/config
      - type: volume
        source: mosquitto_data
        target: /mosquitto/data
      - type: volume
        source: mosquitto_log
        target: /mosquitto/log
    networks:
      - mqtt-net
    ports:
      - target: 1883
        published: 1883
        protocol: tcp
        mode: host
      - target: 9001
        published: 9001
        protocol: tcp
        mode: host

  soarca:
    image: cossas/soarca:latest
    container_name: soarca_server
    environment:
      PORT: 8080
      MONGODB_URI: "mongodb://mongodb_container:27017"
      DATABASE_NAME: "soarca"
      DB_USERNAME: "root"
      DB_PASSWORD: "rootpassword"
      PLAYBOOK_API_LOG_LEVEL: trace
      DATABASE: "true"
      LOG_GLOBAL_LEVEL: "info"
      LOG_MODE: "production"
      LOG_FILE_PATH: ""
      LOG_FORMAT: "json"
      ENABLE_FINS: true
      MQTT_BROKER: "mosquitto"
      MQTT_PORT: 1883
    networks:
      - db-net
      - mqtt-net
    ports:
      - 127.0.0.1:8080:8080
    depends_on:
      - mongodb_container
      - mosquitto

networks:
  db-net:
  mqtt-net:


volumes:
  mongodb_data_container:
  mosquitto_config:
    driver: local # Define the driver and options under the volume name
    driver_opts:
      type: none
      device: ./config
      o: bind
  mosquitto_data:
  mosquitto_log:

⁠Source Project

More information on the source of the project can be found here⁠.

Tag summary

Content type

Image

Digest

sha256:6010e36b6…

Size

25.5 MB

Last updated

9 days ago

docker pull cossas/soarca:development