Emitto is a service which provides a robust and targeted way to manage, store, and administer Suricata intrusion detection system (IDS) rules to a distributed network sensor monitoring deployment.

1. Install Bazel

2. Download the source code

3. Build the project:

cd emitto/
bazel build //...

Both the sever and sensor client can be built with the Bazel Docker rules located in their respective BUILD files.

For example, to build and run the sensor client locally in Docker:

bazel --bazelrc=.bazelrc build --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 source/sensor:sensor_image.tar
docker load -i bazel-bin/source/sensor/sensor_image.tar
docker run bazel/source/sensor:sensor_image

The current go_image rule uses a distroless runtime base image, and will run using the default Go binary flag values. The container_image rule can be extended to support a custom env and other image attributes.

Bazel supports the ability to push an image to a remote repository, and also to pull a remote image to be used as a custom base dependency. More information about Bazel Docker rules can be found here.

The following services and products must be established and configured before running Emitto.

Emitto leverages Fleetspeak for reliable, multi-homed communication between the server and network sensors.

While this code is working internally with an internal deployment of Fleetspeak, the open source version is still in development. See the Fleetspeak status section for more information and updates.

Please read the Fleetspeak disclaimer.

By default, Emitto uses Google Cloud Datastore and Google Cloud Storage for object and rule file storage, respectively.

The Emitto Google Groups forum will be used for community discussions and announcements.

This is not an officially supported Google product.