DOCSEARCHbyAlgolia
Submit Docs

Morio Documentation

website·Indexed 32 days ago

https://morio.it

Technical reference and guides for Morio, featuring details on its core architecture, including the Core, DB, Tap, Connector, UI, and CA services. The documentation covers settings configuration via settings.reference.yaml, the Morio client for data collection, identity provider (IDP) authentication, and deployment concepts such as preseed, reseeding, and ephemeral nodes.

Tokens
50.7K
Snippets
320
Records
493
Agent score
58%

What's inside Morio

  1. Overview of Morio client bundled agents

    The Morio client bundles several observability agents to gather and ship data to a Morio broker:

    • Auditbeat: Collects audit data.
    • Filebeat: Collects log data.
    • Metricbeat: Collects metrics.
    • Winlogbeat: Collects Windows event logs (available only in the Windows Morio client).

  2. Overview of the Morio Certificate Authority (CA) service

    The Morio Certificate Authority Service (ca) provides a Certificate Authority used to facilitate TLS encryption for and between Morio services and clients. It runs on every Morio broker node and is implemented as a Step-CA instance.

  3. Overview of Morio Proxy Service responsibilities

    The Morio Proxy Service (based on Traefik) runs on every broker node and serves as the main entry point for all HTTP-based traffic. Its primary responsibilities include:

    • TLS Termination: Encrypting and terminating all HTTP-based traffic (except ACME discovery).
    • Certificate Provisioning: Working with the CA service to automatically provision X.509 certificates for Morio services.
    • Request Routing: Routing requests to backend services based on the URL (e.g., /login routes to the UI service, /console to the console service, and /-/api/status to the api service).
    • URL Rewriting: Modifying request URLs to match backend service expectations while maintaining specific routing prefixes.
    • Monitoring: Providing a status and configuration dashboard at the /dashboard endpoint.

  8. Overview of Morio Identity and Access Management (IAM) providers

    The iam.providers configuration key enables identity providers (IDPs) for HTTP-based access to Morio. Note that access to Morio's Kafka API is always authenticated via mTLS and is not affected by these settings.

    There are two types of provider configurations:

    1. Single-instance providers: Use predefined keys (e.g., apikey, local).
    2. Multi-instance providers: Use a freely chosen ID as the key (e.g., ldap).

    By default, the Morio root token provider (mrt) is enabled and requires no configuration.

  9. Overview of the Morio Tap Service

    The Morio Tap Service (tap) enables stream processing within Morio using a 'Bring Your Own Business Logic' (BYOBL) approach. It abstracts the low-level complexities of stream processing code, allowing developers to implement specific business logic to handle data streams without managing the underlying stream infrastructure.

  10. Overview of Morio top-level configuration keys

    Morio is configured using a single settings object. The available top-level configuration keys are: access, cluster, connector, iam, metadata, preseed, tokens, vault, and watcher.

  11. Understand Morio project governance and ownership

    Morio is managed by CERT-EU (the Cybersecurity Service for the Institutions, Bodies, Offices and Agencies of the European Union) under the supervision of the Interinstitutional Cybersecurity Board (IICB). Day-to-day management is handled by CERT-EU’s engineering team.

  12. Understand the Morio client architecture

    The Morio client is a deployment tool that gathers and ships system data to a Morio cluster. It bundles various observability agents from the Elastic Beats family (such as Filebeat, Auditbeat, and Metricbeat). While users can install and configure Beats manually, the Morio client provides higher-level abstractions—specifically module templates and variables—to manage these agents at scale. The client is designed to run side-by-side with existing Beats installations without interfering with default configuration or data locations.