soc-collector

A single, run-anywhere container that scans your estate and pushes the results to a SOC Center instance as auto-updating reports. No JSON to write, no curl — you give it an API endpoint and a token, point it at some targets, and run it. Same report slug every run, so SOC Center versions each scan, diffs what changed, and alerts you only on new findings.

Run it

docker run --rm \
  -e SOC_URL=https://soc.ethica.no \
  -e SOC_TOKEN=soc_xxxxxxxx \
  -e SOC_TARGETS=10.0.0.5,10.0.0.6 \
  -e SOC_DOMAINS=soc.ethica.no,ethica.no \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  git.skui.io/ethica/soc-collector:latest

It runs once and exits. To keep reports fresh, schedule that command — e.g. nightly:

0 2 * * *  docker run --rm -e SOC_URL=… -e SOC_TOKEN=… -e SOC_TARGETS=… -e SOC_DOMAINS=… \
             -v /var/run/docker.sock:/var/run/docker.sock:ro git.skui.io/ethica/soc-collector:latest

The SOC_TOKEN is a write-scoped token you mint once in SOC Center (Admin → Tokens). Reports are owned by, and visible per, that token's user.

What it collects

Report (slug)	Source	Needs
attack-surface	nmap open-port / service scan, flags risky exposed ports	SOC_TARGETS
container-cves	trivy vuln scan of every running image (HIGH/CRITICAL)	Docker socket
tls-exposure	cert-expiry, weak TLS, missing security headers	SOC_DOMAINS
config-drift	0.0.0.0 port binds, --privileged, rw docker-socket mounts	Docker socket

Each source self-skips when its inputs are absent — no SOC_TARGETS → no nmap; no socket mount → no Trivy / config-drift. So the same image is safe to run anywhere; you just enable what you give it.

Configuration (all via env)

Var	Required	Default	Meaning
SOC_URL	✅	—	SOC Center base URL, e.g. https://soc.ethica.no
SOC_TOKEN	✅	—	write-scoped API token
SOC_TARGETS	for nmap	—	comma/space hosts or IPs to scan
SOC_DOMAINS	for tls	—	comma hostnames to TLS-probe
SOC_SOURCES		surface,cve,tls,config	which sources to run
SOC_SLUG_PREFIX		—	prefix slugs (e.g. hetzner) so multiple sites don't collide
SOC_VISIBILITY		private	private or authenticated
SOC_TAGS		collector	extra report tags

Notes

• Docker socket is mounted read-only (:ro) and is only used to list running containers and inspect their config. For extra isolation, point it at a scoped socket-proxy instead of the raw socket.
• The collector is pure-stdlib Python; the image just adds nmap and trivy.
• Multi-site: run one container per site with a distinct SOC_SLUG_PREFIX.

License

MIT — see LICENSE.