parsedmarc-dockerized

old Version für Rollback: elasticsearch:8.13.2 & kibana:8.13.2

currently 8.15.0 & 8.15.0

Setup:

1. Get basics together:

git clone https://github.com/Jokoclp/parsedmarc-dockerized.git /opt/parsedmarc-dockerized/
cd /opt/parsedmarc-dockerized/ && cp data/conf/parsedmarc/config.sample.ini data/conf/parsedmarc/config.ini

2. Next we change the parsedmarc config (see docs. You can set Test to True for testing purposes.)

nano data/conf/parsedmarc/config.ini

3. Add your geoipupdate credentials from your MaxMind account to allow the container to pull the databases. For update cycles of the databases, please see here.

nano data/conf/geoipupdate/geoipupdate.env

4. Change credentials for HTTP basic auth, e.g. this way (needs apache2-utils or httpd-tools):

htpasswd -c data/conf/nginx/htpasswd USERNAME

5. Finally, we start up the stack and wait:

docker-compose up -d

What's happening then?

1. First, containers of the stack are created and started. This might take a while, as several containers have dependencies on others being in a healthy state (meaning that its service must be fully started).
2. During the startup of the parsedmarc-init container, all required steps and preparations are being taken care of - like generating a self-signed certificate for the included nginx webserver.
3. Once the Kibana container - where you can view the dashboards - is started up, the corresponding parsedmarc dashboards are automatically imported into Kibana by the parsedmarc-init container.
4. After some while, when everything is up and running, you can then access Kibana and its dashboards under the shipped reverse proxy at https://HOST_IP (Make sure to use HTTPS!). There will be a warning due to the self-signed certificate. The default username/password for HTTP basic authentication is admin/admin. You should change this!

Credits

Built with awesome parsedmarc, Elasticsearch and Kibana, nginx, Docker and MaxMind GeoIP. Based on patschi's work.