thecyberghost/decider repository overview

⁠Decider

Decider is a web application built by CISA that assists network defenders, analysts, and researchers in the process of mapping adversary behaviors to the MITRE ATT&CK® framework.

This docker image is not built or maintained by the official Decider GitHub Project⁠. I created this image from the project's Dockerfile and uploaded it for easier access. Some modifications were performed to eliminate the need to copy over the default_config folder.

⁠Supported Tags

• latest
• v.3.0.0

This project does not support autobuilds of new Decider releases.

⁠Using The Image

1. Create the docker-compose.yml file:

   name: decider
   services:
     web:
       restart: unless-stopped
       container_name: decider-web
       env_file: .env
       depends_on:
         db:
           condition: service_healthy
       image: thecyberghost/decider
       ports:
         - "${WEB_IP}:${WEB_PORT}:5000"
       environment:
         # decider config
         KIOSK_MODE: "yes"
         # db to [connect to, build]
         DB_HOSTNAME: ${DB_HOSTNAME}
         DB_PORT: ${DB_PORT}
         DB_DATABASE: ${DB_DATABASE}
         # db admin user [for building db]
         DB_ADMIN_NAME: ${DB_ADMIN_NAME}
         DB_ADMIN_PASS: ${DB_ADMIN_PASS}
         # db kiosk user [run app under]
         DB_KIOSK_NAME: ${DB_KIOSK_NAME}
         DB_KIOSK_PASS: ${DB_KIOSK_PASS}
         # app admin [create]
         APP_ADMIN_EMAIL: ${APP_ADMIN_EMAIL}
         APP_ADMIN_PASS: ${APP_ADMIN_PASS}
         # cart encryption key
         CART_ENC_KEY: ${CART_ENC_KEY}
         # app endpoint [to display to user]
         WEB_IP: ${WEB_IP}
         WEB_PORT: ${WEB_PORT}
     db:
       restart: unless-stopped
       container_name: decider-db
       env_file: .env
       image: postgres:16-alpine
       environment:
         POSTGRES_INITDB_ARGS: "--auth=scram-sha-256"
         POSTGRES_HOST_AUTH_METHOD: "scram-sha-256"
         POSTGRES_USER: ${DB_ADMIN_NAME}
         PGUSER: ${DB_ADMIN_NAME}
         POSTGRES_PASSWORD: ${DB_ADMIN_PASS}
         POSTGRES_DB: ${DB_DATABASE}
       healthcheck:
         test: ["CMD-SHELL", "pg_isready -U ${DB_ADMIN_NAME} -d ${DB_DATABASE}"]
         interval: 4s
         timeout: 2s
         retries: 8
       volumes:
         - db_data:/var/lib/postgresql/data
   
   volumes:
     db_data:
   

   Copy

2. Create a .env file:

   The DB_ADMINPASS, DB_KIOSK_PASS, CART_ENC_KEY, and APP_ADMIN_PASS must be set. The original .env.docker example in the project leaves them empty, but I have included placeholders. It is strongly encouraged to use more robust passwords if you are hosting this outside a local development environment.

   # DATABASE ---------------------------------------------------------------------
   
   # db to create and use
   DB_DATABASE=decider
   
   # admin (full-access, used in db scripts / normal modes)
   DB_ADMIN_NAME=decideradmin
   DB_ADMIN_PASS=ASecurePassword
   
   # kiosk (limited read-only, used in kiosk mode)
   DB_KIOSK_NAME=deciderkiosk
   DB_KIOSK_PASS=AnotherSecurePasswod
   
   # cart encryption key
   CART_ENC_KEY=AndAStrongEncryptionKey
   
   # WEB-APP ----------------------------------------------------------------------
   
   # app admin login
   [email protected]
   APP_ADMIN_PASS=StrongAdminPassword
   
   # connect to this db (uses DB_DATABASE) (do not edit if using Docker)
   DB_HOSTNAME=db
   DB_PORT=5432
   
   # only for Docker deployment - not manual (host on http(s)://WEB_IP:WEB_PORT/, WEB_HTTPS_ON='yes' for HTTPS)
   WEB_IP=127.0.0.1
   WEB_PORT=8001
   WEB_HTTPS_ON=''
   

   Copy

3. Run with docker compose up -d

4. Access Decider at the URL you specified. (default: http://127.0.0.1:8001)

⁠Dockerfile

The modified Dockerfile used to build this image:

FROM python:3.12-bullseye

# install dir
WORKDIR /opt/decider

# local config
RUN mkdir config

# make non-root app user
RUN adduser --no-create-home --system --shell /bin/false decider && \
    usermod --lock decider && \
    groupadd decider && \
    usermod -aG decider decider

# for CRLF -> LF
RUN apt-get update && \
    apt-get install dos2unix=7.4.1-1 && \
    apt-get install -y rsync=3.2.3-4+deb11u1 && \
    apt-get clean

# setup venv
COPY ["./requirements-pre.txt", "./requirements.txt", "./"]
RUN python3 -m venv venv && \
    . ./venv/bin/activate && \
    pip install --no-cache-dir -r requirements-pre.txt && \
    pip install --no-cache-dir -r requirements.txt

# app files
COPY ["./app", "./app"]
COPY ["./decider.py", "./docker/web/root_files/*", "./"]

# config files
COPY ["./default_config", "/opt/decider/ro_config"]

# compress static js/css/etc
RUN find app/static/ -type f -not -name "*.gz" -exec gzip -9fk {} +

# perform CRLF -> LF
RUN dos2unix entrypoint.sh

# own app files + run (uWSGI drops up)
RUN chown -R decider:decider .
ENTRYPOINT ["/bin/sh", "entrypoint.sh"]