From c559e17cd19b0606baf0fd258d2b05a34f87457c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20K=C3=A1cha?= <ph@cesnet.cz>
Date: Fri, 27 Nov 2015 16:09:00 +0100
Subject: [PATCH] More sensible configuration file defaults, some sections left
commented to prevent unnecessary default filtering and/or adding Node info
---
.../warden_filer/warden_filer.cfg.dist | 62 +++++++++----------
1 file changed, 30 insertions(+), 32 deletions(-)
diff --git a/warden3/contrib/warden_filer/warden_filer.cfg.dist b/warden3/contrib/warden_filer/warden_filer.cfg.dist
index 3ab68c7..0366e5c 100644
--- a/warden3/contrib/warden_filer/warden_filer.cfg.dist
+++ b/warden3/contrib/warden_filer/warden_filer.cfg.dist
@@ -1,13 +1,16 @@
+// For all options see documentation
{
// Warden config can be also referenced as:
// "warden": "/path/to/warden_client.cfg"
"warden": {
"url": "https://example.com/warden3",
"cafile": "tcs-ca-bundle.pem",
- "timeout": 10,
- "errlog": {"level": "debug"},
+ "keyfile": "my.key.pem",
+ "certfile": "my.cert.pem",
+ "timeout": 60,
+ "retry": 20,
+ "pause": 5,
"filelog": {"level": "debug"},
- "idstore": "myclient.id",
"name": "com.example.warden.test",
"secret": "SeCrEt"
},
@@ -16,41 +19,36 @@
// for Idea events to send out
"dir": "warden_sender",
// Optional filter fields, unmatched events are discarded (and removed)
- "filter": {
- "cat": ["Test", "Recon.Scanning"],
- "nocat": null,
- "group": ["cz.example"],
- "nogroup": null,
- "tag": null,
- "notag": ["Honeypot"]
- },
+ //"filter": {
+ // "cat": ["Test", "Recon.Scanning"],
+ // "nocat": null,
+ // "group": ["cz.example"],
+ // "nogroup": null,
+ // "tag": null,
+ // "notag": ["Honeypot"]
+ //},
// Optional information about detector to be prepended into Idea Node array
- "node": {
- "Name": "cz.example.warden.test_sender",
- "Type": ["Relay"],
- "SW": ["warden_filer-sender"],
- "AggrWin": "00:05:00",
- }
+ //"node": {
+ // "Name": "cz.example.warden.test_sender",
+ // "Type": ["Relay"]
+ //}
},
"receiver": {
// Maildir like directory, whose "incoming" will serve as target for events
"dir": "warden_receiver",
// Optional filter fields for Warden query
- "filter": {
- "cat": ["Test", "Recon.Scanning"],
- "nocat": null,
- "group": ["cz.cesnet"],
- "nogroup": null,
- "tag": null,
- "notag": ["Honeypot"]
- },
+ //"filter": {
+ // "cat": ["Test", "Recon.Scanning"],
+ // "nocat": null,
+ // "group": ["cz.cesnet"],
+ // "nogroup": null,
+ // "tag": null,
+ // "notag": ["Honeypot"]
+ //},
// Optional information about detector to be prepended into Idea Node array
- "node": {
- "Name": "cz.example.warden.test_receiver",
- "Type": ["Relay"],
- "SW": ["warden_filer-receiver"],
- "AggrWin": "00:05:00",
- "Note": "Test warden_filer receiver"
- }
+ //"node": {
+ // "Name": "cz.example.warden.test_receiver",
+ // "Type": ["Relay"]
+ //}
}
}
--
GitLab