[{"_1":2,"_181":-5,"_182":-5},"loaderData",{"_3":4,"_18":19,"_26":27,"_160":161},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":22,"_24":11,"_25":22},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_28":29,"_30":-5,"_31":11,"_32":11,"_33":34,"_35":36,"_37":-5,"_38":11,"_39":40,"_89":90,"_109":110,"_148":-5,"_149":11,"_150":22,"_151":11,"_152":11,"_153":-5,"_154":11,"_155":-5,"_156":157,"_158":111,"_159":-7},"canonicalUrl","https://hub.docker.com/r/fuzzybunny/moloch/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","fuzzybunny","reponame","moloch","cloudBuildSource","isAutobuildsAvailable","repo",{"_41":42,"_43":44,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":56,"_58":36,"_33":34,"_59":60,"_61":45,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":63,"_70":71,"_72":11,"_73":34,"_74":75,"_80":11,"_81":82,"_86":34,"_87":88},"categories",[],"content_types",[45],"image","date_registered","2018-02-15T23:19:07.726558Z","description","Moloch image","is_private","last_updated","2018-02-16T00:49:44.679563Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[57],"application/vnd.docker.container.image.v1+json","name","pull_count",93,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","## moloch.compose.yml:\n\nversion: '2'\nservices:\n moloch-capture:\n image: \"moloch:bluefin\"\n restart: \"always\"\n network_mode: \"host\"\n restart: \"always\"\n volumes:\n - \"/data/moloch/pcap:/data/moloch/raw\"\n - \"/data/moloch/logs:/data/moloch/logs\"\n - \"/operator/dip/sensor/moloch/etc/config.ini:/data/moloch/etc/config.ini\"\n command: >\n /bin/bash -c \"groupmod -g1000 daemon; bin/moloch-capture -c etc/config.ini\"\n \n moloch-viewer:\n image: \"moloch:bluefin\"\n restart: \"always\"\n # Port-forwarding is not working, so host-network mode is being used\n # The viewer will be reachable on port 8005\n network_mode: \"host\"\n restart: \"always\"\n volumes:\n - \"/data/moloch/pcap:/data/moloch/raw\"\n - \"/data/moloch/logs:/data/moloch/logs\"\n - \"/operator/dip/sensor/moloch/etc/config.ini:/data/moloch/etc/config.ini\"\n command: >\n /bin/bash -c \"groupmod -g1000 daemon; cd viewer; ../bin/node viewer.js -c ../etc/config.ini\"\n\n## moloch.service:\n\n[Unit]\nDescription = CVAH Moloch Service Module\n\nWants = network.target\nRequires = docker.service\nPartOf = cvah.sensor.service \n\n[Service]\nType = simple\n\nExecStartPre = /sbin/iptables -I INPUT 1 -p tcp --dport 8005 -j ACCEPT\n\nExecStart = /usr/bin/docker-compose -p cvah -f /operator/dip/compose_files/cvah.moloch.compose.yml up\nExecStop = /usr/bin/docker-compose -p cvah -f /operator/dip/compose_files/cvah.moloch.compose.yml stop\nExecStop = /sbin/iptables -D INPUT -p tcp --dport 8005 -j ACCEPT\nExecStopPost = /usr/bin/docker-compose -p cvah -f /operator/dip/compose_files/cvah.moloch.compose.yml down\n\nRestart=always\nRestartSec=3\n\n[Install]\nWantedBy = multi-user.target\n\n## config.ini:\n\n# Latest settings documentation: https://github.com/aol/moloch/wiki/Settings\n#\n# Moloch uses a tiered system for configuration variables. This allows Moloch\n# to share one config file for many machines. The ordering of sections in this \n# file doesn't matter. \n#\n# Order of config variables:\n# 1st) [optional] The section titled with the node name is used first.\n# Moloch will always tag sessions with node:\n# 2nd) [optional] If a node has a nodeClass variable, the section titled with\n# the nodeClass name is used next. Sessions will be tagged with \n# node: which is useful if watching different \n# network classes.\n# 3rd) The section titled \"default\" is used last.\n\n[default]\n# Comma seperated list of elasticsearch host:port combinations. If not using a \n# elasticsearch VIP, a different elasticsearch node in the cluster can be specified \n# for each Moloch node to help spread load on high volume clusters\nelasticsearch=http://elastic_url:9200,http://elastic_url:9200\n\n# How often to create a new elasticsearch index. hourly,daily,weekly,monthly\n# Changing the value will cause previous sessions to be unreachable\nrotateIndex=daily\n\n# Cert file to use, comment out to use http instead\n# certFile=/data/moloch/etc/moloch.cert\n\n# File with trusted roots/certs. WARNING! this replaces default roots\n# Useful with self signed certs and can be set per node.\n# caTrustFile=/data/moloch/etc/roots.cert\n\n# Private key file to use, comment out to use http instead\n# keyFile=/data/moloch/etc/moloch.key\n\n# S2S and Password Hash secret - Must be in default section. Since elasticsearch\n# is wide open by default, we encrypt the stored password hashes with this\n# so a malicous person can't insert a working new account. It is also used\n# for secure S2S communication. Comment out for no user authentication.\n# Changing the value will make all previously stored passwords no longer work.\npasswordSecret = putapasswordhere\n\n# HTTP Digest Realm - Must be in default section. Changing the value\n# will make all previously stored passwords no longer work\nhttpRealm = Moloch\n\n# The base path for Moloch web access. Must end with a / or bad things will happen\n# Default: \"/\"\n# webBasePath = /moloch/\n\n# Semicolon ';' seperated list of interfaces to listen on for traffic\ninterface=ens1\n\n# The bpf filter\n#bpf=not port 9200\n\n# The yara file name\n#yara=\n\n## Start wiseService configuration\n# Host to connect to for wiseService\n#wiseHost=127.0.0.1\n\n# Number of seconds to cache results before asking wiseService again\n#wiseCacheSecs=600\n\n# Max number of items to store in the wise cache that is local to each moloch-capture node\n#wiseMaxCache=100000\n\n# Number of connections to wiseService, this is also the number of concurrent wise queries.\n#wiseMaxConns=10\n\n# Number of oustanding requests to the wiseService\n#wiseMaxRequests=100\n## End wiseService configuration\n\n# Uncomment to log access requests to a different log file\n#accessLogFile = /data/moloch/logs/access.log\n\n# The directory to save raw pcap files to\npcapDir = /data/moloch/raw\n\n# The max raw pcap file size in gigabytes, with a max value of 36G. \n# The disk should have room for at least 10*maxFileSizeG\nmaxFileSizeG = 12\n\n# The max time in minutes between rotating pcap files. Default is 0, which means\n# only rotate based on current file size and the maxFileSizeG variable\n#maxFileTimeM = 60\n\n# TCP timeout value. Moloch writes a session record after this many seconds \n# of inactivity.\ntcpTimeout = 600\n\n# Moloch writes a session record after this many seconds, no matter if \n# active or inactive\ntcpSaveTimeout = 720\n\n# UDP timeout value. Moloch assumes the UDP session is ended after this \n# many seconds of inactivity.\nudpTimeout = 30\n\n# ICMP timeout value. Moloch assumes the ICMP session is ended after this \n# many seconds of inactivity.\nicmpTimeout = 10\n\n# An aproximiate maximum number of active sessions Moloch/libnids will try \n# and monitor\nmaxStreams = 1000000\n\n# Moloch writes a session record after this many packets\nmaxPackets = 10000\n\n# Delete pcap files when free space is lower then this in gigabytes OR it can be \n# expressed as a percentage (ex: 5%). This does NOT delete the session records in \n# the database. It is recommended this value is between 5% and 10% of the disk. \n# Database deletes are done by the db.pl expire script\nfreeSpaceG = 5%\n\n# The port to listen on, by default 8005\nviewPort = 8005\n\n# The host/ip to listen on, by default 0.0.0.0 which is ALL\n#viewHost = localhost\n\n# By default the viewer process is https://hostname: for each node.\n#viewUrl = https://HOSTNAME:8005\n\n# Path of the maxmind geoip country file. Download free version from:\n# http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz\n#geoipFile = /data/moloch/etc/GeoIP.dat\n\n# Path of the maxmind geoip ASN file. Download free version from:\n# http://www.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz\n#geoipASNFile = /data/moloch/etc/GeoIPASNum.dat\n\n# Path of the rir assignments file\n# https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.csv\nrirFile = /data/moloch/etc/ipv4-address-space.csv\n\n# User to drop privileges to. The pcapDir must be writable by this user or group below\ndropUser=nobody\n\n# Group to drop privileges to. The pcapDir must be writable by this group or user above\ndropGroup=daemon\n\n# Semicolon ';' seperated list of tags which once capture sets for a session causes the\n# remaining pcap from being saved for the session. It is likely that the initial packets \n# WILL be saved for the session since tags usually aren't set until after several packets\n# Each tag can optionally be followed by a : which specifies how many total packets to save\n#dontSaveTags=\n\n# Header to use for determining the username to check in the database for instead of\n# using http digest. Use this if apache or something else is doing the auth. \n# Set viewHost to localhost or use iptables\n# Might need something like this in the httpd.conf\n# RewriteRule .* - [E=ENV_RU:%{REMOTE_USER}]\n# RequestHeader set MOLOCH_USER %{ENV_RU}e\n#userNameHeader=moloch_user\n\n# Should we parse extra smtp traffic info\nparseSMTP=true\n\n# Should we parse extra smb traffic info\nparseSMB=true\n\n# Should we parse HTTP QS Values\nparseQSValue=false\n\n# Semicolon ';' seperated list of SMTP Headers that have ips, need to have the terminating colon ':'\nsmtpIpHeaders=X-Originating-IP:;X-Barracuda-Apparent-Source-IP:\n\n# Semicolon ';' seperated list of directories to load parsers from\nparsersDir=/data/moloch/parsers\n\n# Semicolon ';' seperated list of directories to load plugins from\npluginsDir=/data/moloch/plugins\n\n# Semicolon ';' seperated list of plugins to load and the order to load in\n# plugins=tagger.so; netflow.so\n\n# Plugins to load as root, usually just readers\n#rootPlugins=reader-pfring; reader-daq.so\n\n# Semicolon ';' seperated list of viewer plugins to load and the order to load in\n# viewerPlugins=wise.js\n\n# NetFlowPlugin\n# Input device id, 0 by default\n#netflowSNMPInput=1\n# Outout device id, 0 by default\n#netflowSNMPOutput=2\n# Netflow version 1,5,7 supported, 7 by default\n#netflowVersion=1\n# Semicolon ';' seperated list of netflow destinations\n#netflowDestinations=localhost:9993\n\n# Specify the max number of indices we calculate spidata for.\n# ES will blow up if we allow the spiData to search too many indices.\nspiDataMaxIndices=3\n\n# Uncomment the following to allow direct uploads. This is experimental\n#uploadCommand=/data/moloch/bin/moloch-capture --copy -n {NODE} -r {TMPFILE} -c {CONFIG} {TAGS}\n\n# Title Template\n# _cluster_ = ES cluster name\n# _userId_ = logged in User Id\n# _userName_ = logged in User Name\n# _page_ = internal page name\n# _expression_ = current search expression if set, otherwise blank\n# _-expression_ = \" - \" + current search expression if set, otherwise blank, prior spaces removed\n# _view_ = current view if set, otherwise blank\n# _-view_ = \" - \" + current view if set, otherwise blank, prior spaces removed\n#titleTemplate=_cluster_ - _page_ _-view_ _-expression_\n\n# Number of threads processing packets\npacketThreads=2\n\n# ADVANCED - Semicolon ';' seperated list of files to load for config. Files are loaded\n# in order and can replace values set in this file or previous files.\n#includes=\n\n# ADVANCED - How is pcap written to disk\n# simple = use O_DIRECT if available, writes in pcapWriteSize chunks,\n# a file per packet thread.\npcapWriteMethod=simple\n\n# ADVANCED - Buffer size when writing pcap files. Should be a multiple of the raid 5 or xfs \n# stripe size. Defaults to 256k\npcapWriteSize = 262143\n\n# ADVANCED - value for pcap_set_buffer_size, may not be used depending on kernel etc\npcapBufferSize = 30000000\n\n# ADVANCED - Number of bytes to bulk index at a time\ndbBulkSize = 300000\n\n# ADVANCED - Number of seconds before we force a flush to ES\ndbFlushTimeout = 5\n\n# ADVANCED - Compress requests to ES, reduces ES bandwidth by ~80% at the cost\n# of increased CPU. MUST have \"http.compression: true\" in elasticsearch.yml file\ncompressES = false\n\n# ADVANCED - Max number of connections to elastic search\nmaxESConns = 30\n\n# ADVANCED - Max number of es requests outstanding in q\nmaxESRequests = 500\n\n# ADVANCED - Number of packets to ask libnids/libpcap to read per poll/spin\n# Increasing may hurt stats and ES performance\n# Decreasing may cause more dropped packets\npacketsPerPoll = 50000\n\n# ADVANCED - Moloch will try to compensate for SYN packet drops by swapping \n# the source and destination addresses when a SYN-acK packet was captured first.\n# Probably useful to set it false, when running Moloch in wild due to SYN floods.\nantiSynDrop = true\n\n# DEBUG - Write to stdout info every X packets.\n# Set to -1 to never log status\nlogEveryXPackets = 100000\n\n# DEBUG - Write to stdout unknown protocols\nlogUnknownProtocols = false\n\n# DEBUG - Write to stdout elastic search requests\nlogESRequests = true\n\n# DEBUG - Write to stdout file creation information\nlogFileCreation = true\n\n\n##############################################################################\n# Classes of nodes\n# Can override most default values, and create a tag call node:\n#[class1]\n#freeSpaceG = 10%\n\n##############################################################################\n# Nodes\n# Usually just use the hostname before the first dot as the node name\n# Can override most default values\n\n#[node1]\n#nodeClass = class1\n# Might use a different elasticsearch node\n#elasticsearch=elasticsearchhost1\n\n# Uncomment if this node should process the cron queries, only ONE node should process cron queries \n# cronQueries = true\n\n#[node2]\n#nodeClass = class2\n# Might use a different elasticsearch node\n#elasticsearch=elasticsearchhost2\n# Uses a different interface\n#interface = eno1\n\n##############################################################################\n# override-ips is a special section that overrides the MaxMind databases for\n# the fields set, but fields not set will still use MaxMind (example if you set\n# tags but not country it will use MaxMind for the country)\n# Spaces and capitalization is very important. \n# IP Can be a single IP or a CIDR\n# Up to 10 tags can be added\n# \n# ip=tag:TAGNAME1;tag:TAGNAME2;country:3LetterUpperCaseCountry;asn:ASN STRING\n#[override-ips]\n#10.1.0.0/16=tag:ny-office;country:USA;asn:AS0000 This is an ASN\n\n##############################################################################\n# It is now possible to define in the config file extra http/email headers\n# to index. They are accessed using the expression http. and \n# email. with optional .cnt expressions\n#\n# Possible config atributes for all headers\n# type: (string|integer|ip) = data type (default string)\n# count: = index count of items (default false)\n# unique: = only record unique items (default true)\n\n# headers-http-request is used to configure request headers to index\n#[headers-http-request]\n#referer=type:string;count:true;unique:true\n\n# headers-http-response is used to configure http response headers to index\n#[headers-http-response]\n#location=type:string;count:true\n\n# headers-email is used to configure email headers to index\n#[headers-email]\n#x-priority=type:integer\n\n\n##############################################################################\n# If you have multiple clusters and you want the ability to send sessions\n# from one cluster to another either manually or with the cron feature fill out\n# this section\n\n#[moloch-clusters]\n#forensics=url:https://viewer1.host.domain:8005;passwordSecret:password4moloch;name:Forensics Cluster\n#shortname2=url:http://viewer2.host.domain:8123;passwordSecret:password4moloch;name:Testing Cluster\n","has_starred","hub_user","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":22,"_84":11,"_85":11},"read","write","admin","user","storage_size",389738679,"orgData",{"_91":92,"_93":94,"_95":96,"_97":34,"_98":99,"_100":99,"_101":99,"_102":99,"_103":104,"_105":99,"_106":99,"_107":99,"_108":22},"id","d3f9edd0626e44ec9cbc74dac5d4d214","uuid","d3f9edd0-626e-44ec-9cbc-74dac5d4d214","type","organization","orgname","full_name","","location","company","profile_url","date_joined","2017-04-12T01:34:48.626942Z","gravatar_url","gravatar_email","badge","is_active","recentTags",[111],{"_112":45,"_113":114,"_115":116,"_91":117,"_118":119,"_51":136,"_137":114,"_138":139,"_140":57,"_58":141,"_142":143,"_144":127,"_145":136,"_146":67,"_147":22},"content_type","creator",1550957,"full_size",389737259,22376970,"images",[120],{"_121":122,"_123":124,"_125":99,"_126":127,"_128":129,"_130":131,"_132":99,"_133":-5,"_134":116,"_64":67,"_135":-5},"architecture","amd64","digest","sha256:7f06814edd0b73cca894d40c8623b3a3a48dee38e7df5c06b3dc629039b098c8","features","last_pulled","2026-10-20T20:47:14.306805944Z","last_pushed","2018-02-16T00:49:44Z","os","linux","os_features","os_version","size","variant","2018-02-16T00:49:43.728135Z","last_updater","last_updater_username","duckmanjbr","media_type","bluefin","repository",4102379,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_39":162,"_169":170,"_156":179,"_180":11},{"_41":163,"_43":164,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":165,"_58":36,"_33":34,"_59":60,"_61":45,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":63,"_70":71,"_72":11,"_73":34,"_74":166,"_80":11,"_81":168,"_86":34,"_87":88},[],[45],[57],{"_76":11,"_77":167},[79],{"_83":22,"_84":11,"_85":11},"tags",{"_171":65,"_172":-5,"_173":-5,"_174":175},"count","next","previous","results",[176],{"_112":45,"_113":114,"_115":116,"_91":117,"_118":177,"_51":136,"_137":114,"_138":139,"_140":57,"_58":141,"_142":143,"_144":127,"_145":136,"_146":67,"_147":22},[178],{"_121":122,"_123":124,"_125":99,"_126":127,"_128":129,"_130":131,"_132":99,"_133":-5,"_134":116,"_64":67,"_135":-5},[],"canDeleteTags","actionData","errors"]

fuzzybunny/moloch

Tags for fuzzybunny/moloch