{"id":14759,"date":"2022-11-09T21:13:52","date_gmt":"2022-11-09T18:13:52","guid":{"rendered":"https:\/\/kifarunix.com\/?p=14759"},"modified":"2024-03-09T23:19:54","modified_gmt":"2024-03-09T20:19:54","slug":"install-cortex-on-ubuntu","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-cortex-on-ubuntu\/","title":{"rendered":"Install Cortex on Ubuntu 22.04\/Ubuntu 20.04"},"content":{"rendered":"\n
In this tutorial, you will learn how to install Cortex on Ubuntu 22.04\/Ubuntu 20.04. Cortex<\/a> is a powerful observable analysis and active response engine that can be used by SOC analysts or any IT security personnel to analyze collected event\/incident observables at scale by by querying a single tool instead of multiple tools, actively respond to threats and interact with the constituency and other teams<\/em>.<\/p>\n\n\n\n Cortex has an installation script<\/a> that you can just download and excute to automatically deploy cortex on any supported system.<\/p>\n\n\n\n We will do the installation manually in this guide. Of course based on the steps highlighted on the script.<\/p>\n\n\n\n Note the recommended system resource requirements;<\/p>\n\n\n\n It is also good to note that, we are installing Cortex on the same node we are running MISP and TheHive. You can as well install it on a separate node if you like;<\/p>\n\n\n\n Run system package cache update and install required packages;<\/p>\n\n\n\n Install Java and define the JAVA_HOME environment variable.<\/p>\n\n\n\n Set the JAVA_HOME;<\/p>\n\n\n\n Cortex supports Elasticsearch 7.x as of this writing.<\/p>\n\n\n\n If not already installed, then you install it as follows;<\/p>\n\n\n\n Configure Elasticsearch. There is only a few changes we are going to make on the default Elasticsearch config. That is the cluster name.<\/p>\n\n\n\n Update JVM heap size based on the system memory (not more than 50% of total RAM).<\/p>\n\n\n\n Also, disable message formatting;<\/p>\n\n\n\n Remove any previous Elasticsearch data, restart and enable it to run on system boot;<\/p>\n\n\n\n Confirm it is running;<\/p>\n\n\n\n Install Cortex and TheHive repository on Ubuntu;<\/p>\n\n\n\n Create Cortex Secret Key required for secure cryptographic Cortex functions;<\/p>\n\n\n\n Configure Elasticsearch connection settings. By default, this is the Elasticsearch connection settings;<\/p>\n\n\n\n Since we are running Elasticsearch in the same node as Cortex, we will leave the default settings.<\/p>\n\n\n\n Ensure you configure your appropriate Elasticsearch settings.<\/p>\n\n\n\n You can as well configure various appropriate Cortex authentication methods for you.<\/p>\n\n\n\n You can now start Cortex service;<\/p>\n\n\n\n Check the status;<\/p>\n\n\n\n Open Cortex ports (9001\/tcp) on Firewall;<\/p>\n\n\n\n You can then access your Cortex via http:\/\/ip-or-domain:9001<\/strong>.<\/p>\n\n\n\n You might be prompted to update the database;<\/p>\n\n\n\n Once the database update is done, create your Cortex admin account;<\/p>\n\n\n\n Click Create<\/strong> and login to Cortex with your credentials;<\/p>\n\n\n\n Cortex default dashboard;<\/p>\n\n\n\n Next, Create Cortex Organization and Organization administrator;<\/a><\/p>\n\n\n\n Next, create Organization admin account;<\/a><\/p>\n\n\n\n Click New Password<\/strong> to set user’s password.<\/p>\n\n\n\n Log out as And now you have access to more organization settings;<\/p>\n\n\n\n And there you go!<\/p>\n\n\n\n That marks the end of our tutorial on installing Cortex on Ubuntu 22.04\/Ubuntu 20.04.<\/p>\n\n\n\n Administration Guide<\/a><\/p>\n\n\n\n How to Integrate TheHive with MISP<\/a><\/p>\n\n\n\n Install MISP on Ubuntu 22.04\/Ubuntu 20.04<\/a><\/p>\n\n\n\nInstalling Cortex on Ubuntu 22.04\/Ubuntu 20.04<\/h2>\n\n\n\n
\n
Install Required Packages<\/h3>\n\n\n\n
sudo apt update<\/code><\/pre>\n\n\n\n
sudo apt install wget gnupg2 apt-transport-https git ca-certificates curl jq software-properties-common lsb-release python3-pip iproute2<\/code><\/pre>\n\n\n\n
Install Java Runtime Environment<\/h3>\n\n\n\n
sudo apt install openjdk-11-jre-headless<\/code><\/pre>\n\n\n\n
echo JAVA_HOME=\"\/usr\/lib\/jvm\/java-11-openjdk-amd64\" | sudo tee -a \/etc\/environment<\/code><\/pre>\n\n\n\n
source \/etc\/environment<\/code><\/pre>\n\n\n\n
Install Elasticsearch 7.x<\/h3>\n\n\n\n
wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | \\\nsudo gpg --dearmor > \/etc\/apt\/trusted.gpg.d\/elasticsearch-keyring.gpg<\/code><\/pre>\n\n\n\n
echo \"deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main\" | \\\nsudo tee \/etc\/apt\/sources.list.d\/elastic-7.x.list<\/code><\/pre>\n\n\n\n
sudo apt update<\/code><\/pre>\n\n\n\n
sudo apt install elasticsearch<\/code><\/pre>\n\n\n\n
sudo sed -i '\/cluster.name\/s\/^#\/\/;s\/my-application\/thehive\/' \/etc\/elasticsearch\/elasticsearch.yml<\/code><\/pre>\n\n\n\n
sudo tee -a \/etc\/elasticsearch\/jvm.options.d\/jvm.options << 'EOL'\n-Xms1g\n-Xmx1g\n-Dlog4j2.formatMsgNoLookups=true\nEOL<\/code><\/pre>\n\n\n\n
sudo rm -rf \/var\/lib\/elasticsearch\/*<\/code><\/pre>\n\n\n\n
sudo systemctl restart elasticsearch<\/code><\/pre>\n\n\n\n
sudo systemctl enable elasticsearch<\/code><\/pre>\n\n\n\n
systemctl status elasticsearch<\/code><\/pre>\n\n\n\n
Installing Cortex on Ubuntu 22.04\/Ubuntu 20.04<\/h3>\n\n\n\n
wget -qO- \"https:\/\/raw.githubusercontent.com\/TheHive-Project\/Cortex\/master\/PGP-PUBLIC-KEY\" \\\n| sudo gpg --dearmor -o \/etc\/apt\/trusted.gpg.d\/cortex.gpg<\/code><\/pre>\n\n\n\n
wget -qO- https:\/\/raw.githubusercontent.com\/TheHive-Project\/Cortex\/master\/PGP-PUBLIC-KEY \\\n| sudo gpg --dearmor -o \/etc\/apt\/trusted.gpg.d\/thehive.gpg<\/code><\/pre>\n\n\n\n
echo 'deb https:\/\/deb.thehive-project.org release main' | sudo tee -a \/etc\/apt\/sources.list.d\/thehive-project.list<\/code><\/pre>\n\n\n\n
sudo apt update<\/code><\/pre>\n\n\n\n
sudo apt install cortex -y<\/code><\/pre>\n\n\n\n
sudo sed -i \"\/play.http.secret.key\/s\/^#\/\/;s\/\\*\\*\\*CHANGEME\\*\\*\\*\/`cat \\\/dev\\\/urandom \\\n| tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1`\/\" \/etc\/cortex\/application.conf<\/code><\/pre>\n\n\n\n
## ElasticSearch\nsearch {\n # Name of the index\n index = cortex\n<\/strong> # ElasticSearch instance address.\n # For cluster, join address:port with ',': \"http:\/\/ip1:9200,ip2:9200,ip3:9200\"\n uri = \"http:\/\/127.0.0.1:9200\"<\/strong>\n\n ## Advanced configuration\n # Scroll keepalive.\n #keepalive = 1m\n # Scroll page size.\n #pagesize = 50\n # Number of shards\n #nbshards = 5\n # Number of replicas\n #nbreplicas = 1\n # Arbitrary settings\n #settings {\n # # Maximum number of nested fields\n # mapping.nested_fields.limit = 100\n #}\n\n ## Authentication configuration\n #username = \"\"\n #password = \"\"\n\n ## SSL configuration\n #keyStore {\n # path = \"\/path\/to\/keystore\"\n # type = \"JKS\" # or PKCS12\n # password = \"keystore-password\"\n #}\n #trustStore {\n # path = \"\/path\/to\/trustStore\"\n # type = \"JKS\" # or PKCS12\n # password = \"trustStore-password\"\n #}\n}\n<\/code><\/pre>\n\n\n\n
Running Cortex<\/h3>\n\n\n\n
sudo systemctl enable --now cortex<\/code><\/pre>\n\n\n\n
systemctl status cortex<\/code><\/pre>\n\n\n\n
\u25cf cortex.service - cortex\n Loaded: loaded (\/etc\/systemd\/system\/cortex.service; enabled; vendor preset: enabled)\n Active: active (running) since Wed 2022-11-09 16:59:55 UTC; 33s ago\n Docs: https:\/\/thehive-project.org\n Main PID: 46218 (java)\n Tasks: 46 (limit: 4610)\n Memory: 416.7M\n CGroup: \/system.slice\/cortex.service\n \u2514\u250046218 java -Duser.dir=\/opt\/cortex -Dconfig.file=\/etc\/cortex\/application.conf -Dlogger.file=\/etc\/cortex\/logback.xml -Dpidfile.path=\/dev\/null -cp \/opt\/cortex\/>\n\nNov 09 16:59:55 thehive.kifarunix-demo.com systemd[1]: Started cortex.\n<\/code><\/pre>\n\n\n\n
Accessing Cortex Web Interface<\/h3>\n\n\n\n
ufw allow 9001\/tcp<\/code><\/pre>\n\n\n\n
<\/figure><\/a><\/div>\n\n\n\n
<\/figure><\/a><\/div>\n\n\n\n
<\/figure><\/a><\/div>\n\n\n\n
<\/figure><\/a><\/div>\n\n\n\n
\n
<\/figure><\/a><\/div>\n\n\n\n
\n
\n
<\/figure><\/a><\/div>\n\n\n\n
\n
<\/figure><\/a><\/div>\n\n\n\n
superadmin<\/code><\/strong> and login as your specific organization admin to continue with other Cortex settings;<\/p>\n\n\n\n
<\/figure><\/a><\/div>\n\n\n\n
<\/figure><\/a><\/div>\n\n\n\n
Further Reading<\/h3>\n\n\n\n
Other Tutorials<\/h3>\n\n\n\n