https://trisul.org/devzone/ 2026-05-03T21:28:55+00:00 https://trisul.org/devzone/ https://trisul.org/devzone/risul.org/devzone/lib/tpl/dokuwiki/images/favicon.ico text/html 2025-03-18T19:00:34+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:accessing_dev_mem_for_host_from_lxc_container?rev=1742304634&do=diff Problem getting machineid on LXC/LXD container When you install Trisul packages like the probe or hub on a LXC/LXD linux container you might face an error where Trisul is unable to get the machineID of the container. The error could be something like the following ; when you try to get the machineID from the hub or probe node from the admin panel. text/html 2024-07-10T11:48:08+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:adding_logo?rev=1720592288&do=diff Adding Logo to UI This article explains how you can add logo to Trisul UI Precondition Please ensure the following steps are done before adding Logo to the Trisul User Interface. * The dimensions of the logo must be 200 x 90 or nearly equal to that. text/html 2020-03-31T19:06:22+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:alienvault_otx?rev=1585661782&do=diff AlienVault OTX Intel Checker This app helps with providing guidelines for installing the AlienVault OTX Intel-Checker App in Trisul Network Analytics. To check all artifacts in your network traffic against the threat IOCs found in AlientVault OTX and throw an alert in the UI. text/html 2020-10-12T13:44:20+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:automatic_restart?rev=1602490460&do=diff Automatic Webtrisul Restart This article provides instructions to set-up an automatic webtrisul restart everyday. This can be done using cron. Adding the Task to Cron * To set-up automatic webtrisuld restart, You can add a single line command to cron that will run according to the time specified. text/html 2024-11-06T13:25:56+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:bulkqstreamflow?rev=1730879756&do=diff Bulk Query ipdr_bulkquery.sh This script is included with the Trisul Hub IPDR package. The purpose of this script is to allow our IPDR Customers to enter hundreds of IPs at once. Without this it can be tedious to enter each IP separately into the IPDR Web Form. text/html 2024-05-21T12:13:43+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:centos_installation?rev=1716273823&do=diff Installing Trisul on CentOS This article helps you with installing Trisul Network Analytics in CentOS Operating System. The Trisul Network Analytics system consists of 3 Core and 3 Optional Plugin packages. Core packages These three packages are required. text/html 2020-03-26T18:32:48+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:cidr_flows?rev=1585227768&do=diff CIDR Flows Tagger This article helps you with providing steps to install CIDR FLow Tagger in Trisul Network Analytics. Create Automatic flow tags for all the network traffic with CIDR network tags and integrate them into the backend indices. Installing App text/html 2017-11-16T12:12:31+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:dockercentos74?rev=1510814551&do=diff Installing Docker on various platforms On RHEL 7.4 (eg on AWS) The version of Docker CE that works for us on RHEL7.4 is 17.03.02 Post login Step 1 is to add the Docker CE repo like so yum install -y yum-utils yum-config-manager --add-repo \ https://download.docker.com/linux/centos/docker-ce.repo yum makecache fast text/html 2020-05-26T14:51:57+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:docker_installation?rev=1590484917&do=diff Installing Trisul using Docker Image This article helps you with installing Trisul Network Analytics using Docker Image. 1. Run TrisulNSM on a capture interface Now you are ready to run TrisulNSM. Say you want to capture traffic from the port ens33 text/html 2020-03-24T19:01:58+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:firehol_checker?rev=1585056718&do=diff FireHOL Checker This article helps you with providing steps to install and run the FireHOL Checker App in Trisul Network Analytics. Create a high priority alert for block listed IPs(Level 1) and Low Level Priority alert for Malicious Ips(level 3),Shift to level 1 if significant data transfer occurs. text/html 2023-09-27T15:04:03+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:flowindextuning?rev=1695807243&do=diff Tuning flow index database The Trisul flow database is a high performance high throughput store specifically designed for Network Flow storage. The tuning parameters are controlled by the following section in trisulHubConfig.xml Trisul Hub Configuration file Flow database tuning parameters <DBParameters> <FlowStream> <MicroSecondTimestamps>true</MicroSecondTimestamps> <kFLOWS_PER_BLOCK></kFLOWS_PER_BLOCK> <kBLOOM_AGG_SIZE></kBLOOM_AGG_SIZE> <kBUMPX_AGG_… text/html 2021-01-08T17:58:53+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:index?rev=1610108933&do=diff Use cases Tech articles explaining how to use Trisul in various environments. To be read in conjunction with How to guides Articles Monitoring Palo Alto User-ID and App-ID attributes Explains how to setup Trisul to optimally utilize the User-ID and App-ID support from Palo Alto. Explains how to add these metrics, how to tag flows with these fields, query by these attributes, dashboards. text/html 2020-11-27T16:05:52+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:ingress-egress-netflow?rev=1606473352&do=diff Enabling Ingress and Egress Netflow - issues and valid use cases A packet belonging to a IP flow enters a device at an ingress interface and exits through an egress interface. Many routers today have an option to enable Netflow at the ingress interface or at the egress interface or at both. This technical note describes the issues with the options. text/html 2020-03-31T19:04:08+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:ioc_harvestor?rev=1585661648&do=diff IOC Harvestor This article helps with providing guidelines for installing the app IOC AHarvestor in Trisul Network Analytics. To create a single new Trisul Resource Group stream containing INTEL items harvested from various other streams. * This app creates a new Resource Stream called Intel Harvest with text/html 2020-03-26T18:11:30+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:ip2location_lite_geo_metrics?rev=1585226490&do=diff IP2Location LITE Geo Metrics This article helps with providing steps to install IP2 Location Geo App in Trisul Network Analytics. Create a Geo based metering in Trisul using the IP2Location LITE databases. This app processes the following CSV databases and provide data in UI. text/html 2024-08-02T18:34:10+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:ipdr?rev=1722603850&do=diff IPDR Scripts This page contains useful scripts for IPDR mode Bulk query Say you are handed 100s of IPs to search, this can get cumbersome via the UI. This script allows you to place the IPs in a file and uses tool_qstreamflow to produce the output. text/html 2025-01-02T14:11:26+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:jan2025hotfix?rev=1735807286&do=diff Hotfix Jan12025 Data Issue with Traffic Charts We discovered an issue with the traffic metrics code that prevented viewing of traffic charts for dates beyond Jan 1 2025. As you can guess this is a rather major issue for most users. A hotfix was made immediately available. text/html 2020-03-27T19:59:58+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:keyspace_explorer?rev=1585319398&do=diff KeySpace Explorer This article helps you with providing steps to install KeySpace Explorer app in Trisul Network Analytics. To View all the activities and volumes of all IPs within a particular IP range. Installation * You can install the app by logging in as admin and selecting text/html 2020-03-20T15:29:45+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:netflow_troubleshooting?rev=1584698385&do=diff Troubleshooting Netflow This article explains how you can troubleshoot the following problem. No data on the dashboard after enabling Netflow in Trisul Network Analytics. Precondition This configuration must have been already done in your network. text/html 2019-11-01T18:25:46+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:paloalto?rev=1572612946&do=diff Using Palo Alto User-ID and App-ID in Netflow analytics Palo Alto firewalls are capable of exporting two very useful pieces for information in its Netflow export. The User-ID and App-ID fields are added per-flow * User-ID : harvested from a number of mechanisms to map IP-Addresses to user names. The primary method is to interface with Microsoft Exchange / AD servers. text/html 2020-10-14T15:47:26+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:port_mirror_commands?rev=1602670646&do=diff Port Mirroring with iptables This article provides the steps for configuring Port Mirroring with suitable commands. Port Mirroring is used to send a copy of packet to destination which was received on the interface depending on the configuration. 1. Commands to mirror text/html 2021-01-08T17:59:22+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:solarwinds?rev=1610108962&do=diff notes text/html 2020-03-26T15:10:23+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:start?rev=1585215623&do=diff * FireHOL checker * CIDR Flow Tagger text/html 2020-09-28T17:22:51+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:suricata-eve-unixsocket?rev=1601293971&do=diff Suricata-EVE-Unixsocket This article provides instructions for installing Suricata-Eve-Unixsocket app in Trisul Network Analytics. The Suricata-Eve app allows you to integrate Suricata IDS alerts into Trisul metrics framework. Installation 1. Installing Suricata App text/html 2022-09-02T12:05:37+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:trisul_7_6.5?rev=1662100537&do=diff Trisul 7.0 If you are installing new Trisul 7.0 on the existing 6.5 PRODUCTION License machine it won't install and you will get the following error Please follow the instructions below to reinstall Trisul 6.5 Centos(el7) * rpm -e trisul-badfellas trisul-geo text/html 2024-05-21T12:17:15+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:trisul_installation?rev=1716274035&do=diff Trisul Installation This article provides guidelines to help installing Trisul Network Anayltics in your system. Trisul is a distributed monitoring system with a number of trisul-probe instances all reporting back to one or more trisul-hub. We first explain how you can install all components on a single box and then slowly expand to explore distributed installation. text/html 2024-05-21T12:12:31+00:00 Anonymous (anonymous@undisclosed.example.com) https://trisul.org/devzone/doku.php/tips:ubuntu_installation?rev=1716273751&do=diff Installing Trisul on Ubuntu This article helps you with installing Trisul Network Analytics in Ubuntu Operating System. The Trisul Network Analytics system consists of 3 Core and 3 Optional Plugin packages. Core packages These three packages are required.