ArmourBird CSF – Container Security Framework is an extensible, modular, API-first framework build for regular security monitoring of docker installations and containers against CIS and other custom security checks.
ArmourBird CSF has a client-server architecture and is thus divided into two components:
CSF Client
Also Read – FudgeC2 : A Collaborative C2 Framework For Purple-Teaming Written In Python3, Powershell & .NET
CSF Server
Important Note: The tool is currently in beta mode. Hence the debug flag of django (CSF Server) is enabled and the SQLite is used as DB in the same docker container. Hence, spinning up a new docker container will reset the database.
APIs CSF Server
Issue APIs
POST /issues
GET /issues/{issueId}
GET /issues
PUT /issues/{issueId}
DELETE /issues/{issueId}
Client APIs
POST /clients
GET /clients/{clientId}
GET /clients/
PUT /clients/{clientId}
DELETE /clients/{clientId}
Client Group APIs
POST /clientGroup
GET /clientGroup/{groupID}
GET /clientGroup/
PUT /clientGroup/{groupID}
DELETE /clientGroup/{groupId}
CSF client run as a docker container on the compute instances running docker installation. It can be executed using the following command using the docker image hosted on hub.docker.com:
docker run -it –net host –pid host –userns host –cap-add audit_control \
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
-e CSF_CDN=” \
-v /etc:/etc \
-v /usr/bin/docker-containerd:/usr/bin/docker-containerd \
-v /usr/bin/docker-runc:/usr/bin/docker-runc \
-v /usr/lib/systemd:/usr/lib/systemd \
-v /var/lib:/var/lib \
-v /var/run/docker.sock:/var/run/docker.sock \
–label csf_client \
-d armourbird/csf_client
Make sure to update CSF_CDN environment variable in the above command with the CSF server URL.
Once the container is executed, it will start sending issue logs to the CSF server on constant intervals.
CSF server can run as a docker container or natively on a web server on which various CSF clients will be sending data.
You can run it on your server using the following command using the docker image hosted on hub.docker.com
docker run -p 80:8000 -d armourbird/csf_server
Browse the CSF server via the following links
Building docker image for CSF Client
git clone git@github.com:armourbird/csf.git
cd csf_client
docker build . -t csf_client
Building docker image for CSF Server
git clone git@github.com:armourbird/csf.git
cd csf_server
docker build . -t csf_server
Sneak Peak
API View
Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…
JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…
The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…
Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…
SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…
Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…