Introduction
Revision History
| Date | Author | Summary |
|---|---|---|
| 13-MAY-2025 | TSgt. Bernadotte | Initial draft |
| 14-MAY-2025 | TSgt. Bernadotte | Update procedures |
| 16-MAY-2025 | TSgt. Bernadotte | Update architecture |
| 18-MAY-2025 | TSgt. Bernadotte | Add Metasponse section + expand DIP backup procedures |
Purpose
The purpose of this SOP is to provide step-by-step instructions on configuring and operating a MIP with core DIP components (Elastic stack + Zeek, Suricata, and Arkime) installed for standalone analysis on networks where deploying a DIP isn't feasible (or training purposes). It allows an operator to turn a MIP into a DIP Sensor by sniffing an interface with Zeek, Suricata, and Arkime, all while being able to analyze it on the same platform with Kibana and Arkime-Viewer. It also installs a /bin/262cos_dmip_ingest_pcap.sh script for reading PCAP files with the local DIP Sensor tools (Zeek, Suricata, and Arkime).
Requirements
- A MIP deployed via a CVA/H 3.8 Controller setup IAW
262COS-DIP-SOP-001- connected to said DIP