DeepFal
2d76ed6672
- 特征检测（规则/签名）与行为检测（24h 统计）单进程运行 - 融合名单按首次发现时间倒序，展示位置/归属（GeoIP + ASN） - 钉钉融合推送（加签、24h 节流、去重） - 页面状态灯、CSV 导出、Docker 镜像构建文件
31 lines
868 B
Bash
Executable File
31 lines
868 B
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
DATA_DIR="${DATA_DIR:-/data}"
|
|
if [ ! -f "$DATA_DIR/ips.db" ]; then
|
|
echo "[init] 初始化数据目录: $DATA_DIR"
|
|
mkdir -p "$DATA_DIR"
|
|
cp -a /app/seed/. "$DATA_DIR"/
|
|
fi
|
|
|
|
set -- watch \
|
|
--stream "${GRAYLOG_STREAM:-F5_Accesslog}" \
|
|
--profile "${PROFILE:-/app/profiles/f5.json}" \
|
|
--interval "${CHECK_INTERVAL:-60}" \
|
|
--window "${WINDOW:-3600}" \
|
|
--forget "${FORGET:-604800}" \
|
|
--db "$DATA_DIR/ips.db" \
|
|
--host 0.0.0.0 \
|
|
--port "${APP_PORT:-8088}" \
|
|
--path-prefix "${APP_PATH_PREFIX:-}" \
|
|
--geo-db "$DATA_DIR/geo/geo.db" \
|
|
--asn-db "$DATA_DIR/geo/asn.db" \
|
|
--allow /app/allowlist.example.txt \
|
|
--export "$DATA_DIR/blocklist.txt" \
|
|
--behavior-interval "${BEHAVIOR_INTERVAL:-900}" \
|
|
--warm-limit "${WARM_LIMIT:-5}"
|
|
|
|
if [ "${NO_BEHAVIOR:-0}" = "1" ]; then
|
|
set -- "$@" --no-behavior
|
|
fi
|
|
exec python3 -m graylog_ops "$@"
|