stouch/monitor repository overview

⁠Asgard2 monitor

Monitor component of Asgard2, an adaptive and self-guarded honeypot. The monitor collects information from a target Docker container and makes it available, through Redis, to the decision engine.

Asgard2 is an instance of the ASGARD abstract model. An adaptive and self-guarded honeypot collects as much attack data as possible while preventing the attacker from deeply compromising the system. More details on the project page⁠.

⁠Images

⁠Requirements

• Linux host with Docker Engine and Docker Compose v2
• A Redis server (defined in the project's docker-compose.yml)
• Access to the Docker socket, so the monitor can query the target container

⁠Quick start

The images are designed to be run with Docker Compose. Configuration (target container name, Redis host and port, process monitor settings) is read from config.ini.

1. Clone the repository: https://github.com/sereysethy/monitor⁠
2. Follow the setup instructions⁠ to create the .env and docker-compose.yml files.
3. Start the monitors:

   docker compose up -d

See the full documentation⁠ for configuration options, the Redis keys and channels, and the optional terminate service.

⁠Security notes

• Access to the Docker socket is equivalent to root access on the host. Grant it only to the containers that need it.
• Saved process images may be malware. Never execute them, and analyze them only in an isolated environment.
• Keep Redis private: publish its port on the loopback interface only.

⁠License and source

GNU General Public License v3.0. Source code and issue tracker: https://github.com/sereysethy/monitor⁠