Skip to content

Commit 93f332c

Browse files
committed
GB docs adjust
1 parent bfae544 commit 93f332c

File tree

1 file changed

+30
-25
lines changed

1 file changed

+30
-25
lines changed

docs/GreedyBear/Usage.md

Lines changed: 30 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,5 @@
11
# Usage
22

3-
## User management
4-
5-
### Registration
6-
7-
Since Greedybear v1.1.0 we added a Registration Page that can be used to manage Registration requests when providing GreedyBear as a Service.
8-
9-
After an user registration, an email is sent to the user to verify their email address. If necessary, there are buttons on the login page to resend the verification email and to reset the password.
10-
11-
Once the user has verified their email, they would be manually vetted before being allowed to use the GreedyBear platform. The registration requests would be handled in the Django Admin page by admins.
12-
If you have GreedyBear deployed on an AWS instance you can use the SES service.
13-
14-
In a development environment the emails that would be sent are written to the standard output.
15-
16-
17-
### Amazon SES
18-
19-
If you like, you could use Amazon SES for sending automated emails.
20-
21-
First, you need to configure the environment variable `AWS_SES` to `True` to enable it.
22-
Then you have to add some credentials for AWS: if you have GreedyBear deployed on the AWS infrastructure, you can use IAM credentials:
23-
to allow that just set `AWS_IAM_ACCESS` to `True`. If that is not the case, you have to set both `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
24-
25-
Additionally, if you are not using the default AWS region of us-east-1, you need to specify your `AWS_REGION`.
26-
You can customize the AWS Region location of you services by changing the environment variable `AWS_REGION`. Default is `eu-central-1`.
27-
283
## Feeds
294

305
GreedyBear is created with the aim to collect the information from the TPOTs and generate some actionable feeds, so that they can be easily accessible and act as valuable information to prevent and detect attacks.
@@ -136,13 +111,43 @@ https://<greedybear_site>/api/command_sequence?query=<observable>
136111
```
137112

138113
The available query parameters are:
114+
139115
- query (required): either an IP address or a SHA-256 hash of a command or a sequence of commands to search for
140116
- include_similar (optional): when present, returns related command sequences from the same cluster
141117

142118
Notes:
119+
143120
- When generating a SHA-256 hash to query a multi-line command sequence, ensure you join all command lines with a newline character (`\n`) before calculating the hash. This matches our internal hashing method which uses Python's `"\n".join(sequence)` function.
144121
- For the `include_similar` parameter to work, `CLUSTER_COWRIE_COMMAND_SEQUENCES` must be enabled in the `env_file`.
145122

146123
This "Command Sequence" API is protected through authentication. Please reach out [Matteo Lodi](https://twitter.com/matte_lodi) or another member of [The Honeynet Project](https://twitter.com/ProjectHoneynet) if you are interested in gain access to this API.
147124

148125
If you would like to leverage this API without the need of writing even a line of code and together with a lot of other awesome tools, consider using [IntelOwl](https://github.com/intelowlproject/IntelOwl).
126+
127+
128+
## User management
129+
130+
### Registration
131+
132+
_WARNING_ This functionality has been removed from the v.1.5.0 onwards because it was not used. In case you need it, please ask it and we re-add it to the project.
133+
134+
Since Greedybear v1.1.0 we added a Registration Page that can be used to manage Registration requests when providing GreedyBear as a Service.
135+
136+
After an user registration, an email is sent to the user to verify their email address. If necessary, there are buttons on the login page to resend the verification email and to reset the password.
137+
138+
Once the user has verified their email, they would be manually vetted before being allowed to use the GreedyBear platform. The registration requests would be handled in the Django Admin page by admins.
139+
If you have GreedyBear deployed on an AWS instance you can use the SES service.
140+
141+
In a development environment the emails that would be sent are written to the standard output.
142+
143+
144+
### Amazon SES
145+
146+
If you like, you could use Amazon SES for sending automated emails.
147+
148+
First, you need to configure the environment variable `AWS_SES` to `True` to enable it.
149+
Then you have to add some credentials for AWS: if you have GreedyBear deployed on the AWS infrastructure, you can use IAM credentials:
150+
to allow that just set `AWS_IAM_ACCESS` to `True`. If that is not the case, you have to set both `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
151+
152+
Additionally, if you are not using the default AWS region of us-east-1, you need to specify your `AWS_REGION`.
153+
You can customize the AWS Region location of you services by changing the environment variable `AWS_REGION`. Default is `eu-central-1`.

0 commit comments

Comments
 (0)