- Add _is_wsl() helper function to detect Windows Subsystem for Linux
- Checks /proc/version for microsoft/wsl keywords
- Checks WSL environment variables (WSL_DISTRO_NAME, WSL_INTEROP)
- Enhance get_host_ip() to support all platforms:
- Native Linux: hostname -I (unchanged)
- WSL: Automatically detected, uses hostname -I
- macOS: ifconfig en0 (unchanged)
- Native Windows: Parse ipconfig output for IPv4 address
- Fallback: 0.0.0.0 for local Docker (unchanged)
- No changes to existing Linux/macOS behavior
- Script now automatically adapts to environment
- Tested and working on macOS and Ubuntu
- Add check_containers_exist() method to DockerManager
- Detects if containers exist and if they're running
- Returns tuple (containers_exist, containers_running)
- Enhance start command with smart behavior:
- Already running: instant exit (no-op)
- Stopped: quick start without reconfiguration (~30 sec)
- Not exist: full setup with Detection Engine and Fleet (~5 min)
- Add --force-setup flag to force reconfiguration
- Enhance stop command:
- Already stopped: instant exit (no-op)
- Not exist: helpful error message
- Enhance restart command:
- Not exist: error with guidance to run start
- Stopped: starts containers instead of restarting
- Running: normal restart behavior
- Major improvement: subsequent starts are 10x faster
- Better user experience with clear status messages
- Idempotent operations - safe to run multiple times
- Create KibanaManager class for Detection Engine and Fleet setup
- configure_detection_engine() method:
- Wait for Kibana to be ready with retry logic
- Enable Detection Engine API
- Install prepackaged detection rules
- Bulk enable rules by OS (Linux/Windows/macOS)
- setup_fleet() method:
- Check if Fleet is already initialized
- Extract and configure CA certificate fingerprint
- Configure Fleet Server host URLs
- Set up Elasticsearch output with SSL verification
- Create default agent policy with monitoring
- Install Elastic Defend integration with EDRComplete preset
- Full API integration with Kibana Fleet and Detection Engine APIs
- Comprehensive error handling with helpful messages
- Support for verbose logging mode
- 475 lines implementing bash script parity
- Create DockerManager class for all container operations
- Auto-detect docker compose vs docker-compose
- Implement stage, start, stop, destroy, restart, status
- Add clear_documents() for data stream clearing
- Extract CA fingerprint for Fleet configuration
- Comprehensive error handling and validation
- Create utility functions module
- get_host_ip() for Linux/macOS IP detection
- check_python_version() requiring 3.10+
- run_command() helper with verbose support
- show_docker_error() for formatted error messages
- check_prerequisites() for system validation
- Create Config class to load and validate .env file
- Validate passwords are changed from default 'changeme'
- Provide type-safe access to all configuration values
- Support detection rule flags (Linux/Windows/macOS)
- Helpful error messages for missing or invalid config
Andrew Pease