unbaked.yml

---
version: '2'
services:
  zookeeper:
    image: confluentinc/cp-zookeeper:latest
    hostname: zookeeper
    container_name: zookeeper
    ports:
      - "2181:2181"
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000

  broker:
    image: confluentinc/cp-server:latest
    hostname: broker
    container_name: broker
    depends_on:
      - zookeeper
    ports:
      - "9092:9092"
      - "9101:9101"
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://broker:29092,PLAINTEXT_HOST://localhost:9092
      KAFKA_METRIC_REPORTERS: io.confluent.metrics.reporter.ConfluentMetricsReporter
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
      KAFKA_CONFLUENT_LICENSE_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_JMX_PORT: 9101
      KAFKA_CONFLUENT_SCHEMA_REGISTRY_URL: http://schema-registry:8081
      CONFLUENT_METRICS_REPORTER_BOOTSTRAP_SERVERS: broker:29092
      CONFLUENT_METRICS_REPORTER_TOPIC_REPLICAS: 1
      CONFLUENT_METRICS_ENABLE: 'true'
      CONFLUENT_SUPPORT_CUSTOMER_ID: 'anonymous'

  schema-registry:
    image: confluentinc/cp-schema-registry:latest
    hostname: schema-registry
    container_name: schema-registry
    depends_on:
      - broker
    ports:
      - "8081:8081"
    environment:
      SCHEMA_REGISTRY_HOST_NAME: schema-registry
      SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS: 'broker:29092'

  connect:
    image: confluentinc/cp-server-connect-base:latest
    hostname: connect
    container_name: connect
    user: root
    depends_on:
      - broker
      - schema-registry
    ports:
      - "8083:8083"
      - "9997:9997"
      - "5140:5140/udp"
    environment:
      CONNECT_BOOTSTRAP_SERVERS: 'broker:29092'
      CONNECT_REST_ADVERTISED_HOST_NAME: connect
      CONNECT_REST_PORT: 8083
      CONNECT_GROUP_ID: compose-connect-group
      CONNECT_CONFIG_STORAGE_TOPIC: _docker-connect-configs
      CONNECT_OFFSET_STORAGE_TOPIC: _docker-connect-offsets
      CONNECT_STATUS_STORAGE_TOPIC: _docker-connect-status
      CONNECT_CONFIG_STORAGE_REPLICATION_FACTOR: 1
      CONNECT_OFFSET_STORAGE_REPLICATION_FACTOR: 1
      CONNECT_STATUS_STORAGE_REPLICATION_FACTOR: 1
      CONNECT_OFFSET_FLUSH_INTERVAL_MS: 10000
      CONNECT_KEY_CONVERTER: org.apache.kafka.connect.storage.StringConverter
      # CONNECT_KEY_CONVERTER: io.confluent.connect.avro.AvroConverter
      # ^^ From Johnny's docker-compose.yml file
      CONNECT_VALUE_CONVERTER: "org.apache.kafka.connect.json.JsonConverter"
      CONNECT_VALUE_CONVERTER_SCHEMA_REGISTRY_URL: http://schema-registry:8081
      CONNECT_INTERNAL_KEY_CONVERTER: "org.apache.kafka.connect.json.JsonConverter"
      CONNECT_INTERNAL_VALUE_CONVERTER: "org.apache.kafka.connect.json.JsonConverter"
      CONNECT_KEY_CONVERTER_SCHEMAS_ENABLE: "false"
      CONNECT_VALUE_CONVERTER_SCHEMAS_ENABLE: "false"
      # CLASSPATH required due to CC-2422
      CLASSPATH: /usr/share/java/monitoring-interceptors/monitoring-interceptors-latest.jar
      CONNECT_PRODUCER_INTERCEPTOR_CLASSES: "io.confluent.monitoring.clients.interceptor.MonitoringProducerInterceptor"
      CONNECT_CONSUMER_INTERCEPTOR_CLASSES: "io.confluent.monitoring.clients.interceptor.MonitoringConsumerInterceptor"
      CONNECT_PLUGIN_PATH: "/usr/share/java,/usr/share/confluent-hub-components"
      CONNECT_LOG4J_LOGGERS: org.apache.zookeeper=ERROR,org.I0Itec.zkclient=ERROR,org.reflections=ERROR
    volumes:
      - ./spooldir/:/var/spooldir/
      - ./scripts/:/tmp/scripts/
    command:
      - /tmp/scripts/startKafkaConnectDemo.sh
  control-center:
    image: confluentinc/cp-enterprise-control-center:latest
    hostname: control-center
    container_name: control-center
    user: root
    depends_on:
      - broker
      - schema-registry
      - connect
      - ksqldb-server
    ports:
      - "9021:9021"
    environment:
      CONTROL_CENTER_BOOTSTRAP_SERVERS: 'broker:29092'
      CONTROL_CENTER_CONNECT_CONNECT-DEFAULT_CLUSTER: 'connect:8083'
      CONTROL_CENTER_KSQL_KSQLDB1_URL: "http://ksqldb-server:8088"
      CONTROL_CENTER_KSQL_KSQLDB1_ADVERTISED_URL: "http://ec2-44-200-26-58.compute-1.amazonaws.com:8088"
      CONTROL_CENTER_SCHEMA_REGISTRY_URL: "http://schema-registry:8081"
      CONTROL_CENTER_REPLICATION_FACTOR: 1
      CONTROL_CENTER_INTERNAL_TOPICS_PARTITIONS: 1
      CONTROL_CENTER_MONITORING_INTERCEPTOR_TOPIC_PARTITIONS: 1
      CONFLUENT_METRICS_TOPIC_REPLICATION: 1
      PORT: 9021

  ksqldb-server:
    image: confluentinc/cp-ksqldb-server:latest
    hostname: ksqldb-server
    container_name: ksqldb-server
    depends_on:
      - broker
      - connect
    ports:
      - "8088:8088"
    volumes:
      - ./ksql-extension:/etc/ksql-extension/
      - ./mmdb:/opt/mmdb/
    environment:
      KSQL_CONFIG_DIR: "/etc/ksql"
      KSQL_KSQL_EXTENSION_DIR: "/etc/ksql-extension"
      KSQL_KSQL_FUNCTIONS_GETGEOFORIP_GEOCITY_DB_PATH: /opt/mmdb/GeoLite2-City.mmdb
      KSQL_KSQL_FUNCTIONS_GETASNFORIP_GEOCITY_DB_PATH: /opt/mmdb/GeoLite2-ASN.mmdb
      KSQL_BOOTSTRAP_SERVERS: "broker:29092"
      KSQL_HOST_NAME: ksqldb-server
      KSQL_LISTENERS: "http://0.0.0.0:8088"
      KSQL_CACHE_MAX_BYTES_BUFFERING: 0
      KSQL_KSQL_SCHEMA_REGISTRY_URL: "http://schema-registry:8081"
      KSQL_PRODUCER_INTERCEPTOR_CLASSES: "io.confluent.monitoring.clients.interceptor.MonitoringProducerInterceptor"
      KSQL_CONSUMER_INTERCEPTOR_CLASSES: "io.confluent.monitoring.clients.interceptor.MonitoringConsumerInterceptor"
      KSQL_KSQL_CONNECT_URL: "http://connect:8083"
      KSQL_KSQL_HIDDEN_TOPICS: '^_.*'
      KSQL_KSQL_LOGGING_PROCESSING_STREAM_AUTO_CREATE: "true"
      KSQL_KSQL_LOGGING_PROCESSING_TOPIC_AUTO_CREATE: "true"

  ksqldb-cli:
    image: confluentinc/cp-ksqldb-cli:latest
    container_name: ksqldb-cli
    depends_on:
      - broker
      - connect
      - ksqldb-server
    entrypoint: /bin/sh
    tty: true
    volumes:
      - ./ksqldb_scripts:/ksqldb_scripts

  zeek-streamer:
    image: bertisondocker/zeek-tcpreplay-kafka:latest
    container_name: zeek-streamer
    depends_on:
      - broker
      - connect
      - control-center
      - ksqldb-server
    hostname: zeek-streamer
    entrypoint: /init_dummy.sh
    volumes:
      - ./pcaps:/pcaps
      - ./local.zeek:/usr/local/zeek/share/zeek/site/local.zeek
      - ./send-to-kafka.zeek:/usr/local/zeek/share/zeek/site/send-to-kafka.zeek
    cap_add:
      - NET_ADMIN

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.0
    container_name: elasticsearch
    #restart: always
    ports:
      - 9200:9200
      - 9300:9300
    environment:
      discovery.type: "single-node"
      ES_JAVA_OPTS: "-Xms1g -Xmx1g"
      cluster.name: "elasticsearch-cp-demo"

  kibana:
      image: docker.elastic.co/kibana/kibana-oss:7.10.0
      container_name: kibana
      restart: always
      depends_on:
        - elasticsearch
      ports:
        - 5601:5601
      environment:
        NEWSFEED_ENABLED: 'false'
        TELEMETRY_OPTIN: 'false'
        TELEMETRY_ENABLED: 'false'
        SERVER_MAXPAYLOADBYTES: 4194304
        KIBANA_AUTOCOMPLETETIMEOUT: 3000
        KIBANA_AUTOCOMPLETETERMINATEAFTER: 2500000

  splunk:
    image: splunk/splunk:latest
    container_name: splunk
    hostname: splunk
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD
      - SPLUNK_APPS_URL=https://raw.githubusercontent.com/JohnnyMirza/confluent_splunk_demo/main/splunk-add-on-for-cisco-asa_410.tgz
    ports:
      - 8000:8000
      - 8090:8090
    volumes:
      - ./default.yml:/tmp/defaults/default.yml
      - $PWD/splunk-search/:/opt/splunk/etc/apps/splunk-search/

  splunk_uf1:
      image: splunk/universalforwarder:latest
      hostname: splunk_uf1
      container_name: splunk_uf1
      depends_on:
        - connect
      environment:
        - SPLUNK_START_ARGS=--accept-license
        - SPLUNK_PASSWORD=dingdong
        - SPLUNK_APPS_URL=https://raw.githubusercontent.com/JohnnyMirza/confluent_splunk_demo/main/splunk-add-on-for-cisco-asa_410.tgz
      volumes:
        - $PWD/splunk-uf1/:/opt/splunkforwarder/etc/apps/splunk-uf1/
      ports:
        - 3333:3333

  splunk_eventgen:
    image: guilhemmarchand/splunk-eventgen:latest
    container_name: splunk_eventgen
    restart: unless-stopped
    user: 'root'
    volumes:
      - $PWD/splunk-eventgen/:/opt/splunk-eventgen
    ports:
      - 6379:6379
      - 9500:9500
    depends_on:
      - splunk_uf1
    command: 'splunk_eventgen -v generate /opt/splunk-eventgen/default/eventgen.conf'

  cyber-sigma-streams:
    image: michaelpeacock/confluent-sigma:v2_1
    container_name: cyber-sigma-streams
    depends_on:
      - broker
      - connect
      - control-center
      - ksqldb-server
    hostname: cyber-sigma-streams
    volumes:
      - $PWD/scripts/:/tmp/config
    command:
      - bash
      - -c
      - |
        echo "Starting Streams app...java -cp sigma-streams-1.0-fat.jar io.confluent.sigmarules.SigmaStreamsApp -c /tmp/config/sigma-dns.properties"
        cd /tmp
        java -cp sigma-streams-1.0-fat.jar io.confluent.sigmarules.SigmaStreamsApp -c /tmp/config/sigma-dns.properties
        sleep infinity

  cyber-sigma-regex-ui:
    image: michaelpeacock/confluent-sigma-regex-ui:v2_1
    container_name: cyber-sigma-regex-ui
    depends_on:
      - broker
      - connect
      - control-center
      - ksqldb-server
    hostname: cyber-sigma-regex-ui
    ports:
      - 8080:8080
    environment:
      kafka_bootstrapAddress: 'broker:29092'
      kafka_schemaRegistry: 'http://schema-registry:8081'
      kafka_sigma_rules_topic: 'sigma-rules'
      confluent_regex_applicationID: 'regex-application'
      confluent_regex_inputTopic: 'splunk-s2s-events'
      confluent_regex_ruleTopic: 'regex-rules'
      confluent_regex_filterField: 'sourcetype'
      confluent_regex_regexField: 'event'

  duo:
    image: confluentinc/cp-server-connect-base:latest
    hostname: duo
    container_name: duo
    user: root
    depends_on:
      - broker
    volumes:
      - ./spooldir/:/var/spooldir/
      - ./scripts/:/tmp/scripts/
    command:
      - /tmp/scripts/produceDuoData.sh