mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
138 lines
3.7 KiB
Plaintext
138 lines
3.7 KiB
Plaintext
# Enable or disable the available reporting modules [on/off].
|
|
# If you add a custom reporting module to your Cuckoo setup, you have to add
|
|
# a dedicated entry in this file, or it won't be executed.
|
|
# You can also add additional options under the section of your module and
|
|
# they will be available in your Python class.
|
|
|
|
[feedback]
|
|
# Automatically report errors that occurred during an analysis. Requires the
|
|
# Cuckoo Feedback settings in cuckoo.conf to have been filled out properly.
|
|
enabled = no
|
|
|
|
[jsondump]
|
|
enabled = yes
|
|
indent = 4
|
|
calls = yes
|
|
|
|
[singlefile]
|
|
# Enable creation of report.html and/or report.pdf?
|
|
enabled = no
|
|
# Enable creation of report.html?
|
|
html = no
|
|
# Enable creation of report.pdf?
|
|
pdf = no
|
|
|
|
[misp]
|
|
enabled = no
|
|
url =
|
|
apikey =
|
|
|
|
# The various modes describe which information should be submitted to MISP,
|
|
# separated by whitespace. Available modes: maldoc ipaddr hashes url.
|
|
mode = maldoc ipaddr hashes url
|
|
|
|
distribution = 0
|
|
analysis = 0
|
|
threat_level = 4
|
|
|
|
# The minimum Cuckoo score for a MISP event to be created
|
|
min_malscore = 0
|
|
|
|
tag = Cuckoo
|
|
upload_sample = no
|
|
|
|
[mongodb]
|
|
enabled = no
|
|
host = 127.0.0.1
|
|
port = 27017
|
|
db = cuckoo
|
|
store_memdump = yes
|
|
paginate = 100
|
|
# MongoDB authentication (optional).
|
|
username =
|
|
password =
|
|
|
|
[elasticsearch]
|
|
enabled = no
|
|
# Comma-separated list of ElasticSearch hosts. Format is IP:PORT, if port is
|
|
# missing the default port is used.
|
|
# Example: hosts = 127.0.0.1:9200, 192.168.1.1:80
|
|
hosts = 127.0.0.1
|
|
# Increase default timeout from 10 seconds, required when indexing larger
|
|
# analysis documents.
|
|
timeout = 300
|
|
# Set to yes if we want to be able to search every API call instead of just
|
|
# through the behavioral summary.
|
|
calls = no
|
|
# Index of this Cuckoo instance. If multiple Cuckoo instances connect to the
|
|
# same ElasticSearch host then this index (in Moloch called "instance") should
|
|
# be unique for each Cuckoo instance.
|
|
index = cuckoo
|
|
|
|
# Logging time pattern. This sets how elasticsearch creates indexes
|
|
# by default it is yearly in most instances this will be sufficient
|
|
# valid options: yearly, monthly, daily
|
|
index_time_pattern = yearly
|
|
|
|
# Cuckoo node name in Elasticsearch to identify reporting host. Can be useful
|
|
# for automation and while referring back to correct Cuckoo host.
|
|
cuckoo_node =
|
|
|
|
[moloch]
|
|
enabled = no
|
|
# If the Moloch web interface is hosted on a different IP address than the
|
|
# Cuckoo Web Interface then you'll want to override the IP address here.
|
|
host =
|
|
# If you wish to run Moloch in http (insecure) versus https (secure) mode,
|
|
# set insecure to yes.
|
|
insecure = no
|
|
|
|
# Following are various configurable settings. When in use of a recent version
|
|
# of Moloch there is no need to change any of the following settings as they
|
|
# represent the defaults.
|
|
moloch_capture = /data/moloch/bin/moloch-capture
|
|
conf = /data/moloch/etc/config.ini
|
|
instance = cuckoo
|
|
|
|
[notification]
|
|
# Notification module to inform external systems that analysis is finished.
|
|
# You should consider keeping this as very last reporting module.
|
|
enabled = no
|
|
|
|
# External service URL where info will be POSTed.
|
|
# example : https://my.example.host/some/destination/url
|
|
url =
|
|
|
|
# Cuckoo host identifier - can be hostname.
|
|
# for example : my.cuckoo.host
|
|
identifier =
|
|
|
|
[mattermost]
|
|
enabled = no
|
|
|
|
# Mattermost webhook URL.
|
|
# example : https://my.mattermost.host/hooks/yourveryrandomkey
|
|
url =
|
|
|
|
# Cuckoo host URL to make analysis ID clickable.
|
|
# example : https://my.cuckoo.host/
|
|
myurl =
|
|
|
|
# Username to show when posting message
|
|
username = cuckoo
|
|
|
|
# What kind of data to show apart from default.
|
|
# Show virustotal hits.
|
|
show_virustotal = no
|
|
|
|
# Show matched cuckoo signatures.
|
|
show_signatures = no
|
|
|
|
# Show collected URL-s by signature "network_http".
|
|
show_urls = no
|
|
|
|
# Hide filename and create hash of it
|
|
hash_filename = no
|
|
# Hide URL and create hash of it
|
|
hash_url = no
|