maxldwg/bicep-snort repository overview

⁠BICEP-snort-image

Snort docker image adapated for BICEP

The image holds every dependency necessary along with the necessary interface implemented, in order to work with the BICEP application

The main BICEP project is available here⁠
The official Snort repository can be found here⁠

⁠Usage

If you want to use the resulting image with the BICEP framework, keep in mind that in its current version, the Snort container will need a config that outputs alerts to /opt/logs/alerts_and_anomalies.json. If you do not log to this location, the analysis willnot work properly. A feature for including a whole use selected directory is planned.

⁠Initialize project

In order to be able to start the project you will need to initialize it first. Do this by running:

git submodule update --init --recursive

This fetches the newest version of the submodule for the backend code and is necessary for the application to work seamlessly.

⁠Building the project

To build a local version of the image for testing purposes, simply run:

cd ./bicep-snort
docker buildx build . --build-arg BASE_IMAGE=maxldwg/snort --build-arg VERSION=3.7.4.0 -t maxldwg/bicep-snort:latest --no-cache

Change the version to your desried one