shomon - GitLite

KO | EN

gitlite — search

#javascript #llm #golang #machine-learning #linux #nodejs #macos #java #windows #awesome #kubernetes #vue #security #openai

shomon

(★ 130)

Shodan Monitoring integration for TheHive.

File Explorer

Download Latest Version (.zip)

- - build.yml
  - release.yml
- FUNDING.yml
- conf.go
- conf_test.go
- alert.png
- logo.png
- observable.png
- log.go
- producer.go
- shodan_stream.go
- shodan_webhook.go
- service.go
- service_stream_test.go
- models.go
- thehive.go
- thehive_test.go
.gitignore
.goreleaser.Dockerfile
.goreleaser.yaml
conf.yaml
docker-compose.yml
Dockerfile
go.mod
go.sum
LICENSE
main.go
README.md

# Installation Guide

1. Get the code

git clone https://github.com/kaansk/shomon

Downloads the entire project code from GitHub to your computer.

cd shomon

Moves into the project folder you just downloaded.

2. Docker

Easy Recommended

Prerequisites

Git Needed to download the project code from GitHub.
Docker Desktop Needed to build and run containers. Install it and keep it running in the background.

* `docker pull ghcr.io/kaansk/shomon`

Type this command into your terminal and run it.

* `docker pull kaansk/shomon`

Type this command into your terminal and run it.

✅ Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.

Pulled directly from this repo's README.

3. Go

Medium

Prerequisites

Git Needed to download the project code from GitHub.
Go The Go compiler and toolchain.

* `go build -ldflags="-s -w" .` could be used to customize compilation and produce smaller binary.

Compiles the Go program into an executable.

✅ If the build finishes without errors, it worked. If you used go run ., check the terminal output.

Pulled directly from this repo's README.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<p align="center">
  <img src="images/logo.png" />
</p>

<p align="center">
  <img src="https://goreportcard.com/badge/github.com/KaanSK/shomon" />
  <img src="https://img.shields.io/github/downloads/kaansk/shomon/total?color=%233ABE25&label=Release%20Downloads" />
  <img src="https://img.shields.io/docker/pulls/kaansk/shomon?color=%233ABE25&label=DockerHub%20Pulls" />
</p>

<p align="center">
ShoMon is a Shodan alert feeder for TheHive written in GoLang. With version 2.0, it is more powerful than ever!
</p>

# Functionalities
* Can be used as Webhook OR Stream listener
    * Webhook listener opens a restful API endpoint for Shodan to send alerts. This means you need to make this endpoint available to public net
    * Stream listener connects to Shodan and fetches/parses the alert stream
* Utilizes [shadowscatcher/shodan](https://github.com/shadowscatcher/shodan) (fantastic work) for Shodan interaction.
* Console logs are in JSON format and can be ingested by any other further log management tools
* CI/CD via Github Actions ensures that a proper Release with changelogs, artifacts, images on ghcr and dockerhub will be provided
* Provides a working [docker-compose file](docker-compose.yml) file for TheHive, dependencies
* Super fast and Super mini in size
* Complete code refactoring in v2.0 resulted in more modular, maintainable code
* Via conf file or environment variables alert specifics including tags, type, alert-template can be dynamically adjusted. See [config file](conf.yaml).
* Full banner can be included in Alert with direct link to Shodan Finding.

![Alert example](https://raw.githubusercontent.com/kaansk/shomon/master/images/alert.png)
* IP is added to observables

![Observable example](https://raw.githubusercontent.com/kaansk/shomon/master/images/observable.png)

# Usage
* Parameters should be provided via ```conf.yaml``` or environment variables. Please see [config file](conf.yaml) and [docker-compose file](docker-compose.yml)
* After conf or environment variables are set simply issue command:

`./shomon`

## Notes
* Alert reference is first 6 chars of md5("ip:port")
* Only 1 mod can be active at a time. Webhook and Stream listener can not be activated together.

# Setup & Compile Instructions
## Get latest compiled binary from releases
1. Check [Releases](https://github.com/KaanSK/shomon/releases/latest)  section.

## Compile from source code
1. Make sure that you have a working Golang workspace.
2. `go build .`
    * `go build -ldflags="-s -w" .` could be used to customize compilation and produce smaller binary.

## Using Public Container Registries
1. Thanks to new CI/CD integration, latest versions of built images are pushed to ghcr, DockerHub and can be utilized via:
    * `docker pull ghcr.io/kaansk/shomon`
    * `docker pull kaansk/shomon`

## Using [Dockerfile](Dockerfile)
1. Edit [config file](conf.yaml) or provide environment variables to commands bellow
2. `docker build -t shomon .`
3. `docker run -it shomon`

## Using [docker-compose file](docker-compose.yml)
1. Edit environment variables and configurations in [docker-compose file](docker-compose.yml)
2. `docker-compose run -d`

# Credits
* Logo Made via LogoMakr.com
* [shadowscatcher/shodan](https://github.com/shadowscatcher/shodan) 
* [Dockerfile Reference](https://www.cloudreach.com/en/resources/blog/cts-build-golang-dockerfiles/) 
* Release management with [GoReleaser](https://goreleaser.com)