This project contains tools for building, packaging, and deploying Apache Metron. Please refer to the following sections for more information on how to get Apache Metron running in your environment.
This provides a Management Pack (MPack) extension for Apache Ambari that simplifies the provisioning, management and monitoring of Metron on clusters of any size.
This allows you to easily install Metron using a simple, guided process. This also allows you to monitor cluster health and even secure your cluster with kerberos.
If you want to see how Metron can really scale by deploying it on your own hardware, or even in the cloud, this is the best option for you.
If you want to run a proof-of-concept to see how Apache Metron can benefit your organization, then this is the way to do it.
To deploy Apache Metron using Ambari, follow the instructions at packaging/ambari/metron-mpack.
This will deploy Metron and all of its dependencies on a virtual machine running on your computer.
If you are new to Metron and want to explore the functionality that it offers, this is good place to start.
If you are a developer contributing to the Apache Metron project, this is also a great way to test your changes.
This VM is not intended for processing anything beyond the most basic, low volume work loads.
Additional services should not be installed along side Metron in this VM.
This VM should not be used to run a proof-of-concept for Apache Metron within your organization.
Running Metron within the resource constraints of a single VM is incredibly challenging. Failing to respect this warning, will cause various services to fail mysteriously as the system runs into memory and processing limits.
To deploy Metron in a VM running on your computer, follow the instructions at development/centos6.
We recommend looking at Ambari and shutting down any services you may not be using. For example, we recommend turning off Metron Profiler, as this commonly causes REST services to crash when running on a single VM.
This provides RPM packages that allow you to install Metron on an RPM-based operating system like CentOS.
If you want to manually install Apache Metron on an RPM-based system like CentOS, installation can be simplified by using these packages.
If you want a guided installation process using Ambari on an RPM-based system, then these RPMs are a necessary prerequisite.
To build the RPM packages, follow the instructions at packaging/docker/rpm-docker.
This builds installable DEB packages that allow you to install Metron on an APT-based operating system like Ubuntu.
If you want to manually install Metron on a APT-based system like Ubuntu, installation can be simplified by using these packages.
If you want a guided installation process using Ambari on an APT-based system, then these DEBs are a necessary prerequisite.
To build the DEB packages, follow the instructions at packaging/docker/deb-docker.
This deploys Apache Metron on an automatically provisioned 10-node cluster running in Amazon Web Service's EC2 platform.
This installs real sources of telemetry like Bro, Snort, and YAF, but feeds those sensors with canned pcap data.
If you want to run Metron in AWS with real data for either testing or production, then this is NOT the right option for you.
WARNING This is only intended for creating an ephemeral cluster for brief periods of testing. This deployment method has the following severe limitations.
Follow the instructions available at amazon-ec2.
This provides a Docker containing all of the prerequisites required to build Metron. This allows you to easily build Metron without installing all of the build dependencies manually.
Follow the instructions available at packaging/docker/ansible-docker.