nfr/config.yml at master · 5up3rc/nfr · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
# This is the Network Flight Recorder (NFR) configuration file. Here you define the location of the
# DNS Analytics API and key, and the way in which the NFR application will
# monitor network traffic, store data, and submit events to the API for scoring.
# Please contact support@alphasoc.com if you have any questions.

################################################################################
# AlphaSOC DNS Analytics server location and API key
################################################################################

alphasoc:

  # Location of the server (e.g. cloud or on-premise operation)
  # Default: https://api.alphasoc.net
  host: https://api.alphasoc.net

  # Your AlphaSOC API key (required to use the service)
  # Use "nfr account register" to generate one
  api_key: test-api-key

################################################################################
# Define the network interface and protocol(s) to monitor
################################################################################

network:

  # Interface to listen for DNS events on (e.g. eth0)
  interface: <interface-name>

  # Protocols to process (possible values are udp and tcp)
  protocols:
  - udp

  # Port to monitor for DNS traffic on
  port: 53

################################################################################
# Logging configuration
################################################################################

log:

  # File to which nfr should log
  # To print log to console use two special outputs: stderr or stdout
  # Default: stdout
  file: stdout

  # Logging level. Possibles values are: debug, info, warn, error
  # Default: info
  level: info

################################################################################
# Internal NFR data location
################################################################################

data:

  # Define the file for internal data and caching
  # Default (Linux): /run/nfr.data
  file: /run/nfr.data

################################################################################
# Monitoring scope file location
################################################################################

scope:

   # Monitoring scope file to load
   # Default: (none)
  file:

################################################################################
# AlphaSOC events configuration
################################################################################

events:

  # Location to which events should be written. This can be a file, or a special
  # ouput (stderr or stdout) to print events to the terminal
  # Default: stdout
  file: stdout

  # Interval for polling events from the DNS Analytics API
  # Default: 5m
  poll_interval: 5m

################################################################################
# DNS queries (data queuing and processing) configuration
################################################################################

queries:

  # NFR buffer size for the DNS event queue
  # Default: 65535
  buffer_size: 65535

  # Interval for flushing data to DNS Analytics API for scoring
  # Default: 30s
  flush_interval: 30s

  # If NFR is unable to send DNS events to the API for processing, it can
  # write the events to disk (in PCAP format) and attempt to send them again
  failed:
    # File in which to store unprocessed DNS events on disk
    # Default: (none)
    file: