sirensolutions/siren-investigate repository overview

⁠Siren Investigate

Siren Investigate is the front end of the Siren platform that allows the creation of dashboards, graphs, link analysis, alerting and much more.

For more information, please check the following links:

• Platform Overview⁠
• Documentation⁠

⁠Running the image

⁠Elasticsearch vm.max_map_count setting

To run Elasticsearch, vm.max_map_count must be set on the Docker host to at least 262144.

For more information and OS specific instructions, see here⁠.

The exposed ports are:

• 5606: Investigate HTTP server

To run the image and create a link with an Elasticsearch container:

$ docker run --name investigate --link elasticsearch-host:elasticsearch -p 5606:5606 -d sirensolutions/siren-investigate:10.2.2

To provide the URL of the desired Elasticsearch to the container via an environmental variable:

$ docker run --name investigate -e ELASTICSEARCH_URL=http://elasticsearch-host:9200 -p 5606:5606 -d sirensolutions/siren-investigate:10.2.2

Then connect to https://localhost:5606 to try the demo.

⁠Troubleshooting

• To connect to an elasticsearch cluster on the host, find the IP of the host on the Docker bridge network by e.g.: ip addr show docker0 | awk '$1 == "inet" {gsub(//.*$/, "", $2); print $2}'

  • for MacOS 17.06+, use the DNS name docker.for.mac.localhost

• Pass that IP as the Elasticsearch host, e.g. : docker run -e ELASTICSEARCH_URL=http://123.123.1.1:9220 ...

• If there is a connection issue, there may be iptables rules preventing communications from the docker image to the host.

  In the event of further connection issues, it is advised to download the Siren Investigate zipped package and run that on your system. It can be found here⁠ by going to the Siren Platform version you require and selecting the siren-investigate package that matches your operating system from the "Siren Investigate" section.

  (You can also find the corresponding Siren Federate and Siren Alert versions at the same page⁠)

⁠docker-machine

If using docker-machine, change localhost to the IP address of docker-machine.

⁠Mac Docker Users

If using docker-for-mac, to connect to an elasticsearch instance running on port 9220 on localhost, run

docker run --name kibi -e ELASTICSEARCH_URL=http://host.docker.internal:9220 -p 5606:5606 -d sirensolutions/siren-investigate:10.2.2

See here⁠ if there are any further issues and for known limitations and workarounds.

⁠Windows Docker Users

Accessing docker containers in Windows may require a small adjustment to the NAT rules of VirtualBox. To expose port 5606 (and allow access to https://localhost:5606), try the following:

• Go to VirtualBox and select your VM image
• Choose NAT
• Click on Advanced
• Click on Port Forwarding
• Add a new rule that maps localhost:5606 to the VM port 5606
• Click OK and OK again to get back to VirtualBox's main page
• Restart the image by
  • rightclicking the image,
  • select Close -> Save State
  • rightclick again and select Start