94 lines
2.4 KiB
Plaintext
94 lines
2.4 KiB
Plaintext
TZ=Europe/Berlin
|
|
|
|
LISTEN_ADDR=:8080
|
|
DB_DSN=eventuser:DEINPASSWORT@tcp(mariadb:3306)/eventcollector?parseTime=true&charset=utf8mb4,utf8&collation=utf8mb4_unicode_ci&loc=UTC
|
|
|
|
DB_MAX_OPEN_CONNS=50
|
|
DB_MAX_IDLE_CONNS=25
|
|
DB_CONN_MAX_LIFETIME=3m
|
|
DB_CONN_MAX_IDLE_TIME=1m
|
|
|
|
MAX_BODY_BYTES=10485760
|
|
HTTP_READ_TIMEOUT=15s
|
|
HTTP_WRITE_TIMEOUT=30s
|
|
HTTP_IDLE_TIMEOUT=60s
|
|
|
|
DETECTION_INTERVAL=1m
|
|
OFFLINE_AFTER=10m
|
|
OFFLINE_ALERT_MAX=120m
|
|
FAILED_LOGON_WINDOW=5m
|
|
FAILED_LOGON_THRESHOLD=25
|
|
REBOOT_WINDOW=15m
|
|
REBOOT_THRESHOLD=3
|
|
PASSWORD_SPRAY_WINDOW=5m
|
|
PASSWORD_SPRAY_MIN_USERS=5
|
|
PASSWORD_SPRAY_MIN_ATTEMPTS=15
|
|
SUCCESS_AFTER_FAILURE_WINDOW=10m
|
|
NEW_SOURCE_IP_LOOKBACK=720h
|
|
NEW_SOURCE_IP_WINDOW=10m
|
|
DETECTIONS_LIMIT=100
|
|
|
|
MARIADB_DATABASE=eventcollector
|
|
MARIADB_USER=eventuser
|
|
MARIADB_PASSWORD=DEINPASSWORT
|
|
MARIADB_ROOT_PASSWORD=ROOTPASSWORT
|
|
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=admin
|
|
|
|
ENROLLMENT_KEY=BITTE_SEHR_LANG_UND_ZUFAELLIG
|
|
|
|
BASELINE_ENABLED=true
|
|
BASELINE_WINDOW=5m
|
|
BASELINE_MIN_SAMPLES=24
|
|
BASELINE_MIN_COUNT=10
|
|
BASELINE_MEDIUM_Z=2.5
|
|
BASELINE_HIGH_Z=4.0
|
|
BASELINE_SUPPRESS_FOR=1h
|
|
|
|
|
|
#BASELINE_MIN_SAMPLES=84
|
|
#BASELINE_MEDIUM_Z=3.0
|
|
#BASELINE_HIGH_Z=5.0
|
|
#BASELINE_MIN_COUNT=20
|
|
# Metadata-first storage
|
|
# Raw XML is disabled by default. Enable only for short forensic retention.
|
|
STORE_EVENT_ROWS=false
|
|
STORE_RAW_XML=false
|
|
METADATA_CONTEXT_EVENT_IDS=4624,4625,4648,4672,4720,4726,4728,4732,4740,4756,4768,4769,4771,4776
|
|
METADATA_BUCKET=5m
|
|
EVENT_RETENTION=6h
|
|
RAW_RETENTION=6h
|
|
METADATA_RETENTION=720h
|
|
|
|
# Partition maintenance
|
|
PARTITION_MAINTENANCE_ENABLED=true
|
|
PARTITION_MAINTENANCE_INTERVAL=15m
|
|
PARTITION_INTERVAL=3h
|
|
PARTITION_AHEAD=24h
|
|
PARTITION_BEHIND=6h
|
|
# Compatibility fallback; table-specific retention values above take precedence.
|
|
PARTITION_RETENTION=720h
|
|
|
|
# New Event-ID classification
|
|
NEW_EVENT_ID_MODE=inventory
|
|
NEW_EVENT_ID_LEARNING_PERIOD=24h
|
|
NEW_EVENT_ID_CONFIRM_WINDOW=15m
|
|
NEW_EVENT_ID_MIN_COUNT=3
|
|
NEW_EVENT_ID_IGNORE_CHANNELS=Microsoft-Windows-WMI-Activity/Operational
|
|
NEW_EVENT_ID_ALERT_CHANNELS=Security,System
|
|
NEW_EVENT_ID_HIGH_RISK_IDS=1102,4697,4719,7045
|
|
|
|
# Optional stress-agent profile
|
|
SIEM_STRESS_URL=http://siem-backend:8080/ingest
|
|
SIEM_STRESS_HOST=SIEM-STRESS-01
|
|
SIEM_STRESS_API_KEY=CHANGE-ME-STRESS-API-KEY
|
|
SIEM_STRESS_SCENARIO=mixed
|
|
SIEM_STRESS_RATE=200
|
|
SIEM_STRESS_BATCH=100
|
|
SIEM_STRESS_WORKERS=4
|
|
SIEM_STRESS_DURATION=30s
|
|
SIEM_STRESS_MAX_EVENTS=100000
|
|
SIEM_STRESS_TIMEOUT=20s
|
|
SIEM_STRESS_CONFIRM=true
|