FROM ubuntu:24.04

# Network forensics tools for Chapter 15 - Lab 15.5
#   - Zeek: network-monitoring framework (structured logs from raw traffic)
#   - Suricata: IDS/IPS + EVE JSON alert engine
#   - zeek-cut: Zeek log field extractor
#   - jq: JSON query (for EVE triage)
#   - tshark: Wireshark command-line (PCAP inspection)
#
# Zeek official install docs: https://docs.zeek.org/en/master/install.html
# Suricata official install docs: https://docs.suricata.io/en/latest/install.html

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -qq && \
    apt-get install -y --no-install-recommends \
        software-properties-common \
        curl \
        gnupg \
        ca-certificates \
        lsb-release \
    && rm -rf /var/lib/apt/lists/*

# Zeek: add the official OBS repo for Ubuntu 24.04 (Noble)
# https://software.opensuse.org/download.html?project=security:zeek&package=zeek
RUN echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/ /' \
        > /etc/apt/sources.list.d/security:zeek.list && \
    curl -fsSL https://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/Release.key \
        | gpg --dearmor > /usr/share/keyrings/security-zeek.gpg && \
    sed -i 's|deb http|deb [signed-by=/usr/share/keyrings/security-zeek.gpg] http|' \
        /etc/apt/sources.list.d/security:zeek.list

# Suricata: add the official PPA
RUN add-apt-repository -y ppa:oisf/suricata-stable

RUN apt-get update -qq && \
    apt-get install -y --no-install-recommends \
        zeek \
        suricata \
        tshark \
        tcpdump \
        jq \
        python3 \
        python3-pip \
        file \
        xxd \
    && rm -rf /var/lib/apt/lists/*

# zeek-cut is included with the zeek package; symlink for PATH
RUN ln -sf /usr/bin/zeek-cut /usr/local/bin/zeek-cut 2>/dev/null || true

# Expose Zeek and Suricata in PATH
ENV PATH="/usr/bin:/usr/sbin:$PATH"

WORKDIR /labs

CMD ["/bin/bash"]
