NOTE: This is still in the prototype phase. While the tools work, there are some growing pains as well as known and possibly unknown defects.

EDCOP is a bootable ISO based on Centos 7. EDCOP will install all the necessary components required for deploying EDCOP-Tools from a repository. Current Tools that are supported natively (linked to associated GitHub repos):

• Suricata IDS/IPS
• Bro NSM/IDS
• Moloch Full-PCAP
• ElasticSearch
• ElasticSearch XPACK
• Kibana

Checkout this quick feature demo of EDCOP:

The EDCOP is a scalable cluster to deploy virtual network defense tools on. It is designed to install a kubernetes cluster that is purpose-built to deploy and manage tools for Defensive Cyber Operations (DCO), although it could be used for any NFVi or standard application.

EDCOP is designed to be a platform to deploy any CND tools. Once deployed you will have Bro, Suricata, ELK stack and other tools made available to you. Each tool has a seperate Github repository viewable here: https://github.com/sealingtech/

EDCOP is designed to work in a number of deployment scenarios including a single physical system as well as large cluster with a traffic load balancer.

Installation takes place by building a "master" node which is then used to build more "minion" nodes. Once this process is completed then it is possible to deploy tools in a scalable fashion.

Install Guide: https://github.com/sealingtech/EDCOP/blob/master/docs/installation_guide.rst