Files
2024-07-21 22:49:06 -07:00

138 lines
3.7 KiB
Plaintext

# Enable or disable the available reporting modules [on/off].
# If you add a custom reporting module to your Cuckoo setup, you have to add
# a dedicated entry in this file, or it won't be executed.
# You can also add additional options under the section of your module and
# they will be available in your Python class.
[feedback]
# Automatically report errors that occurred during an analysis. Requires the
# Cuckoo Feedback settings in cuckoo.conf to have been filled out properly.
enabled = no
[jsondump]
enabled = yes
indent = 4
calls = yes
[singlefile]
# Enable creation of report.html and/or report.pdf?
enabled = no
# Enable creation of report.html?
html = no
# Enable creation of report.pdf?
pdf = no
[misp]
enabled = no
url =
apikey =
# The various modes describe which information should be submitted to MISP,
# separated by whitespace. Available modes: maldoc ipaddr hashes url.
mode = maldoc ipaddr hashes url
distribution = 0
analysis = 0
threat_level = 4
# The minimum Cuckoo score for a MISP event to be created
min_malscore = 0
tag = Cuckoo
upload_sample = no
[mongodb]
enabled = no
host = 127.0.0.1
port = 27017
db = cuckoo
store_memdump = yes
paginate = 100
# MongoDB authentication (optional).
username =
password =
[elasticsearch]
enabled = no
# Comma-separated list of ElasticSearch hosts. Format is IP:PORT, if port is
# missing the default port is used.
# Example: hosts = 127.0.0.1:9200, 192.168.1.1:80
hosts = 127.0.0.1
# Increase default timeout from 10 seconds, required when indexing larger
# analysis documents.
timeout = 300
# Set to yes if we want to be able to search every API call instead of just
# through the behavioral summary.
calls = no
# Index of this Cuckoo instance. If multiple Cuckoo instances connect to the
# same ElasticSearch host then this index (in Moloch called "instance") should
# be unique for each Cuckoo instance.
index = cuckoo
# Logging time pattern. This sets how elasticsearch creates indexes
# by default it is yearly in most instances this will be sufficient
# valid options: yearly, monthly, daily
index_time_pattern = yearly
# Cuckoo node name in Elasticsearch to identify reporting host. Can be useful
# for automation and while referring back to correct Cuckoo host.
cuckoo_node =
[moloch]
enabled = no
# If the Moloch web interface is hosted on a different IP address than the
# Cuckoo Web Interface then you'll want to override the IP address here.
host =
# If you wish to run Moloch in http (insecure) versus https (secure) mode,
# set insecure to yes.
insecure = no
# Following are various configurable settings. When in use of a recent version
# of Moloch there is no need to change any of the following settings as they
# represent the defaults.
moloch_capture = /data/moloch/bin/moloch-capture
conf = /data/moloch/etc/config.ini
instance = cuckoo
[notification]
# Notification module to inform external systems that analysis is finished.
# You should consider keeping this as very last reporting module.
enabled = no
# External service URL where info will be POSTed.
# example : https://my.example.host/some/destination/url
url =
# Cuckoo host identifier - can be hostname.
# for example : my.cuckoo.host
identifier =
[mattermost]
enabled = no
# Mattermost webhook URL.
# example : https://my.mattermost.host/hooks/yourveryrandomkey
url =
# Cuckoo host URL to make analysis ID clickable.
# example : https://my.cuckoo.host/
myurl =
# Username to show when posting message
username = cuckoo
# What kind of data to show apart from default.
# Show virustotal hits.
show_virustotal = no
# Show matched cuckoo signatures.
show_signatures = no
# Show collected URL-s by signature "network_http".
show_urls = no
# Hide filename and create hash of it
hash_filename = no
# Hide URL and create hash of it
hash_url = no