Complete local research platform and deployment workflows

.dockerignore

@@ -0,0 +1,14 @@
+.git
+.venv
+.env
+.env.*
+!.env.example
+**/__pycache__
+**/.pytest_cache
+**/*.pyc
+models
+work
+datasets
+services/correlation-engine/experiments*
+services/correlation-engine/data
+**/tests

.env.example

@@ -1,240 +1,10 @@
-# ============================================================================
-# AI-SOC Environment Configuration Template
-# ============================================================================
-# IMPORTANT: Copy this file to .env and replace placeholder values
-# NEVER commit .env to version control (already in .gitignore)
-#
-# Quick Setup:
-#   cp .env.example .env
-#   # Edit .env with your secure passwords
-#   # On Linux: openssl rand -base64 32
-#   # On Windows: [System.Convert]::ToBase64String((1..32|%{Get-Random -Max 256}))
-# ============================================================================
-
-# ============================================================================
-# WAZUH CONFIGURATION
-# ============================================================================
-# Wazuh Indexer (OpenSearch) Credentials
-INDEXER_USERNAME=admin
-INDEXER_PASSWORD=CHANGE_ME_SecurePassword123!
-
-# Wazuh API Credentials
-API_USERNAME=wazuh-wui
-API_PASSWORD=CHANGE_ME_SecurePassword456!
-
-# ============================================================================
-# NETWORK CONFIGURATION
-# ============================================================================
-# Network Interface for Packet Capture (Suricata/Zeek)
-# Linux: eth0, ens33, etc. | Windows: Use adapter name from 'ipconfig'
-MONITOR_INTERFACE=eth0
-
-# Docker Network Subnets (avoid conflicts with existing networks)
-BACKEND_SUBNET=172.20.0.0/24
-FRONTEND_SUBNET=172.21.0.0/24
-DEV_BACKEND_SUBNET=172.22.0.0/24
-DEV_FRONTEND_SUBNET=172.23.0.0/24
-
-# ============================================================================
-# POSTGRESQL CONFIGURATION
-# ============================================================================
-# Database credentials for metadata storage
-POSTGRES_USER=aisoc
-POSTGRES_PASSWORD=CHANGE_ME_PostgresPassword789!
-POSTGRES_DB=aisoc_metadata
-POSTGRES_PORT=5432
-
-# PostgreSQL Performance Tuning (adjust based on available RAM)
-# Default settings assume 8GB RAM available for PostgreSQL
-# For 16GB+ systems, increase shared_buffers to 4GB and effective_cache_size to 12GB
-
-# ============================================================================
-# REDIS CONFIGURATION
-# ============================================================================
-# Redis cache credentials
-REDIS_PASSWORD=CHANGE_ME_RedisPassword012!
-REDIS_PORT=6379
-
-# Redis memory limit (MB) - adjust based on available RAM
-REDIS_MAX_MEMORY=512
-
-# ============================================================================
-# JUPYTER LAB CONFIGURATION
-# ============================================================================
-# Jupyter authentication token (generate with: openssl rand -hex 32)
-JUPYTER_TOKEN=CHANGE_ME_JupyterToken345678901234567890ab
-JUPYTER_USER=jovyan
-JUPYTER_PORT=8888
-
-# ============================================================================
-# PORTAINER CONFIGURATION
-# ============================================================================
-# Portainer admin password (bcrypt hash or plain text)
-# Generate hash: htpasswd -nb -B admin your_password | cut -d ":" -f 2
-# Or use plain text and Portainer will hash on first run
-PORTAINER_ADMIN_PASSWORD=CHANGE_ME_PortainerPassword678!
-PORTAINER_HTTP_PORT=9000
-PORTAINER_HTTPS_PORT=9443
-
-# ============================================================================
-# SOAR / MINIO CONFIGURATION
-# ============================================================================
-# MinIO S3-compatible storage (used by TheHive for artifact storage)
-MINIO_ROOT_USER=minioadmin
-MINIO_ROOT_PASSWORD=CHANGE_ME_MinioPassword567!
-
-# ============================================================================
-# OPTIONAL SERVICES CONFIGURATION
-# ============================================================================
-# Adminer (PostgreSQL Web UI)
-ADMINER_PORT=8080
-
-# Redis Commander (Redis Web UI)
-REDIS_COMMANDER_PORT=8081
-REDIS_COMMANDER_USER=admin
-REDIS_COMMANDER_PASSWORD=CHANGE_ME_RedisCommanderPass901!
-
-# ============================================================================
-# RESOURCE LIMITS
-# ============================================================================
-# CPU and memory limits for Docker containers
-# Adjust based on total system resources
-# Minimum system: 16GB RAM, 4 CPU cores
-# Recommended system: 32GB RAM, 8 CPU cores
-
-# Wazuh Indexer (OpenSearch)
-INDEXER_MEMORY_MIN=2g
-INDEXER_MEMORY_MAX=4g
-INDEXER_CPU_LIMIT=2.0
-
-# Wazuh Manager
-MANAGER_MEMORY_MIN=2g
-MANAGER_MEMORY_MAX=4g
-MANAGER_CPU_LIMIT=2.0
-
-# Wazuh Dashboard
-DASHBOARD_MEMORY_MIN=1g
-DASHBOARD_MEMORY_MAX=2g
-DASHBOARD_CPU_LIMIT=1.0
-
-# Suricata
-SURICATA_MEMORY_MIN=2g
-SURICATA_MEMORY_MAX=4g
-SURICATA_CPU_LIMIT=2.0
-
-# Zeek
-ZEEK_MEMORY_MIN=2g
-ZEEK_MEMORY_MAX=4g
-ZEEK_CPU_LIMIT=2.0
-
-# ============================================================================
-# SSL/TLS CONFIGURATION
-# ============================================================================
-# Certificate paths (relative to docker-compose directory)
-# Generate certificates with: ./scripts/generate-certs.sh
-
-# Wazuh Indexer Certificates
-INDEXER_CERT_PATH=./config/wazuh-indexer/certs
-INDEXER_ROOT_CA=root-ca.pem
-INDEXER_CERT=indexer.pem
-INDEXER_KEY=indexer-key.pem
-
-# Wazuh Manager Certificates
-MANAGER_CERT_PATH=./config/wazuh-manager/certs
-MANAGER_ROOT_CA=root-ca.pem
-MANAGER_CERT=filebeat.pem
-MANAGER_KEY=filebeat-key.pem
-
-# Wazuh Dashboard Certificates
-DASHBOARD_CERT_PATH=./config/wazuh-dashboard/certs
-DASHBOARD_CERT=dashboard.pem
-DASHBOARD_KEY=dashboard-key.pem
-
-# ============================================================================
-# LOG RETENTION AND STORAGE
-# ============================================================================
-# Log retention policies (days)
-WAZUH_LOG_RETENTION=90
-SURICATA_LOG_RETENTION=30
-ZEEK_LOG_RETENTION=30
-
-# Storage paths (for custom volume mounts)
-# Leave commented to use Docker volumes
-# WAZUH_DATA_PATH=/opt/ai-soc/wazuh/data
-# SURICATA_LOGS_PATH=/opt/ai-soc/suricata/logs
-# ZEEK_LOGS_PATH=/opt/ai-soc/zeek/logs
-
-# ============================================================================
-# ALERTING AND NOTIFICATIONS
-# ============================================================================
-# Email SMTP Configuration (for alert notifications)
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
-SMTP_USERNAME=your-email@example.com
-SMTP_PASSWORD=CHANGE_ME_SmtpPassword234!
-SMTP_FROM=ai-soc@example.com
-SMTP_TO=security-team@example.com
-
-# Slack Webhook (optional)
-SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/WEBHOOK/URL
-
-# ============================================================================
-# DATASET CONFIGURATION
-# ============================================================================
-# Paths to security datasets (for replay and training)
-CICIDS2017_PATH=./datasets/CICIDS2017
-UNSW_NB15_PATH=./datasets/UNSW-NB15
-LOGHUB_PATH=./datasets/LogHub-2.0
-
-# ============================================================================
-# SYSTEM TUNING (Linux Only)
-# ============================================================================
-# OpenSearch/Elasticsearch requirement
-# Run before deployment: sudo sysctl -w vm.max_map_count=262144
-# Permanent: echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
-VM_MAX_MAP_COUNT=262144
-
-# ============================================================================
-# DEPLOYMENT MODE
-# ============================================================================
-# Environment: development, staging, production
-DEPLOYMENT_ENV=development
-
-# Enable debug logging (true/false)
-DEBUG_MODE=true
-
-# Timezone for logs and timestamps
-TZ=America/Los_Angeles
-
-# ============================================================================
-# BACKUP CONFIGURATION
-# ============================================================================
-# Backup directory for database dumps and configurations
-BACKUP_DIR=./backups
-
-# Automated backup schedule (cron format)
-# Default: Daily at 2 AM
-BACKUP_SCHEDULE=0 2 * * *
-
-# ============================================================================
-# SECURITY BEST PRACTICES
-# ============================================================================
-# 1. Generate strong passwords (32+ characters, alphanumeric + symbols)
-# 2. Use unique passwords for each service
-# 3. Rotate passwords every 90 days
-# 4. Enable 2FA where supported
-# 5. Restrict network access with firewall rules
-# 6. Enable SSL/TLS for all services
-# 7. Regular security audits and updates
-# 8. Monitor logs for suspicious activity
-# 9. Backup .env file securely (encrypted storage)
-# 10. Never commit .env to version control
-#
-# Password Generation Commands:
-# - Linux/Mac: openssl rand -base64 32
-# - Windows PowerShell: [System.Convert]::ToBase64String((1..32|%{Get-Random -Max 256}))
-# - Python: python -c "import secrets; print(secrets.token_urlsafe(32))"
-#
-# ============================================================================
-# END OF CONFIGURATION
-# ============================================================================
+# Run python scripts/configure_local.py; it generates all credentials privately.
+# Do not deploy the placeholder values in this example.
+AI_SOC_API_KEY=
+POSTGRES_PASSWORD=
+AI_SOC_AUTH_SECRET=
+AI_SOC_MODEL_SIGNING_KEY=
+AI_SOC_IDENTITY_DIR=
+OLLAMA_MODEL=llama3.2:3b
+# Optional: connect only to the explicitly configured disposable response lab.
+# ORCHESTRATOR_LAB_URL=http://127.0.0.1:8900