dagda
0.8.0
DAGDA是对Docker Images/Container中的已知漏洞，特洛伊斯，病毒，恶意软件和其他恶意威胁的静态分析的工具，并监视Docker守护程序和运行Docker容器以检测异常活动。
为了履行其使命，首先将已知的漏洞（常见的漏洞和暴露率），投标（Bugtraq ID），RHSA（红帽安全咨询）和RHBA（红色帽子型问题咨询）以及来自进攻安全数据库中的已知利用（可用于搜索这些漏洞）在这些漏洞中的搜索和搜索时，这些漏洞是对这些漏洞的搜索和探索。
然后，当您对已知漏洞进行静态分析时， DAGDA会检索有关安装在Docker映像中的软件的信息，例如OS软件包和编程语言的依赖项，并为每种产品及其版本验证是否没有漏洞在MongongoDB中的漏洞。此外， DAGDA使用Clamav作为防病毒引擎来检测Docker Images/Containers中包含的特洛伊木马，病毒，恶意软件和其他恶意威胁。
DAGDA支持多个Linux基础图像：
DAGDA基于OWASP依赖性检查 +退休。JS，以分析以下分析多个依赖关系：
另一方面， DAGDA与FALCO集成，用于监视运行的Docker容器以检测异常活动。此外， DAGDA还包括Docker Daemon的实时活动的聚集。
最后，Docker Image/Container的每个分析报告（包括所有静态分析和所有运行时监视）都存储在同一MongoDB中，以便在需要时拥有每个Docker Image/Container的历史记录。
在DAGDA使用之前，您必须安装下一个要求：
可以使用PIP安装要求：
sudo pip3 install -r requirements.txt您必须已经安装了使用DAGDA的Docker。如果您需要Docker安装的说明，请参阅“ Howto intermant docker”页面。
为了避免使用docker命令时必须使用sudo ，请创建一个名为docker的Unix组并将用户添加到其中。当docker守护程序开始时，它使docker Group的Unix套接字读/写道的所有权。
您必须已经安装了MongoDB 3.6或更高版本才能使用DAGDA ，因为在MongoDB中既存储了漏洞/exploits和分析结果。
如果您需要有关MongoDB安装的说明，请参见How-Tointion Mongodb Community Edition页面。
您也可以使用Docker运行MongoDB：
docker pull mongo
docker run -d -p 27017:27017 mongo您必须在主机OS中安装了内核标题，因为DAGDA与FALCO集成在一起，以监视运行的Docker容器以检测异常活动。
通常可以在类似Debian的发行版上完成： apt-get -y install linux-headers-$(uname -r)
或者，在类似Rhel的分布上： yum -y install kernel-devel-$(uname -r)
之后，建议使用命令/usr/lib/dkms/dkms_autoinstaller start来避免下一个sysdig falco错误跟踪：
rmmod: ERROR: Module sysdig_probe is not currently loaded
重要的是要注意：在某些分布中，已经检测到需要SYSDIG安装，因此，如果您需要SYSDIG安装的说明，请参见Linux页面的HOFTO SENTALSSDIG。
您必须运行python3 dagda.py start以启动dagda服务器。有关详细信息，请参见Wiki页面中的开始子命令。
DAGDA服务器启动并在DAGDA CLI使用之前，您必须根据需要设置下一个环境变量：
export DAGDA_HOST= ' 127.0.0.1 '
export DAGDA_PORT=5000尽管在此用法文档中仅显示CLI使用情况，但DAGDA具有用于使用它的REST API。有关详细信息，请参见REST API文档页面。
对于初始运行，您需要通过运行来填充数据库中的漏洞和利用：
python3 dagda.py vuln --init上一个命令可能需要几分钟的时间才能完成，所以要耐心等待。
如果您需要重新流动数据库以使用新的漏洞和利用来更新，则只需要重新运行上一个命令即可。
另外，您可以使用dagda.py vuln在个人数据库上运行查询。用法示例将是下一个：
python3 dagda.py vuln --product openldap --product_version 2.2.20上一个查询的预期输出如下：
[
{
"CVE-2005-4442" : {
"cveid" : " CVE-2005-4442 " ,
"cvss_access_complexity" : " Low " ,
"cvss_access_vector" : " Local access " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Complete " ,
"cvss_base" : 7.2 ,
"cvss_confidentiality_impact" : " Complete " ,
"cvss_exploit" : 3.9 ,
"cvss_impact" : 10.0 ,
"cvss_integrity_impact" : " Complete " ,
"cvss_vector" : [
" AV:L " ,
" AC:L " ,
" Au:N " ,
" C:C " ,
" I:C " ,
" A:C "
],
"cweid" : " CWE-0 " ,
"mod_date" : " 05-09-2008 " ,
"pub_date" : " 20-12-2005 " ,
"summary" : " Untrusted search path vulnerability in OpenLDAP before 2.2.28-r3 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH. "
}
},
{
"CVE-2006-2754" : {
"cveid" : " CVE-2006-2754 " ,
"cvss_access_complexity" : " Low " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " None " ,
"cvss_base" : 5.0 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 10.0 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " Partial " ,
"cvss_vector" : [
" AV:N " ,
" AC:L " ,
" Au:N " ,
" C:N " ,
" I:P " ,
" A:N "
],
"cweid" : " CWE-0 " ,
"mod_date" : " 07-03-2011 " ,
"pub_date" : " 01-06-2006 " ,
"summary" : " Stack-based buffer overflow in st.c in slurpd for OpenLDAP before 2.3.22 might allow attackers to execute arbitrary code via a long hostname. "
}
},
{
"CVE-2006-5779" : {
"cveid" : " CVE-2006-5779 " ,
"cvss_access_complexity" : " Low " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Partial " ,
"cvss_base" : 5.0 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 10.0 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " None " ,
"cvss_vector" : [
" AV:N " ,
" AC:L " ,
" Au:N " ,
" C:N " ,
" I:N " ,
" A:P "
],
"cweid" : " CWE-399 " ,
"mod_date" : " 26-08-2011 " ,
"pub_date" : " 07-11-2006 " ,
"summary" : " OpenLDAP before 2.3.29 allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names, which triggers an assertion failure. "
}
},
{
"CVE-2006-6493" : {
"cveid" : " CVE-2006-6493 " ,
"cvss_access_complexity" : " High " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Partial " ,
"cvss_base" : 5.1 ,
"cvss_confidentiality_impact" : " Partial " ,
"cvss_exploit" : 4.9 ,
"cvss_impact" : 6.4 ,
"cvss_integrity_impact" : " Partial " ,
"cvss_vector" : [
" AV:N " ,
" AC:H " ,
" Au:N " ,
" C:P " ,
" I:P " ,
" A:P "
],
"cweid" : " CWE-0 " ,
"mod_date" : " 07-03-2011 " ,
"pub_date" : " 12-12-2006 " ,
"summary" : " Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data. "
}
},
{
"CVE-2007-5707" : {
"cveid" : " CVE-2007-5707 " ,
"cvss_access_complexity" : " Medium " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Complete " ,
"cvss_base" : 7.1 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 8.6 ,
"cvss_impact" : 6.9 ,
"cvss_integrity_impact" : " None " ,
"cvss_vector" : [
" AV:N " ,
" AC:M " ,
" Au:N " ,
" C:N " ,
" I:N " ,
" A:C "
],
"cweid" : " CWE-399 " ,
"mod_date" : " 07-03-2011 " ,
"pub_date" : " 30-10-2007 " ,
"summary" : " OpenLDAP before 2.3.39 allows remote attackers to cause a denial of service (slapd crash) via an LDAP request with a malformed objectClasses attribute. NOTE: this has been reported as a double free, but the reports are inconsistent. "
}
},
{
"CVE-2007-5708" : {
"cveid" : " CVE-2007-5708 " ,
"cvss_access_complexity" : " Medium " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Complete " ,
"cvss_base" : 7.1 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 8.6 ,
"cvss_impact" : 6.9 ,
"cvss_integrity_impact" : " None " ,
"cvss_vector" : [
" AV:N " ,
" AC:M " ,
" Au:N " ,
" C:N " ,
" I:N " ,
" A:C "
],
"cweid" : " CWE-399 " ,
"mod_date" : " 07-03-2011 " ,
"pub_date" : " 30-10-2007 " ,
"summary" : " slapo-pcache (overlays/pcache.c) in slapd in OpenLDAP before 2.3.39, when running as a proxy-caching server, allocates memory using a malloc variant instead of calloc, which prevents an array from being initialized properly and might allow attackers to cause a denial of service (segmentation fault) via unknown vectors that prevent the array from being null terminated. "
}
},
{
"CVE-2011-4079" : {
"cveid" : " CVE-2011-4079 " ,
"cvss_access_complexity" : " Low " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " Requires single instance " ,
"cvss_availability_impact" : " Partial " ,
"cvss_base" : 4.0 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 8.0 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " None " ,
"cvss_vector" : [
" AV:N " ,
" AC:L " ,
" Au:S " ,
" C:N " ,
" I:N " ,
" A:P "
],
"cweid" : " CWE-189 " ,
"mod_date" : " 06-01-2017 " ,
"pub_date" : " 27-10-2011 " ,
"summary" : " Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value in an LDIF entry. "
}
},
{
"BID-83610" : {
"bugtraq_id" : 83610 ,
"class" : " Failure to Handle Exceptional Conditions " ,
"cve" : [
" CVE-2006-6493 "
],
"local" : " no " ,
"remote" : " yes " ,
"title" : " OpenLDAP CVE-2006-6493 Remote Security Vulnerability "
}
},
{
"BID-83843" : {
"bugtraq_id" : 83843 ,
"class" : " Failure to Handle Exceptional Conditions " ,
"cve" : [
" CVE-2006-2754 "
],
"local" : " no " ,
"remote" : " yes " ,
"title" : " OpenLDAP CVE-2006-2754 Remote Security Vulnerability "
}
}
]要获取有关特定CVE的所有信息，您必须运行下一个命令：
python3 dagda.py vuln --cve_info CVE-2009-2890上一个查询的预期输出如下：
[
{
"cveid" : " CVE-2009-2890 " ,
"cvss_access_complexity" : " Medium " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " None " ,
"cvss_base" : 4.3 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 8.6 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " Partial " ,
"cvss_vector" : [
" AV:N " ,
" AC:M " ,
" Au:N " ,
" C:N " ,
" I:P " ,
" A:N "
],
"cweid" : " CWE-79 " ,
"mod_date" : " 20-08-2009 " ,
"pub_date" : " 20-08-2009 " ,
"summary" : " Cross-site scripting (XSS) vulnerability in results.php in PHP Scripts Now Riddles allows remote attackers to inject arbitrary web script or HTML via the searchquery parameter. "
}
]如果您想了解有关dagda.py vuln的更多详细信息，请键入python3 dagda.py vuln --help或查看Wiki页面中的vuln子命令。
该数据库称为vuln_database ，有10个集合：
http://www.securityfocus.com/ ） - 源biddb_downloader在接下来的小节中，对已知漏洞，特洛伊木马，病毒，恶意软件和其他恶意威胁进行静态分析以及监视运行Docker容器以检测异常活动的静态分析。
DAGDA的主要目标之一是对Docker Images/Container中的已知漏洞，特洛伊木马，病毒，恶意软件和其他恶意威胁进行分析，因此，如果您想对Docker Image/Container进行分析，则必须输入：
python3 dagda.py check --docker_image jboss/wildfly有关详细信息，请参见检查子命令WIKI页面。
上一个命令的预期输出将是下一个命令。在此输出中， DAGDA响应分析id 。
{
"id" : " 58667994ed253915723c50e7 " ,
"msg" : " Accepted the analysis of <jboss/wildfly> "
}另外，如果您想以远程方式运行静态分析，则可以使用代理子命令：
python3 dagda.py agent localhost:5000 -i jboss/wildfly上一个命令的预期输出将是下一个命令。在此输出中， DAGDA响应分析id 。
{
"id" : " 58667994ed253915723c50e7 " ,
"image_name" : " jboss/wildfly "
}如果您想查看混凝土码头分析，则必须输入：
python3 dagda.py history < DOCKER_IMAGE_NAME_HERE > --id < REPORT_ID_HERE >有关dagda.py history的更多详细信息，请键入python3 dagda.py history --help或查看Wiki页面中的历史记录子命令。
分析可能需要几分钟才能完成，因此请耐心等待。如果您键入上一个命令，则在键入python3 dagda.py history jboss/wildfly --id 58667994ed253915723c50e7时，预期输出如下所示。
{
"id" : " 58667994ed253915723c50e7 " ,
"image_name" : " jboss/wildfly " ,
"status" : " Completed " ,
"timestamp" : " 2016-12-14 13:17:12.802486 " ,
"static_analysis" : {
"malware_binaries" : [
{
"file" : " /tmp/test/removal-tool.exe " ,
"malware" : " Worm.Sober "
},
{
"file" : " /tmp/test/error.hta " ,
"malware" : " VBS.Inor.D "
}
],
"os_packages" : {
"total_os_packages" : 182 ,
"vuln_os_packages" : 41 ,
"ok_os_packages" : 141 ,
"os_packages_details" : [
{
"product" : " sed " ,
"version" : " 4.2.2 " ,
"is_vulnerable" : false ,
"is_false_positive" : false ,
"vulnerabilities" : []
},
{
"product" : " grep " ,
"version" : " 2.20 " ,
"is_vulnerable" : true ,
"is_false_positive" : false ,
"vulnerabilities" : [
{
"CVE-2015-1345" : {
"cveid" : " CVE-2015-1345 " ,
"cvss_access_complexity" : " Low " ,
"cvss_access_vector" : " Local access " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Partial " ,
"cvss_base" : 2.1 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 3.9 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " None " ,
"cvss_vector" : [
" AV:L " ,
" AC:L " ,
" Au:N " ,
" C:N " ,
" I:N " ,
" A:P "
],
"cweid" : " CWE-119 " ,
"mod_date" : " 23-12-2016 " ,
"pub_date" : " 12-02-2015 " ,
"summary" : " The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option. "
}
}
]
},
{
"product" : " lua " ,
"version" : " 5.1.4 " ,
"is_vulnerable" : true ,
"is_false_positive" : false ,
"vulnerabilities" : [
{
"CVE-2014-5461" : {
"cveid" : " CVE-2014-5461 " ,
"cvss_access_complexity" : " Low " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Partial " ,
"cvss_base" : 5.0 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 10.0 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " None " ,
"cvss_vector" : [
" AV:N " ,
" AC:L " ,
" Au:N " ,
" C:N " ,
" I:N " ,
" A:P "
],
"cweid" : " CWE-119 " ,
"mod_date" : " 06-01-2017 " ,
"pub_date" : " 04-09-2014 " ,
"summary" : " Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments. "
}
},
{
"BID-34237" : {
"bugtraq_id" : 34237 ,
"class" : " Unknown " ,
"cve" : [],
"local" : " no " ,
"remote" : " yes " ,
"title" : " Lua Unspecified Bytecode Verifier Security Vulnerability "
}
}
]
},
[ ... ]
, {
"product" : " sqlite " ,
"version" : " 3.7.17 " ,
"is_vulnerable" : false ,
"is_false_positive" : false ,
"vulnerabilities" : []
}
]
},
"prog_lang_dependencies" : {
"vuln_dependencies" : 9 ,
"dependencies_details" : {
"java" : [
{
"product" : " xalan-java " ,
"version" : " 2.5.2 " ,
"product_file_path" : " /opt/jboss/java/xalan.2.5.2.jar " ,
"is_vulnerable" : true ,
"is_false_positive" : false ,
"vulnerabilities" : [
{
"CVE-2014-0107" : {
"cveid" : " CVE-2014-0107 " ,
"cvss_access_complexity" : " Low " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " Partial " ,
"cvss_base" : 7.5 ,
"cvss_confidentiality_impact" : " Partial " ,
"cvss_exploit" : 10.0 ,
"cvss_impact" : 6.4 ,
"cvss_integrity_impact" : " Partial " ,
"cvss_vector" : [
" AV:N " ,
" AC:L " ,
" Au:N " ,
" C:P " ,
" I:P " ,
" A:P "
],
"cweid" : " CWE-264 " ,
"mod_date" : " 06-01-2017 " ,
"pub_date" : " 15-04-2014 " ,
"summary" : " The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function. "
}
},
{
"BID-66397" : {
"bugtraq_id" : 66397 ,
"class" : " Input Validation Error " ,
"cve" : [
" CVE-2014-0107 "
],
"local" : " no " ,
"remote" : " yes " ,
"title" : " Apache Xalan-Java Library CVE-2014-0107 Security Bypass Vulnerability "
}
}
]
},
{
"product" : " jboss_wildfly_application_server " ,
"version" : " - " ,
"product_file_path" : " /opt/jboss/java/jboss_wildfly_application_server.jar " ,
"is_vulnerable" : true ,
"is_false_positive" : false ,
"vulnerabilities" : [
{
"CVE-2014-0018" : {
"cveid" : " CVE-2014-0018 " ,
"cvss_access_complexity" : " Medium " ,
"cvss_access_vector" : " Local access " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " None " ,
"cvss_base" : 1.9 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 3.4 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " Partial " ,
"cvss_vector" : [
" AV:L " ,
" AC:M " ,
" Au:N " ,
" C:N " ,
" I:P " ,
" A:N "
],
"cweid" : " CWE-264 " ,
"mod_date" : " 06-01-2017 " ,
"pub_date" : " 14-02-2014 " ,
"summary" : " Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment. "
}
}
]
},
[ ... ]
, {
"product" : " jboss_weld " ,
"version" : " 3.0.0 " ,
"product_file_path" : " /opt/jboss/java/jboss_weld.3.0.0.jar " ,
"is_vulnerable" : true ,
"is_false_positive" : false ,
"vulnerabilities" : [
{
"CVE-2014-8122" : {
"cveid" : " CVE-2014-8122 " ,
"cvss_access_complexity" : " Medium " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " None " ,
"cvss_base" : 4.3 ,
"cvss_confidentiality_impact" : " Partial " ,
"cvss_exploit" : 8.6 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " None " ,
"cvss_vector" : [
" AV:N " ,
" AC:M " ,
" Au:N " ,
" C:P " ,
" I:N " ,
" A:N "
],
"cweid" : " CWE-362 " ,
"mod_date" : " 13-05-2015 " ,
"pub_date" : " 13-02-2015 " ,
"summary" : " Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state. "
}
}
]
}
],
"js" : [],
"nodejs" : [],
"php" : [],
"python" : [
{
"product" : " lxml " ,
"version" : " 1.0.1 " ,
"product_file_path" : " /opt/jboss/python/lxml.1.0.1.py " ,
"is_vulnerable" : true ,
"is_false_positive" : false ,
"vulnerabilities" : [
{
"CVE-2014-3146" : {
"cveid" : " CVE-2014-3146 " ,
"cvss_access_complexity" : " Medium " ,
"cvss_access_vector" : " Network " ,
"cvss_authentication" : " None required " ,
"cvss_availability_impact" : " None " ,
"cvss_base" : 4.3 ,
"cvss_confidentiality_impact" : " None " ,
"cvss_exploit" : 8.6 ,
"cvss_impact" : 2.9 ,
"cvss_integrity_impact" : " Partial " ,
"cvss_vector" : [
" AV:N " ,
" AC:M " ,
" Au:N " ,
" C:N " ,
" I:P " ,
" A:N "
],
"cweid" : " CWE-0 " ,
"mod_date" : " 14-04-2015 " ,
"pub_date" : " 14-05-2014 " ,
"summary" : " Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function. "
}
}
]
}
],
"ruby" : []
}
}
}
}另一个主要的DAGDA目标是执行运行Docker容器的监视以检测异常活动，因此，如果您想通过运行的Docker容器执行监视，则必须输入：
python3 dagda.py monitor 69dbf26ab368 --start有关详细信息，请参见监视器子命令WIKI页面。
预期输出看起来如下所示：
{
"id" : " 586f7631ed25396a829baaf4 " ,
"image_name" : " jboss/wildfly " ,
"msg" : " Monitoring of docker container with id <69dbf26ab368> started "
}如果您打字时，可以在需要时停止监视：
python3 dagda.py monitor 69dbf26ab368 --stop当您在运行容器上停止监视时的预期输出如下所示：
{
"id" : " 586f7631ed25396a829baaf4 " ,
"image_name" : " jboss/wildfly " ,
"timestamp" : " 2017-01-06 10:49:21.212508 " ,
"status" : " Completed " ,
"runtime_analysis" : {
"container_id" : " 69dbf26ab368 " ,
"start_timestamp" : " 2017-01-06 10:49:21.212508 " ,
"stop_timestamp" : " 2017-01-06 10:50:16.343847 " ,
"anomalous_activities_detected" : {
"anomalous_counts_by_severity" : {
"Warning" : 2
},
"anomalous_activities_details" : [{
"output" : " 10:49:47.492517329: Warning Unexpected setuid call by non-sudo, non-root program (user=<NA> command=ping 8.8.8.8 uid=<NA>) container=thirsty_spence (id=69dbf26ab368) " ,
"priority" : " Warning " ,
"rule" : " Non sudo setuid " ,
"time" : " 2017-01-06 10:49:47.492516 "
}, {
"output" : " 10:49:53.181654702: Warning Unexpected setuid call by non-sudo, non-root program (user=<NA> command=ping 8.8.4.4 uid=<NA>) container=thirsty_spence (id=69dbf26ab368) " ,
"priority" : " Warning " ,
"rule" : " Non sudo setuid " ,
"time" : " 2017-01-06 10:49:53.181653 "
}]
}
}
}如果您想查看所有报告，请参阅“历史记录命令”。
DAGDA包括Docker Daemon的实时事件的收集，因此，如果您想获得所有Docker Daemon事件，则必须输入：
python3 dagda.py docker events预期输出看起来如下所示：
[
{
"Action" : " attach " ,
"Actor" : {
"Attributes" : {
"build-date" : " 20171128 " ,
"image" : " jboss/wildfly " ,
"license" : " GPLv2 " ,
"name" : " amazing_wilson " ,
"vendor" : " CentOS "
},
"ID" : " 73c5ed015df661ce799baa685a39c32125a47b71f3476e9d452adc381fb8114c "
},
"Type" : " container " ,
"from" : " jboss/wildfly " ,
"id" : " 73c5ed015df661ce799baa685a39c32125a47b71f3476e9d452adc381fb8114c " ,
"scope" : " local " ,
"status" : " attach " ,
"time" : 1517323482 ,
"timeNano" : 1517323482957358115
},
{
"Action" : " create " ,
"Actor" : {
"Attributes" : {
"build-date" : " 20171128 " ,
"image" : " jboss/wildfly " ,
"license" : " GPLv2 " ,
"name" : " amazing_wilson " ,
"vendor" : " CentOS "
},
"ID" : " 73c5ed015df661ce799baa685a39c32125a47b71f3476e9d452adc381fb8114c "
},
"Type" : " container " ,
"from" : " jboss/wildfly " ,
"id" : " 73c5ed015df661ce799baa685a39c32125a47b71f3476e9d452adc381fb8114c " ,
"scope" : " local " ,
"status" : " create " ,
"time" : 1517323482 ,
"timeNano" : 1517323482944595092
}
]如果要查看此命令的所有允许过滤器，请参见Docker命令。
本节介绍了使用Docker容器（包括Mongo数据库和Dogda容器）使用docker-compose安装DAGDA 。 Docker插座与DAGDA容器共享，因此可以从执行docker-compose主机中检查Docker映像和容器。
在DAGDA的根文件夹中执行以下命令，然后， DAGDA服务器将在端口5000开始收听：
docker-compose build
docker-compose up -d下面显示了有关DAGDA内部工作流程的10,000英尺图：
通常，达格达效果很好，但是有些情况可能会引起问题。如果您遇到问题，请检查故障排除页面是否进行修复。
有关详细信息，请参见“更改日志”页面。
有关错误，问题和讨论，请使用github问题或在Twitter上（@3grander）ping我。
