From b1f23f814eb903673d7cdf246ec5db2ba9f1845f Mon Sep 17 00:00:00 2001
From: yashsinghcodes <yash9vardhan@gmail.com>
Date: Mon, 24 Nov 2025 16:44:06 +0530
Subject: [PATCH 1/2] auto find the orborus container

---
 functions/onprem/orborus/orborus.go | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go
index 3f0fffaf..d4f760fd 100755
--- a/functions/onprem/orborus/orborus.go
+++ b/functions/onprem/orborus/orborus.go
@@ -2416,6 +2416,27 @@ func main() {
 	}
 
 	if swarmConfig == "run" || swarmConfig == "swarm" || isKubernetes == "true" {
+		if os.Getenv("SHUFFLE_EC2_INSTANCE") == "true" {
+			log.Printf("[INFO] Detected AWS EC2 instance. Setting up Docker Swarm with AWS optimizations.")
+			containers, err := dockercli.ContainerList(ctx, container.ListOptions{})
+			if err == nil {
+				for _, container := range containers {
+					if strings.Contains(container.Image, "shuffle-orborus") {
+						if len(container.Names) != 0 {
+							if strings.Contains(container.Names[0], "shuffle-orborus") {
+								containerName = container.Names[0]
+								containerName = strings.TrimPrefix(containerName, "/")
+								os.Setenv("ORBORUS_CONTAINER_NAME", containerName)
+								log.Printf("[DEBUG] Found orborus container name: %s", containerName)
+							}
+						}
+					}
+				}
+			} else {
+				log.Printf("[ERROR] Failed to find orborus container: %s", err)
+			}
+		}
+
 		if isKubernetes != "true" {
 			checkSwarmService(ctx)
 		}
@@ -2750,6 +2771,8 @@ func main() {
 								fmt.Sprintf("/detections/Sigma"),
 								org,
 								true,
+								"LOW",
+								"TENZIR_START",
 							)
 
 							if err != nil {

From cb9c9236b30a4e9c434b576d7bb7ba2484e1d195 Mon Sep 17 00:00:00 2001
From: yashsinghcodes <yash9vardhan@gmail.com>
Date: Mon, 24 Nov 2025 17:58:53 +0530
Subject: [PATCH 2/2] moved container auto find for orborus to init

---
 functions/onprem/orborus/go.mod     |  2 +-
 functions/onprem/orborus/orborus.go | 42 +++++++++++++++--------------
 2 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/functions/onprem/orborus/go.mod b/functions/onprem/orborus/go.mod
index b11dc0bb..543568b8 100644
--- a/functions/onprem/orborus/go.mod
+++ b/functions/onprem/orborus/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/docker/docker v28.3.3+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/satori/go.uuid v1.2.0
-	github.com/shuffle/shuffle-shared v0.9.58
+	github.com/shuffle/shuffle-shared v0.9.59
 	k8s.io/api v0.33.1
 	k8s.io/apimachinery v0.33.1
 )
diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go
index d4f760fd..a1cda9a2 100755
--- a/functions/onprem/orborus/orborus.go
+++ b/functions/onprem/orborus/orborus.go
@@ -142,6 +142,28 @@ func init() {
 		log.Printf("Unable to create docker client: %s", err)
 	}
 
+	if os.Getenv("SHUFFLE_EC2_INSTANCE") == "true" {
+		log.Printf("[INFO] Detected AWS EC2 instance. Setting up Docker Swarm with AWS optimizations.")
+		containers, err := dockercli.ContainerList(context.Background(), container.ListOptions{})
+		if err == nil {
+			for _, container := range containers {
+				if strings.Contains(container.Image, "shuffle-orborus") {
+					if len(container.Names) != 0 {
+						if strings.Contains(container.Names[0], "shuffle-orborus") {
+							containerName = container.Names[0]
+							containerName = strings.TrimPrefix(containerName, "/")
+							os.Setenv("ORBORUS_CONTAINER_NAME", containerName)
+							log.Printf("[DEBUG] Found orborus container name: %s", containerName)
+							break
+						}
+					}
+				}
+			}
+		} else {
+			log.Printf("[ERROR] Failed to find orborus container: %s", err)
+		}
+	}
+
 	getThisContainerId()
 
 	if len(pipelineApikey) == 0 {
@@ -2416,26 +2438,6 @@ func main() {
 	}
 
 	if swarmConfig == "run" || swarmConfig == "swarm" || isKubernetes == "true" {
-		if os.Getenv("SHUFFLE_EC2_INSTANCE") == "true" {
-			log.Printf("[INFO] Detected AWS EC2 instance. Setting up Docker Swarm with AWS optimizations.")
-			containers, err := dockercli.ContainerList(ctx, container.ListOptions{})
-			if err == nil {
-				for _, container := range containers {
-					if strings.Contains(container.Image, "shuffle-orborus") {
-						if len(container.Names) != 0 {
-							if strings.Contains(container.Names[0], "shuffle-orborus") {
-								containerName = container.Names[0]
-								containerName = strings.TrimPrefix(containerName, "/")
-								os.Setenv("ORBORUS_CONTAINER_NAME", containerName)
-								log.Printf("[DEBUG] Found orborus container name: %s", containerName)
-							}
-						}
-					}
-				}
-			} else {
-				log.Printf("[ERROR] Failed to find orborus container: %s", err)
-			}
-		}
 
 		if isKubernetes != "true" {
 			checkSwarmService(ctx)