warden-server.conf

# 
# warden-server.conf - configuration file for Warden server
#

#-------------------------------------------------------------------------------
# BASEDIR - base directory of Warden server
#-------------------------------------------------------------------------------
$BASEDIR = "/opt/warden-server";

#-------------------------------------------------------------------------------
# FACILITY - syslog facility
#-------------------------------------------------------------------------------
$FACILITY = "local7";

#-------------------------------------------------------------------------------
# DB_NAME - database name of Warden server
#-------------------------------------------------------------------------------
$DB_NAME = "warden";

#-------------------------------------------------------------------------------
# DB_USER - user of Warden server database
#-------------------------------------------------------------------------------
$DB_USER = "root";

#-------------------------------------------------------------------------------
# DB_PASS - password of Warden server database
#-------------------------------------------------------------------------------
$DB_PASS = "";

#-------------------------------------------------------------------------------
# DB_HOST - what IP address to listen on of Warden server
#-------------------------------------------------------------------------------
$DB_HOST = "localhost";

#-------------------------------------------------------------------------------
# MAX_EVENTS_LIMIT - maximum number of events that can be downloaded from
# 		    Warden server in a single getNewEvents client function call
#-------------------------------------------------------------------------------
$MAX_EVENTS_LIMIT = "1000000";

#-------------------------------------------------------------------------------
# VALID_STRINGS - validation hash containing allowed event attributes
#-------------------------------------------------------------------------------
%VALID_STRINGS = (
"type" => ["portscan", "bruteforce", "probe", "spam", "phishing", "botnet_c_c", "dos", "malware", "copyright", "webattack", "test", "other", "_any_"],
);