trisulnsm/trisul6 repository overview

⁠Docker images for Trisul Network Analytics 6.5

This Docker Image contains a full blown NSM (Network Security Monitoring) system as well as deep Network Traffic Analytics.

The image includes the latest TrisulNSM 6.5⁠ in a single node configuration. The appliance contains a single Probe, a single Hub, and a Web Trisul. A fine tuned database is also included that is capable of handling very large networks (try it and see if you can overwhelm it).

The image includes Suricata IDS⁠ paired with Emerging Threats community rules updated via Oinkmaster. This supplies the IDS context to the system. Trisul provides everything else like 200+ Traffic Metrics, PCAP storage and recall, flow analysis, meta dataextraction and a programmable LUA API.

This is the easiest way to get rolling with Traffic+NSM for total visibility. The best part is the docker image packs into it a FREE Trisul License that lets you monitor a rolling 3-day window for ever. Upgrade to a any license to unlock the restriction.

⁠How to run ?

⁠1. Run : start capturing on eth0 and use /opt/trisuldata to store everything

Just get going !!

sudo docker run --name=trisul1a --net=host  \
  -v /opt/trisuldata:trisulroot \
    -d trisulnsm/trisul6  --interface eth0

⁠2. Login

Go to localhost:3000

Done!

For more details check out trisulnsm/docker@github⁠

There are other options to running the docker image. Please refer to the trisulnsm/docker GitHub page for more⁠