This repository was archived by the owner on Apr 16, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 523
CapMe
Doug Burks edited this page Dec 16, 2017
·
12 revisions
CapME is a web interface that allows you to:
- view a pcap transcript rendered with tcpflow
- view a pcap transcript rendered with Bro (especially helpful for dealing with gzip encoding)
- download a pcap
You can pivot to CapME from a NIDS alert in Squert or from any log in ELSA that has timestamp, source IP, source port, destination IP, and destination port.
When prompted for username/password, simply enter your normal Sguil/Squert/ELSA username/password.
CapMe displays source IP address and destination IP address including their DNS lookups. You can disable these DNS lookups as shown here: https://github.com/Security-Onion-Solutions/security-onion/issues/905
- Introduction
- Use Cases
- Hardware Requirements
- Release Notes
- Download/Install
- Booting Issues
- After Installation
- UTC and Time Zones
- Services
- VirtualBox Walkthrough
- VMWare Walkthrough
- Videos
- Architecture
- Cheat Sheet
- Conference
- Elastic Stack
- Elastic Architecture
- Elasticsearch
- Logstash
- Kibana
- ElastAlert
- Curator
- FreqServer
- DomainStats
- Docker
- Redis
- Data Fields
- Beats
- Pre-Releases
- ELSA to Elastic
- Network Configuration
- Proxy Configuration
- Firewall/Hardening
- Email Configuration
- Integrating with other systems
- Changing IP Addresses
- NTP
- Managing Alerts
- Managing Rules
- Adding Local Rules
- Disabling Processes
- Filtering with BPF
- Adjusting PF_RING for traffic
- MySQL Tuning
- Adding a new disk
- High Performance Tuning
- Trimming PCAPs