Community Articles

Find and share helpful community-sourced technical articles.
Celebrating as our community reaches 100,000 members! Thank you!
Labels (1)
Super Collaborator

This article serves as an addendum to the main Metron MaaS README doc in Apache Metron github.

It is highly recommended that you go through the README article in github to understand the concepts and working principle. This article only intends to capture the steps specific to the Metron full dev vagrant platform so it is easy for a user to copy-paste-run and get it working quickly.

Further, this article only covers the successful startup, deployment and validation of the Metron MaaS service. Refer to the master github README for further steps.


* You need to have a working Metron full dev platform before you proceed with the instructions

Step 1:Install Required Packages

Run the following commands to install Flask, Jinja2, Squid client and the Elasticsearch HEAD plugin:

vagrant ssh #To SSH onto the full-dev platform
sudo yum install python-flask
sudo yum install python-jinja2
sudo yum install squid
sudo service start squid
sudo /usr/share/elasticsearch/bin/plugin install mobz/elasticsearch-head

Step 2: Create Mock DGA service files

Run the following commands:

sudo su - metron
mkdir mock_dga
cd mock_dga

Download the files from this link and copy to the folder. Alternativey you use the following commands to create the files:

* vi

(paste the below code snippet, save and quit)

from flask import Flask
from flask import request,jsonify
import socket
app = Flask(__name__)
@app.route("/apply", methods=['GET'])
def predict():
        h = request.args.get('host')
        r = {}
        if h == '' or h == '':
                r['is_malicious'] = 'legit'
                r['is_malicious'] = 'malicious'
        return jsonify(r)
if __name__ == "__main__":
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.bind(('localhost', 0))
        port = sock.getsockname()[1]
        with open("endpoint.dat", "w") as text_file:
                text_file.write("{\"url\" : \"\"}" % port), host="", port=port)

* vi

(paste the below code snippet, save and quit)


Run these commands to make the files executable

chmod +x /home/metron/mock_dga/*

Step 3: Create HDFS directories

Run the following commands as vagrant user, and _not_ as metron user

sudo su - hdfs -c "hadoop fs -mkdir /user/metron"
sudo su - hdfs -c "hadoop fs -chown metron:metron /user/metron"<br>

Step 4: Start MaaS service

Run the following commands:

Note: Change the METRON_HOME variable per the version of Metron you are running

sudo su - metron
export METRON_HOME=/usr/metron/0.4.2
$METRON_HOME/bin/ -zq node1:2181

Verify MaaS service running and view application log

Follow these steps to ensure that the maas service is running properly

1. Launch Ambari UI at http://node1:8080. Authenticate with admin/admin

2. Go to Services -> YARN -> 'Quick Links' dropdown -> ResourceManager UI

3. You should be able to see the application listed in the UI, similar to the below:


4. Click on the application -> Logs -> AppMaster.stderr log file to view the startup logs. Check for presence of any errors. If there are none, you are good to deploy the DGA model in the next step.

Step 5: Deploy Mock DGA model

Run the following command as metron user to deploy the DGA model

$METRON_HOME/bin/ -zq node1:2181 -lmp /home/metron/mock_dga -hmp /user/metron/models -mo ADD -m 512 -n dga -v 1.0 -ni 1

Once the command completes, you can monitor the ResourceManager UI application logs to check for any errors.

Verify DGA model has been successfully deployed

a) Run the following command as metron user:

$METRON_HOME/bin/ -zq node1:2181 -mo LIST

At the end of the command execution, you should be able to see something similar to the following output, which indicates that the model has been successfully deployed.

Model dga @ 1.0
dga:1.0 @ http://node1:50451 serving:

Note: The port number '50451' in the above output may change across different runs.

b) Try to hit the model via curl by running the following commands, and verify you are seeing the respective outputs.

[metron@node1 ~]$ curl 'http://localhost:50451/apply?'
  "is_malicious": "malicious"

[metron@node1 ~]$ curl 'http://localhost:50451/apply?'
  "is_malicious": "legit"

With this you would have been able to successfully started, deployed and validated Metron MaaS on your full dev Metron platform.

Step 6: Squid Example

The next steps of sending data through the squid sensor and having it processed through the MaaS is not covered as a part of this article. Please refer to the steps listed in the github README doc.