CyberReboot / vent

Vent is a light-weight platform built to automate network collection and analysis pipelines using a flexible set of popular open source tools and technologies. Vent is python-based, extensible, leverages docker containers, and provides both an API and CLI.

vent

Network Visibility (an anagram)

Overview

vent is a library that includes a CLI designed to serve as a general platform for analyzing network traffic. Built with some basic functionality, vent serves as a user-friendly platform to build custom plugins that perform user-defined processing on incoming network data. See this blog post - Introducing vent

Dependencies

docker>=1.13.1
git
make (if building from source)
pip3
python3.6.x

Installation

Option 1: Running inside of a Docker container

docker run -it -v /var/run/docker.sock:/var/run/docker.sock cyberreboot/vent

Option 2: Installing directly

pip3 install vent

Option 3: Getting the source and building

git clone https://github.com/CyberReboot/vent.git
cd vent

Root/sudo users can simply run make to compile and install the platform. Users with limited permissions or require user-local installation can use the following:

sudo env "PATH=$PATH" make

Note - If you already have docker-py installed on your machine, you may need to pip uninstall docker-py first. vent will install docker-py as part of the installation process, however there are known incompatibilities of docker-py with older versions.

Running

vent

Plugins

vent supports custom plugins that perform user-defined processing on incoming data.

vent is filetype-agnostic in that the plugins installed within your specific vent instance determine what type of files your instance supports. Simply create your plugins, point vent to them & install them, and drop a file in vent to begin processing!

The vent-plugins repository showcases a number of example plugins and contains details on how to create your own.

Documentation

Want to read the documentation for vent? Great! You can find it here

Contributing to vent

Want to contribute? Awesome! Issue a pull request or see more details here.

See this for a crash course on npyscreen: the TUI used by Vent!