So, I’m conducting a research for one of my classes at the university, and I’m wanting to use RockNSM to analyze traffic, use it to collect logs from Suricata and see what I can get out of it.
So, a bit of background:
- I created a segregated vLAN for my research in which I’m using my desktop as my VMware Workstation Server (Running on a desktop with 8 cores, 32 GB of RAM, 2 NICs (as required), and about 500 GB for my VMs)
- The secondary NIC, monitoring sensor, is a connection from my L3 Switch that is doing port mirroring
- I’m using RockNSM as one of my VMs, I made sure to section off 8 GB of RAM for it and 256 GB of storage
- I have a DNS and Domain Server setup, it has a hostname assigned for the machine
Now, to the brunt of my issue. I’m following the docs on the site, and I feel like the latest version of RockNSM isn’t doing what I think it should be doing.
For starters, when I use
sudo rock setup command, and I do the setup (delegating what NICs are what, setting a static IP for the management NIC, creating a hostname (which I did during the installation of the OS, but w/e, might as well make sure the configs have the hostname I want), doing online installation (is that fine? I do have net access), select the components and enabled services, and write the config.
What I’m noticing? The config.yml doesn’t seem to be updating? Or at least not in a way that I can understand if it is or not. What I’m saying is, when I compare the notes on the docs site (link to the exact portion of the documentation) and what I’m reading in /etc/rocknsm/config.yml, the syntax is different. For example, I don’t see anything about hostnames, monitor or management interface, fqdn, it looks totally different! This is after writing the config using the rock setup.
I’m going to keep this topic open for a bit, because I’ve already gone through a setup a week ago, and I just couldn’t get my filebeat working. But, we’ll get to that here in a bit. Let’s start with the config.yml. Is this normal?