Networking

elasticsearch:8.13.1 is the latest version working and tested. version: '3.7' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:8.13.1 # Replace with the latest version if needed container_name: elasticsearch environment: - discovery.type=single-node - ES_JAVA_OPTS=-Xms512m -Xmx512m # Adjust JVM heap size as needed - bootstrap.memory_lock=true - xpack.security.enabled=true # Enable security - ELASTIC_USERNAME=elastic # Set the username for the 'elastic' user - ELASTIC_PASSWORD=YourSecurePasswordHere # Set the password for the 'elastic' user ulimits: memlock: soft: -1 hard: -1 volumes: - es_data:/usr/share/elasticsearch/data ports: - "9200:9200" - "9300:9300" networks: - es_network volumes: es_data: driver: local networks: es_network: driver: bridge Do the initial configuration of Zenarmor Database settings -> Use a Remote Elasticsearch Database Provide the http://hostname:9200 where the docker is running and user / pass specified in the compose config file

After installing Zenarmor on OPNsense I saw that due to the nature of the netmap driver I am not able to run Suricata and Zenarmor both on the LAN interfaces. This was somewhat a downside as I already had some nmap rules configured and ET Telemetry in Suricata. I my scenario I have all the physical interfaces bridged. Suricata detects that bridge interface and I was able to add it. Zenarmor does not see that interface and only sees the physical ones. I added all the physical LAN interfaces in Zenarmor and the BRIDGE in Suricata. ...