Socket

https://docs.socket.dev/docs
Admin
Socket is a supply chain security platform that fights vulnerabilities and provides visibility,...
Tokens:129,018
Snippets:1,795
Trust Score:9.8
Update:3 months ago
Show doc for...
Tokens:
Raw
### Setup Manifest Defaults

Source: https://docs.socket.dev/docs/socket-manifest

Starts an interactive tool to set default flag values for manifest generation in the current directory. The configuration is saved in a local socket.json file.

```bash
socket manifest setup ./proj
```

--------------------------------

### Basic Configuration File Example

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-proxy-mode-configuration

Example of a .sfw.config file using dotenv format for essential settings like API key and hostname.

```shell
SOCKET_API_KEY=sktsec_your_api_key_here_api
SFW_HOSTNAME=your.proxy.hostname
```

--------------------------------

### Install Malicious Package and Check Firewall Logs

Source: https://docs.socket.dev/docs/artifactory-configuration

Demonstrates how to attempt installing a known malicious package and then check the firewall logs for a block event.

```bash
# Try to install known malicious package
npm install some-malicious-package

# Check firewall logs for block
docker compose logs socket-firewall | grep -i block
```

--------------------------------

### Install Safe Package and Verify Firewall Logs

Source: https://docs.socket.dev/docs/artifactory-configuration

Shows how to install a known safe package and verify that the firewall logs indicate it was allowed.

```bash
# Install known safe package
npm install lodash

# Should succeed - check logs
docker compose logs socket-firewall | grep lodash
```

--------------------------------

### Example JSON Configuration

Source: https://docs.socket.dev/docs/tool-configuration-files

This is an example of the JSON structure used for tool configuration, containing an API key.

```json
{
  "apiKey":"..."
}
```

--------------------------------

### Test PyPI Installation via Nexus

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-nexus-configuration

Configures pip to use the Nexus index URL and installs the 'requests' package. Includes checking firewall logs for the installation event.

```bash
pip config set global.index-url https://nexus.company.com/repository/pypi-proxy/simple
pip install requests

docker compose logs socket-firewall | grep requests

```

--------------------------------

### Allowed Package with Warnings Response Example

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

Example of an HTTP response for an allowed package that has associated warnings.

```http
HTTP/1.1 200 OK
X-Socket-Request-ID: a1b2c3d4e5f6...
X-Socket-Decision: allowed
X-Socket-Warn-Reason: protestware
```

--------------------------------

### Use Socket NPM for Installation

Source: https://docs.socket.dev/docs/safe-npm-faq

Replace 'npm install' with 'socket npm install' to leverage Socket's security protections during package installation.

```bash
socket npm install
```

--------------------------------

### Test npm Installation via Nexus

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-nexus-configuration

Configures npm to use the Nexus registry and installs the 'lodash' package. Includes checking firewall logs for the installation event.

```bash
# Developers use Nexus as normal
npm config set registry https://nexus.company.com/repository/npm-proxy/
npm install lodash

# Check firewall logs
docker compose logs socket-firewall | grep lodash

```

--------------------------------

### Install Socket JavaScript SDK

Source: https://docs.socket.dev/docs/socket-javascript-sdk

Install the Socket JavaScript SDK using npm. This is the first step before using the SDK in your project.

```bash
npm install @socketsecurity/sdk
```

--------------------------------

### Mounting the Configuration File

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

Example of how to mount the socket.yml configuration file into the container.

```yaml
volumes:
  - ./socket.yml:/app/socket.yml:ro
```

--------------------------------

### Allowed Package Response Example (No Alerts)

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

Example of a standard HTTP response for an allowed package with no security alerts.

```http
HTTP/1.1 200 OK
X-Socket-Request-ID: a1b2c3d4e5f6...
X-Socket-Decision: allowed
```

--------------------------------

### Start Socket Firewall

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-setup-downstream

Pull the firewall image and start the firewall service using Docker Compose. Verify the firewall is running by checking its health status.

```bash
docker pull socketdev/socket-registry-firewall
docker compose up -d
```

```bash
curl -k https://localhost:8443/health
# Expected: {"status":"healthy","version":"..."}
```

--------------------------------

### Install Socket Firewall Free via npm

Source: https://docs.socket.dev/docs/socket-firewall-free

Install the Socket Firewall Free package globally using npm. After installation, you can prefix package manager commands with `sfw`.

```bash
npm i -g sfw
# sfw can then be prefixed in front of package manager commands
sfw npm install --save dangerous-package
sfw pip install dangerous-package
```

--------------------------------

### Build, Push, and Start Socket Firewall

Source: https://docs.socket.dev/docs/installations

Commands to build the Docker image using Docker Compose, optionally push it to a private registry, and then start the firewall service in detached mode. Includes viewing logs.

```Bash
# Build the image
docker compose build

# (Optional) Push to private registry
docker tag my-registry.company.com/socket-firewall:latest \
  my-registry.company.com/socket-firewall:1.1.94
docker push my-registry.company.com/socket-firewall:latest
docker push my-registry.company.com/socket-firewall:1.1.94

# Start the firewall
docker compose up -d

# View logs
docker compose logs -f socket-firewall

```

--------------------------------

### Install sfw for Windows (ARM64)

Source: https://docs.socket.dev/docs/socket-firewall-free

Download the sfw executable for Windows (ARM64 architecture) using PowerShell and move it to a directory in your PATH.

```powershell
Invoke-WebRequest -Uri "https://github.com/SocketDev/sfw-free/releases/latest/download/sfw-free-windows-arm64.exe" -OutFile "sfw.exe"
# Move to a directory in your PATH, such as:
Move-Item sfw.exe "%USERPROFILE%\AppData\Local\Microsoft\WindowsApps\sfw.exe"
```

--------------------------------

### Example requirements.txt Output

Source: https://docs.socket.dev/docs/anaconda-setup-instructions

This is an example of the content generated in a requirements.txt file by `conda list -e`. It includes package names, versions, and build information.

```text
# This file may be used to create an environment using:
# $ conda create --name <env> --file <this file>
# platform: linux-64

ca-certificates=2020.1.1=0
certifi=2020.4.5.1=py38_0
openssl=1.1.1f=h7b6447c_0
pip=20.0.2=py38_1
setuptools=46.1.3=py38_0
wheel=0.34.2=py38_0
```

--------------------------------

### Blocked Package Response Example

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

Example of an HTTP response for a blocked package, including decision and block reason headers.

```http
HTTP/1.1 403 Forbidden
X-Socket-Request-ID: a1b2c3d4e5f6...
X-Socket-Decision: blocked
X-Socket-Block-Reason: malware,typosquat
```

--------------------------------

### Start and Verify Socket Firewall Deployment

Source: https://docs.socket.dev/docs/installations

Pull the latest firewall image and start the services in detached mode using Docker Compose. Verify the deployment by checking the health endpoint and logs.

```bash
docker pull socketdev/socket-registry-firewall:latest
docker compose up -d
```

```bash
# Check health endpoint
curl -fk https://localhost:8443/health
# Expected: {"status":"healthy","version":"1.x.x"}

# View logs
docker compose logs -f socket-firewall
```

--------------------------------

### Start Socket Firewall and Verify Health

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-upstream-deployment-guide

Pull the firewall image, start the services in detached mode, and then check the firewall's health endpoint.

```bash
docker pull socketdev/socket-registry-firewall
docker compose up -d
curl -k https://socket-firewall.internal.company.com:8443/health
```

--------------------------------

### Install Socket CLI

Source: https://docs.socket.dev/docs/safe-npm-faq

Install the Socket CLI globally to enable Safe NPM protections. This command adds the 'socket' binary to your system's PATH.

```bash
npm install -g socket
```

--------------------------------

### Troubleshoot Lua Library Installation

Source: https://docs.socket.dev/docs/installations

Test Git connectivity within an OpenResty container to diagnose issues with Lua library installation.

```bash
# Test git connectivity
docker run --rm openresty/openresty:1.27.1.2-11-alpine \
  sh -c "apk add git && git clone https://github.com/ledgetech/lua-resty-http.git"
```

--------------------------------

### Basic Socket CLI Commands

Source: https://docs.socket.dev/docs/socket-cli

Examples of common Socket CLI commands.

```bash
socket --help
```

```bash
socket package score npm webpack@5.75.0 --markdown
```

```bash
socket scan create ./proj
```

```bash
socket login
```

--------------------------------

### Test PyPI Installation via Artifactory

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-artifactory-configuration

Installs a PyPI package using Artifactory as the index URL and then checks the Socket Firewall logs for related activity. This verifies the integration.

```bash
pip config set global.index-url https://artifactory.company.com/artifactory/api/pypi/pypi-remote/simple
pip install requests

docker compose logs socket-firewall | grep requests
```

--------------------------------

### Install sfw for Windows (x86_64)

Source: https://docs.socket.dev/docs/socket-firewall-free

Download the sfw executable for Windows (x86_64 architecture) using PowerShell and move it to a directory in your PATH.

```powershell
Invoke-WebRequest -Uri "https://github.com/SocketDev/sfw-free/releases/latest/download/sfw-free-windows-x86_64.exe" -OutFile "sfw.exe"
# Move to a directory in your PATH, such as:
Move-Item sfw.exe "%USERPROFILE%\AppData\Local\Microsoft\WindowsApps\sfw.exe"
```

--------------------------------

### Initialize Socket SDK (CommonJS)

Source: https://docs.socket.dev/docs/socket-javascript-sdk

Import the SocketSdk class for use in CommonJS modules. This is a basic setup step.

```javascript
const { SocketSdk } = require('@socketsecurity/sdk')
```

--------------------------------

### Clone the Socket Python SDK Repository

Source: https://docs.socket.dev/docs/socket-python-sdk

Clone the GitHub repository to get started with the Socket Python SDK.

```bash
git clone https://github.com/SocketDev/socket-sdk-python.git
```

--------------------------------

### Health Check Request and Response

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

Example of a GET request to the /health endpoint and its corresponding HTTP response. This demonstrates the basic health check interaction.

```http
GET /health HTTP/1.1

HTTP/1.1 200 OK
Content-Type: text/plain
Server: SocketFirewall/1.2.3

SocketFirewall/1.2.3 - Health OK
```

--------------------------------

### Login to Store API Token

Source: https://docs.socket.dev/docs/socket-cli

Log in to the Socket CLI to store your API token locally. This command also guides you through setup with interactive questions.

```bash
socket login
```

--------------------------------

### Troubleshoot Container Startup Failures

Source: https://docs.socket.dev/docs/installations

Use these commands to check logs, verify API token, and test configuration generation when a container fails to start.

```bash
# Check logs
docker compose logs socket-firewall

# Verify API token is set
docker compose exec socket-firewall env | grep SOCKET_SECURITY_API_TOKEN

# Test config generation
docker compose exec socket-firewall socket-proxy-config-tool generate --config /app/socket.yml
```

--------------------------------

### Full Azure DevOps YAML Pipeline Example

Source: https://docs.socket.dev/docs/socket-for-azure-devops-yaml

This pipeline installs the Socket CLI, runs it with full context (branch, commit, PR), and handles blocking logic based on the branch. It pulls credentials securely from a variable group.

```yaml
trigger:
  branches:
    include:
      - '*'

pool: your_agent_pool

variables:
  - group: socket_security
  - name: SOCKET_SECURITY_API_KEY
    value: $[variables.api_key]

steps:
- script: |
    pip install socketsecurity --upgrade
  displayName: Install Socket CLI

- script: |
    PR="${SYSTEM_PULLREQUEST_PULLREQUESTNUMBER:-0}"
    DISABLE_BLOCKING=""

    if [[ "$BUILD_SOURCEBRANCHNAME" == "main" || "$BUILD_SOURCEBRANCHNAME" == "master" ]]; then
      DEFAULT_BRANCH="--default-branch"
      DISABLE_BLOCKING="--disable-blocking"
    fi

    socketcli \
      --target-path "$BUILD_REPOSITORY_LOCALPATH" \
      --branch "$BUILD_SOURCEBRANCHNAME" \
      --pr-number "$PR" \
      --commit-sha "$BUILD_SOURCEVERSION" \
      --commit-message "$BUILD_SOURCEVERSIONMESSAGE" \
      --enable-diff \
      $DEFAULT_BRANCH \
      $DISABLE_BLOCKING
  displayName: Run Socket CLI

```

--------------------------------

### Display Help for Socket Firewall Free

Source: https://docs.socket.dev/docs/socket-firewall-free

Use the --help flag to display usage information and examples for the Socket Firewall Free command-line tool.

```bash
$ sfw --help

Socket Firewall Free - Network security proxy for package managers

Runs any package manager command with network traffic filtering.

Usage:
  sfw <command>...
  sfw --help

  Examples:
    sfw npm install
    sfw pip install requests

Provided under the following license:
https://github.com/SocketDev/sfw-free/blob/main/README.md#license
```

--------------------------------

### Example Bitbucket Pipeline Setup for Socket Security Scan

Source: https://docs.socket.dev/docs/socket-in-your-bitbucket-pipeline

This YAML configuration sets up a Bitbucket Pipeline to automatically run Socket Security scans on every commit to any branch and on all pull requests. The Socket CLI automatically detects repository details from git.

```yaml
# Socket Security Bitbucket Pipelines
# This pipeline runs Socket Security scans on every commit to any branch
# The CLI automatically detects most information from the git repository

image: socketdev/cli:latest

definitions:
  steps:
    - step: &socket-scan
        name: Socket Security Scan
        script:
          # Run Socket CLI with minimal required parameters
          # The CLI automatically detects:
          # - Repository name from git
          # - Branch name from git
          # - Commit SHA from git
          # - Commit message from git
          # - Committer information from git
          # - Default branch status from git repository
          # - Changed files from git commit
          - |
            socketcli \
              --integration bitbucket \
              --pr-number ${BITBUCKET_PR_ID:-0}
        # Repository variables needed (set in Bitbucket repo settings)
        # SOCKET_SECURITY_API_KEY: Your Socket Security API token

pipelines:
  # Run on all branches
  branches:
    '**':
      - step: *socket-scan
  
  # Run on pull requests
  pull-requests:
    '**':
      - step: *socket-scan

```

--------------------------------

### Install sfw for Linux (x86_64)

Source: https://docs.socket.dev/docs/socket-firewall-free

Download the sfw binary for Linux (x86_64 architecture), make it executable, and move it to the system's PATH.

```bash
curl -L -o sfw https://github.com/SocketDev/sfw-free/releases/latest/download/sfw-free-linux-x86_64
chmod +x sfw
sudo mv sfw /usr/local/bin/
```

--------------------------------

### Install sfw for Linux (ARM64)

Source: https://docs.socket.dev/docs/socket-firewall-free

Download the sfw binary for Linux (ARM64 architecture), make it executable, and move it to the system's PATH.

```bash
curl -L -o sfw https://github.com/SocketDev/sfw-free/releases/latest/download/sfw-free-linux-arm64
chmod +x sfw
sudo mv sfw /usr/local/bin/
```

--------------------------------

### Example Webhook Signing Key

Source: https://docs.socket.dev/docs/webhooks

This is an example of a webhook signing key. Do not use this example in your configuration.

```text
// Webhook signing key example:
whsec_h4fk4iWceEsgYw/JbT9Feg98sgSFYsAy
```

--------------------------------

### Display Socket Repository Help

Source: https://docs.socket.dev/docs/socket-repo

Use this command to view all available sub-commands for repository management and their usage.

```bash
$ socket repository --help
```

--------------------------------

### Install sfw for macOS (Intel)

Source: https://docs.socket.dev/docs/socket-firewall-free

Download the sfw binary for macOS with Intel architecture, make it executable, and move it to the system's PATH.

```bash
curl -L -o sfw https://github.com/SocketDev/sfw-free/releases/latest/download/sfw-free-macos-x86_64
chmod +x sfw
sudo mv sfw /usr/local/bin/
```

--------------------------------

### Verify OpenSSL Installation

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-proxy-mode-generating-keys

Check if OpenSSL is installed on your system by running this command in your terminal.

```bash
openssl version
```

--------------------------------

### Troubleshoot Container Startup Failures

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-setup-downstream

Use these commands to check container logs, environment variables, and configuration generation for the socket-firewall container.

```bash
docker compose logs socket-firewall
docker compose exec socket-firewall env | grep SOCKET
docker compose exec socket-firewall socket-proxy-config-tool generate --config /app/socket.yml
```

--------------------------------

### Example Prompt for Evaluating Packages with Issues

Source: https://docs.socket.dev/docs/socket-mcp-for-claude-desktop

Use this prompt to ask Claude to evaluate packages that may have known issues, leveraging Socket MCP.

```text
Evaluate packages with issues
```

--------------------------------

### Test Pipeline with pip Install

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-upstream-deployment-guide

Trigger a cache miss by installing an uncached pip package to test the pipeline through the firewall.

```bash
pip install some-uncached-package
```

--------------------------------

### Test Pipeline with npm Install

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-upstream-deployment-guide

Trigger a cache miss by installing an uncached npm package to test the pipeline through the firewall.

```bash
npm install some-uncached-package
```

--------------------------------

### Install sfw for macOS (Apple Silicon)

Source: https://docs.socket.dev/docs/socket-firewall-free

Download the sfw binary for macOS with Apple Silicon architecture, make it executable, and move it to the system's PATH.

```bash
curl -L -o sfw https://github.com/SocketDev/sfw-free/releases/latest/download/sfw-free-macos-arm64
chmod +x sfw
sudo mv sfw /usr/local/bin/
```

--------------------------------

### Passthrough Request Response Example

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

Example of an HTTP response for a passthrough request, such as metadata or checksums, which does not include decision headers.

```http
HTTP/1.1 200 OK
X-Socket-Request-ID: a1b2c3d4e5f6...
```

--------------------------------

### Display Socket Manifest Help

Source: https://docs.socket.dev/docs/socket-manifest

Shows all available commands and options for the socket manifest tool. Use this to understand the full capabilities and subcommands.

```bash
$ socket manifest --help
```

--------------------------------

### Socket Login Help

Source: https://docs.socket.dev/docs/socket-login

Displays help information for the `socket login` command, including usage, API token requirements, and available options.

```bash
$ socket login --help

  Socket API login

  Usage
    $ socket login [options]

  API Token Requirements
    - Quota: 1 unit

  Logs into the Socket API by prompting for an API token

  Options
    --api-base-url    API server to connect to for login
    --api-proxy       Proxy to use when making connection to API server

  Examples
    $ socket login
    $ socket login --api-proxy=http://localhost:1234
```

--------------------------------

### Execute npm Install with socket raw-npm

Source: https://docs.socket.dev/docs/socket-raw-npm

Installs a package globally using npm without the Socket wrapper. This is useful when the Socket wrapper is active and you need to bypass its protection for specific installations. Note that all arguments after `raw-npm` are passed directly to the npm command.

```bash
socket raw-npm install -g cowsay
```

--------------------------------

### Advanced projectIgnorePaths Example

Source: https://docs.socket.dev/docs/socket-yml

Demonstrates advanced usage of projectIgnorePaths to ingest specific files while ignoring others by default. Ensure gitignore directives are wrapped in double quotes.

```yaml
projectIgnorePaths:
  - "/*"
  - "!/package.json"
  - "!/package-lock.json"
  - "!/workspaces"
  - "/workspaces/*"
  - "!/workspaces/foo"
  - "!/workspaces/bar"


```

--------------------------------

### Check Firewall Logs for PyPI Installs

Source: https://docs.socket.dev/docs/nexus-configuration

Verifies PyPI package installations by checking the firewall logs for requests proxied through Nexus.

```bash
docker compose logs socket-firewall | grep requests
```

--------------------------------

### Check Firewall Logs for npm Installs

Source: https://docs.socket.dev/docs/nexus-configuration

Monitors the firewall logs to verify that npm package installations are being proxied correctly through Nexus.

```bash
docker compose logs socket-firewall | grep lodash
```

--------------------------------

### Socket Scan Create Help

Source: https://docs.socket.dev/docs/socket-scan

Shows detailed help for the `socket scan create` command, outlining its usage, API token requirements, and available options for creating a new scan.

```bash
$ socket scan create --help
```

--------------------------------

### Webhook Event Payload Example

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

An example of the JSON payload sent for a 'package_decision' event. This includes details about the package, decision, and context.

```json
{
  "event_type": "package_decision",
  "timestamp": 1709078400.123,
  "request_id": "abc123xyz",
  "purl": "pkg:npm/malicious-package@1.0.0",
  "decision": "blocked",
  "action": "block",
  "response_code": 403,
  "upstream_status": null,
  "block_source": "download",
  "block_reason": "Known Malware",
  "warn_reason": "",
  "client_ip": "203.0.113.10",
  "user_agent": "npm/8.19.2",
  "repo": "npm-remote",
  "source_path": "/repository/npm/malicious-package/-/malicious-package-1.0.0.tgz",
  "upstream_host": "registry.npmjs.org",
  "cached": false,
  "stale": false,
  "socket_api_response_code": 403,
  "purl_check_latency_ms": 142,
  "private_registry_request_id": "ecb06b92c7f89c93:ecb06b92c7f89c93:0000000000000000:0"
}
```

--------------------------------

### Example Base64 Encoded API Key

Source: https://docs.socket.dev/docs/tool-configuration-files

This is an example of a Base64 encoded string representing a JSON configuration with the API key 'my-api-key'.

```text
ewogICJhcGlLZXkiOiAibXktYXBpLWtleSIKfQo=
```

--------------------------------

### Setup Default Scan Configuration

Source: https://docs.socket.dev/docs/socket-scan

Use this command to generate a `socket.json` file with default settings for scans in a specific directory. This helps prefill flags like `--repo` and `--branch` for subsequent commands.

```bash
socket scan setup ./proj
```

--------------------------------

### Install Socket CLI using pip

Source: https://docs.socket.dev/docs/socket-for-azure-devops

Installs or upgrades the Socket CLI package on the build agent. Ensure Python and pip are available.

```bash
pip install socketsecurity --upgrade
```

--------------------------------

### Display Socket Organization Help

Source: https://docs.socket.dev/docs/socket-organizations

Shows available commands and options for managing Socket organization details. Use this to understand the scope of organization-related commands.

```bash
socket organization --help
```

--------------------------------

### Display socket package CLI help

Source: https://docs.socket.dev/docs/socket-package

Use the --help flag to view available commands and options for the socket package CLI.

```bash
$ socket package --help
```

--------------------------------

### Example Prompt for Dependency Security Check

Source: https://docs.socket.dev/docs/socket-mcp-for-claude-desktop

Use this prompt to ask Claude to check the security of a new dependency using Socket MCP.

```text
Check the security of react
```

--------------------------------

### Dockerfile for Socket Firewall

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-proxy-mode-service-setup

A sample Dockerfile to build a custom Socket Firewall image. It installs dependencies, downloads the binary, and configures the service entrypoint.

```dockerfile
FROM debian:bullseye-slim

# netcat/curl included for healthcheck and fetching binaries
RUN apt-get update 
    && apt-get install -y netcat-openbsd curl 
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

RUN mkdir -p /app/certs /run/secrets

# Make sure the binary matches the host architecture
ADD https://github.com/SocketDev/firewall-release/releases/latest/download/sfw-linux-x86_64 ./sfw
RUN chmod +x ./sfw
RUN mv ./sfw /usr/local/bin/sfw

COPY ./ca.crt /app/certs/ca.crt
COPY ./ca.key /app/certs/ca.key

ENV SFW_HTTP_PORT=80
ENV SFW_HTTPS_PORT=443
EXPOSE 80
EXPOSE 443

ENTRYPOINT ["/usr/local/bin/sfw", "--service"]
```

--------------------------------

### Download Firewall Tarball and Entrypoint Script

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-installations

Download the Socket Firewall tarball and the entrypoint script. Make the entrypoint script executable. Replace {version} and {arch} with your specific values.

```bash
# Download tarball and entrypoint for your architecture
# Replace {version} and {arch} with your values
wget https://github.com/SocketDev/socket-registry-firewall/releases/download/v{version}/socket-firewall-{version}.{arch}.tgz
wget https://github.com/SocketDev/socket-registry-firewall/blob/main/entrypoint.sh

# Make entrypoint executable
chmod +x entrypoint.sh
```

--------------------------------

### Configure Socket Firewall with CA Keys

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-proxy-mode-generating-keys

Sets environment variables for the CA certificate and key paths, then starts the Socket Firewall service. Ensure the paths point to your generated `ca.crt` and `ca.key` files.

```bash
export SFW_CA_CERT_PATH=/path/to/ca.crt
export SFW_CA_KEY_PATH=/path/to/ca.key
sfw --service
```

--------------------------------

### Test npm Installation via Artifactory

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-artifactory-configuration

Installs an npm package using Artifactory as the registry and then checks the Socket Firewall logs for related activity. This verifies the integration.

```bash
# Developers use Artifactory as normal
npm config set registry https://artifactory.company.com/artifactory/api/npm/npm-remote/
npm install lodash

# Check firewall logs
docker compose logs socket-firewall | grep lodash
```

--------------------------------

### Example Splunk Event

Source: https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference

An example of a security event logged by Socket Firewall and sent to Splunk HEC. It includes details about package checks, PURL, decision, and alerts.

```json
{
  "time": 1709078400,
  "event": {
    "event_type": "package_check",
    "purl": "pkg:npm/malicious-package@1.0.0",
    "decision": "blocked",
    "action": "block",
    "response_code": 403,
    "upstream_status": null,
    "block_source": "download",
    "block_reason": "Known Malware",
    "warn_reason": "",
    "repo": "npm-remote",
    "client_ip": "203.0.113.10",
    "user_agent": "npm/8.19.2",
    "request_id": "abc123xyz",
    "upstream_host": "registry.npmjs.org",
    "source_path": "/repository/npm/malicious-package/-/malicious-package-1.0.0.tgz",
    "cached": false,
    "stale": false,
    "socket_api_response_code": 403,
    "purl_check_latency_ms": 142,
    "private_registry_request_id": "ecb06b92c7f89c93:ecb06b92c7f89c93:0000000000000000:0",
    "reason": "security_policy",
    "alerts": [
      {"type": "knownMalware", "severity": "critical", "category": "security", "action": "error"}
    ],
    "alert_count": 1,
    "blocked_alerts": [
      {"type": "knownMalware", "severity": "critical", "category": "security", "action": "error"}
    ],
    "blocked_alert_count": 1,
    "score": 0.1,
    "versions": {}
  },
  "source": "socket-firewall",
  "sourcetype": "socket:firewall:event"
}
```
Tokens:
Raw