====== Using the TrisulNSM Docker appliance ======

This post introduces the newly released TrisulNSM Docker Appliance. A lightweight fast Network Traffic Analytics and Security Monitoring system that can be deployed instantly. 


{{ :docker:trisvenn.png?nolink |}}

===== All in one NSM and Traffic monitoring =====

The Docker appliance is on Docker Hub at [[https://hub.docker.com/r/trisulnsm/trisul6/|trisulnsm/trisul6]]

Here are some links to get your started.

  - **Start here** github [[https://github.com/trisulnsm/docker|trisulnsm/docker]] : Quick instructions on running the appliance 
  - [[https://trisul.org/blog/docker/post.html|Blog post]] announcing the release 
  - Devzone article [[docker:pcap_analysis|"Importing PCAPS"]] explaining how you can import PCAP dumps 

===== Advantages of the Docker NSM appliance =====

  - Just run the appliance to get a complete NSM system live. All parts are included. There is no need to setup a backend database cluster with Elastic, Splunk, etc.
  - The performance is very close to directly installing on the host. 
  - Secure. The docker image is a minimal install, with only the necessary packages. 
  - Also includes Suricata IDS with auto updates.  Trisul integrates the alert based metrics into its pipelines. Just check it out to see this powerful feature in action. 
  - Built-in [[https://trisul.org/free|FREE Trisul Network Analytics]] License that lets you monitor for ever but only reports on the most recent 3 days. 


===== Next steps =====

If you need a 'point' solution , this Docker image should be good enough for most deployments.  Here are some advantages of installing the packages directly on the host instead of Docker.

  - Trisul packages allow a Hub+Probe architecture. The Docker image bundles them all in one ball. If you want to deploy a distribute probe network. You need to use the packages.
  - This image uses the ''--net=host'' Host network bridge. If you are uncomfortable with that , and there is no need to be, you can use the raw packages.
  - Short answer : In most case this Docker image will work just fine as an **all-in-one** NSM and Traffic Analytics system.