warden_filer.cfg.dist

// For all options see documentation
{
    // Warden config can be also referenced as:
    // "warden": "/path/to/warden_client.cfg"
    "warden": {
        "url": "https://example.com/warden3",
        "cafile": "tcs-ca-bundle.pem",
        "keyfile": "my.key.pem",
        "certfile": "my.cert.pem",
        "timeout": 60,
        "retry": 20,
        "pause": 5,
        "filelog": {"level": "debug"},
        "name": "com.example.warden.test",
        "secret": "SeCrEt"
    },
    "sender": {
        // Maildir like directory, whose "incoming" subdir will be checked
        // for Idea events to send out
        "dir": "warden_sender",
        // Optional filter fields, unmatched events are discarded (and removed)
        //"filter": {
        //    "cat": ["Test", "Recon.Scanning"],
        //    "nocat": null,
        //    "group": ["cz.example"],
        //    "nogroup": null,
        //    "tag": null,
        //    "notag": ["Honeypot"]
        //},
        // Optional information about detector to be prepended into Idea Node array
        //"node": {
        //    "Name": "cz.example.warden.test_sender",
        //    "Type": ["Relay"]
        //}
    },
    "receiver": {
        // Maildir like directory, whose "incoming" will serve as target for events
        "dir": "warden_receiver",
        // Optional filter fields for Warden query
        //"filter": {
        //    "cat": ["Test", "Recon.Scanning"],
        //    "nocat": null,
        //    "group": ["cz.cesnet"],
        //    "nogroup": null,
        //    "tag": null,
        //    "notag": ["Honeypot"]
        //},
        // Optional information about detector to be prepended into Idea Node array
        //"node": {
        //    "Name": "cz.example.warden.test_receiver",
        //    "Type": ["Relay"]
        //},
        // Optional limit on number of files in "incoming" directory
        //"file_limit": 10000
    }
}