{"action":"opened","issue":{"url":"https://api.github.com/repos/Open-Network-Insight/open-network-insight/issues/116","repository_url":"https://api.github.com/repos/Open-Network-Insight/open-network-insight","labels_url":"https://api.github.com/repos/Open-Network-Insight/open-network-insight/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/Open-Network-Insight/open-network-insight/issues/116/comments","events_url":"https://api.github.com/repos/Open-Network-Insight/open-network-insight/issues/116/events","html_url":"https://github.com/Open-Network-Insight/open-network-insight/issues/116","id":185953452,"number":116,"title":"Installation of Apache Spot on a testbed *Info needed*","user":{"login":"lighteternal","id":22905968,"avatar_url":"https://avatars.githubusercontent.com/u/22905968?v=3","gravatar_id":"","url":"https://api.github.com/users/lighteternal","html_url":"https://github.com/lighteternal","followers_url":"https://api.github.com/users/lighteternal/followers","following_url":"https://api.github.com/users/lighteternal/following{/other_user}","gists_url":"https://api.github.com/users/lighteternal/gists{/gist_id}","starred_url":"https://api.github.com/users/lighteternal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lighteternal/subscriptions","organizations_url":"https://api.github.com/users/lighteternal/orgs","repos_url":"https://api.github.com/users/lighteternal/repos","events_url":"https://api.github.com/users/lighteternal/events{/privacy}","received_events_url":"https://api.github.com/users/lighteternal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-28T15:32:55Z","updated_at":"2016-10-28T15:32:55Z","closed_at":null,"body":"Hi all, \r\nI'm a complete beginner to this, and I'd like some guidance, as I'm trying to test Apache Spot on a testbed, consisting of a small local network (3-5 clients + server). I would like to direct all the network flow to the edge node (ingest), followed by ML and OA procedures, as described in the documentation, in order to monitor the network activity.\r\n\r\nThen I'm planning to use one of the clients of the network as a threat generator by using a tool (probably metasploit) to transmit suspicious packets to the other clients and see if they are detected. If this is succesful, I 'm planning to create some triggers to activate specific countermeasures determined by the type of each threat.\r\n\r\nWhat I'm concerned about is the hardware requirements of each of the nodes, as I haven't found any relevant info. More specifically, I'm planning to pseudo-distribute the resources of one machine (i7-6core, 16gb ram, >1tb hdd and ssd) to deploy the \"Hybrid Hadoop\" configuration and create nodes as shown here:\r\nhttps://github.com/Open-Network-Insight/open-network-insight/wiki/Hybrid%20Hadoop\r\n\r\nSo **TLDR**: \r\n1. Is my perspective of pseudo-distributing one machine for the nodes a viable solution for this testbed?\r\n2. Are there any deployment examples of the Apache Spot solution, in small-scale testebeds at all?\r\n3. Is it possible to create \"hooks\" to each type of suspicious activity that will trigger custom countermeasures or alerts, (apart from those shown in the UI of course)?\r\n\r\nAny help would be appreciated!\r\nThank you for ur time."}}
{"actor":{"display_login":"lighteternal"}}