- Requirements
- Configuring ee-outliers
- Running in interactive mode
- Running in daemon mode
- Customizing your Docker run parameters
- Running ee-outliers
- Additionnal Content
- Docker and Docker Compose to build and run ee-outliers
- Access to an Elasticsearch cluster
Using ee-outliers is basically a four-step process:
- Define the ee-outliers configuration file.
- Define your outlier detection use cases.
- Define the docker container and the ee-outliers parameters inside a Compose file
docker-compose.yml
. - Build an image and run ee-outliers with
docker-compose up
.
ee-outliers makes use of a single configuration file containing all required parameters such as connectivity with your Elasticsearch cluster, logging, etc.
A default configuration file with all required configuration sections and parameters, along with an explanation, can be
found in defaults/outliers.conf
. We recommend starting from this file when running
ee-outliers yourself.
A full description of all configuration parameters can be found here.
Each detection use case has to be defined in a separate .conf file.
We provided 4 examples of use cases available in the use_cases/examples repository. A detailed description of these use case examples, along with information on how you can create your owns can be found here.
The Compose file is located at docker-compose.yml
and should look like this:
version: '3'
services:
outliers:
build: .
container_name: your_outliers_container_name
command: "python3 outliers.py RUN_MODE --config /mappedvolumes/config/outliers.conf --use-cases /use_cases/*.conf"
volumes:
- ./defaults/outliers.conf:/mappedvolumes/config/outliers.conf
- ./use_cases/examples:/use_cases
network_mode: network_name
It allows you to define the docker container and the ee-outliers parameters for then build and run the ee-outliers image in one single command line. For more information about the Compose file, see the Compose file reference.
The main parameters of the Compose file are as follow:
-
container_name
: Your custom container name. -
command
: The command line that will executeoutliers.py
.The
--config
and--use-cases
argument require respectively the location of the configuration and the use cases file. Note that the--use-cases
argument can also contain wildcards, such as"/my/usecase/folder/*.conf"
.The
RUN_MODE
argument should be replaced by one of the 3 running modes:-
interactive
: In interactive mode, ee-outliers will run once and finish. This is the ideal run mode to use when testing ee-outliers straight from the command line. If you are testing ee-outliers for the first time, we are recommending to use it. -
daemon
: In daemon mode, ee-outliers will continuously run based on a cron schedule defined in the outliers configuration file. The following example from the default configuration file will run ee-outliers at 00:10 each night (standard cron format).[daemon] schedule=10 0 * * *
-
tests
: In test mode, ee-outliers will run all unit tests and finish, providing feedback on the test results. This mode, which is developer-oriented, is useful for developing and debugging purposes.
-
-
volumes
: The mapped volumes so that your configuration and use case files can be found. In this example, the default configuration file in/defaults
is mapped to/mappedvolumes/config
and the/use_cases/examples
is mapped to/use_cases
. -
network_mode
: The name of the docker network through which the Elasticsearch cluster is reachable.
Thanks to Docker Compose, we can build and run an image of ee-outliers with one single command line:
docker-compose up
To stop and remove the container use:
docker-compose down
For convenience, we recommend using Docker Compose but the user can also use Docker and specify the ee-outliers parameters straight from the command line.
To use Docker, after following Step 1 and Step 2, you can enter the following commands:
# Build the image
docker build -t "outliers-dev" .
# Run the image
docker run \
--network=network_name \
-v "$PWD/defaults:/mappedvolumes/config" \
-i outliers-dev:latest python3 outliers.py interactive \
--config /mappedvolumes/config/outliers.conf \
--use-cases "/my/usecase/folder/*.conf"
- TLS beaconing detection using ee-outliers and Elasticsearch
- Detecting suspicious child processes using ee-outliers and Elasticsearch