Component Installation

# Update system packages
sudo apt update && sudo apt upgrade -y  # Debian/Ubuntu
sudo yum update -y                       # RHEL/CentOS

# Install common dependencies
sudo apt install -y curl wget gnupg2 software-properties-common \
  apt-transport-https ca-certificates ntp

# Configure NTP for time synchronization
sudo systemctl enable ntp
sudo systemctl start ntp

# Configure firewall (example using ufw)
sudo ufw enable
# Add specific rules per component (see Network Setup guide)

# Set hostname appropriately
sudo hostnamectl set-hostname soc-component-name

# Import Elasticsearch GPG key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
  sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

# Add repository
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] \
  https://artifacts.elastic.co/packages/8.x/apt stable main" | \
  sudo tee /etc/apt/sources.list.d/elastic-8.x.list

# Install Elasticsearch
sudo apt update && sudo apt install elasticsearch

# Configure cluster (edit /etc/elasticsearch/elasticsearch.yml)
# See Configuration guide for details

# Enable and start service
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch

# Verify cluster health
curl -X GET "localhost:9200/_cluster/health?pretty"

# PostgreSQL installation (recommended)
sudo apt install postgresql postgresql-contrib

# Start and enable
sudo systemctl enable postgresql
sudo systemctl start postgresql

# Create databases
sudo -u postgres psql
CREATE DATABASE zabbix;
CREATE DATABASE thehive;
CREATE USER zabbix_user WITH PASSWORD 'secure_password';
CREATE USER thehive_user WITH PASSWORD 'secure_password';
GRANT ALL PRIVILEGES ON DATABASE zabbix TO zabbix_user;
GRANT ALL PRIVILEGES ON DATABASE thehive TO thehive_user;
\q

# Install Terraform
wget https://releases.hashicorp.com/terraform/latest/terraform_linux_amd64.zip
unzip terraform_linux_amd64.zip
sudo mv terraform /usr/local/bin/

# Verify installation
terraform version

# Initialize SOC infrastructure code
mkdir -p ~/soc-terraform
cd ~/soc-terraform
terraform init

# Install PyInfra
pip3 install pyinfra

# Create deployment scripts
mkdir -p ~/soc-pyinfra
# Add deployment scripts for SOC components