TZ=Europe/Berlin

LISTEN_ADDR=:8080
DB_DSN=eventuser:DEINPASSWORT@tcp(mariadb:3306)/eventcollector?parseTime=true&charset=utf8mb4,utf8&collation=utf8mb4_unicode_ci&loc=UTC

DB_MAX_OPEN_CONNS=50
DB_MAX_IDLE_CONNS=25
DB_CONN_MAX_LIFETIME=3m
DB_CONN_MAX_IDLE_TIME=1m

MAX_BODY_BYTES=10485760
HTTP_READ_TIMEOUT=15s
HTTP_WRITE_TIMEOUT=30s
HTTP_IDLE_TIMEOUT=60s

DETECTION_INTERVAL=1m
OFFLINE_AFTER=10m
OFFLINE_ALERT_MAX=120m
FAILED_LOGON_WINDOW=5m
FAILED_LOGON_THRESHOLD=25
REBOOT_WINDOW=15m
REBOOT_THRESHOLD=3
PASSWORD_SPRAY_WINDOW=5m
PASSWORD_SPRAY_MIN_USERS=5
PASSWORD_SPRAY_MIN_ATTEMPTS=15
SUCCESS_AFTER_FAILURE_WINDOW=10m
NEW_SOURCE_IP_LOOKBACK=720h
NEW_SOURCE_IP_WINDOW=10m
DETECTIONS_LIMIT=100

MARIADB_DATABASE=eventcollector
MARIADB_USER=eventuser
MARIADB_PASSWORD=DEINPASSWORT
MARIADB_ROOT_PASSWORD=ROOTPASSWORT

GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=admin

ENROLLMENT_KEY=BITTE_SEHR_LANG_UND_ZUFAELLIG

BASELINE_ENABLED=true
BASELINE_WINDOW=5m
BASELINE_MIN_SAMPLES=24
BASELINE_MIN_COUNT=10
BASELINE_MEDIUM_Z=2.5
BASELINE_HIGH_Z=4.0
BASELINE_SUPPRESS_FOR=1h


#BASELINE_MIN_SAMPLES=84
#BASELINE_MEDIUM_Z=3.0
#BASELINE_HIGH_Z=5.0
#BASELINE_MIN_COUNT=20
# Metadata-first storage
# Raw XML is disabled by default. Enable only for short forensic retention.
STORE_EVENT_ROWS=false
STORE_RAW_XML=false
METADATA_CONTEXT_EVENT_IDS=4624,4625,4648,4672,4720,4726,4728,4732,4740,4756,4768,4769,4771,4776
METADATA_BUCKET=5m
EVENT_RETENTION=6h
RAW_RETENTION=6h
METADATA_RETENTION=720h

# Partition maintenance
PARTITION_MAINTENANCE_ENABLED=true
PARTITION_MAINTENANCE_INTERVAL=15m
PARTITION_INTERVAL=3h
PARTITION_AHEAD=24h
PARTITION_BEHIND=6h
# Compatibility fallback; table-specific retention values above take precedence.
PARTITION_RETENTION=720h

# New Event-ID classification
NEW_EVENT_ID_MODE=inventory
NEW_EVENT_ID_LEARNING_PERIOD=24h
NEW_EVENT_ID_CONFIRM_WINDOW=15m
NEW_EVENT_ID_MIN_COUNT=3
NEW_EVENT_ID_IGNORE_CHANNELS=Microsoft-Windows-WMI-Activity/Operational
NEW_EVENT_ID_ALERT_CHANNELS=Security,System
NEW_EVENT_ID_HIGH_RISK_IDS=1102,4697,4719,7045

# Optional stress-agent profile
SIEM_STRESS_URL=http://siem-backend:8080/ingest
SIEM_STRESS_HOST=SIEM-STRESS-01
SIEM_STRESS_API_KEY=CHANGE-ME-STRESS-API-KEY
SIEM_STRESS_SCENARIO=mixed
SIEM_STRESS_RATE=200
SIEM_STRESS_BATCH=100
SIEM_STRESS_WORKERS=4
SIEM_STRESS_DURATION=30s
SIEM_STRESS_MAX_EVENTS=100000
SIEM_STRESS_TIMEOUT=20s
SIEM_STRESS_CONFIRM=true