<commit_before>%YAML 1.1
---
# Alertflex collector configuration file. In addition to the comments describing
# the parameters for this file, see project documentation - http://alertflex.org/doc/index.html

# Collector version 0.7
collector:
  node: "_node_id"
  sensor: "_sensor_id"
  
  # allow remote management of collector from controller
  active_response: "true"
  remote_upload: "true"
      
  # time difference between collector and controller's, timezones in hours
  time_zone: 0
  # save events/logs to local path - /var/log/alertflex, if controller isn't available
  # max size (MB) of the log file, if size more than this value, collector switches to the next log file
  log_size: 100
  # alerts threshold, if the threshold is exceeded, collector omits all others alerts until Redis list is not empty
  # also special alert about multiple alerts will appear (redirection of alerts to logs will not interrupted)
  alerts_threshold: 100
  
  # TIMERS
  # delay on collector startup in sec (default 30)
  startup_timer: 30  
  # sleep delay in milisecond (default 1000)
  sleep_timer:   1000  
  # period generation of reports for netflow and IDS statistics in sec, if 0 then this functionality is off (default 300)
  report_timer: 300  
  # run update of rules on sensor side after that sync them with central node
  update_timer: 1
    
  # path to MaxMind Geo DB
  geo_db: "/etc/alertflex/GeoLiteCity.dat"
  
  # Altprobe reads via Wazuh API an OSSEC agents status (use report_timer for period of reading)
  wazuh_host: "127.0.0.1"
  wazuh_port: 55000  
  wazuh_user: "_wazuh_user"
  wazuh_pwd: <PASSWORD>"
    
  # Altprobe reads sources events from Redis list by pop API call
  redis_host: "127.0.0.1"
  redis_port: 6379 
  
sources:
  # for reading of events from metricbeat and altprobe client (misc) only Redis intefrace can be used 
  metric: "altprobe_metrics"
  misc: "altprobe_misc"
  
  # Altprobe can read events of suricata, wazuh and modsec directly from log files
  # if xxx_log is "none" redis interface will be used
  
  # modsec_log: "/var/log/nginx/error.log"
  modsec_log: "none"
  modsec_redis: "altprobe_waf" 
  # path for config file - /etc/nginx/modsec/
  modsec_path: "none"
  # path for update ip-reputation list and rules - /etc/nginx/modsec/rules/
  # need add rule - SecRule REQUEST_HEADERS:User-Agent "@pmFromFile /etc/nginx/modsec/rules/waf-black.list" "id:167"
  modsec_iprep: "/etc/nginx/modsec/rules/" 
  # owasp_rules: "/usr/local/owasp-modsecurity-crs-3.0.2/"
  modsec_rules: "/usr/local/owasp-modsecurity-crs-3.0.2/"
  
  # suri_log: "/var/log/suricata/eve.json"
  suri_log: "none"
  suri_redis: "altprobe_nids"
  # path to config file - /etc/suricata/suricata.yaml
  suri_path: "/etc/suricata/" 
  # path for update ip-reputation list - /etc/suricata/iprep/nids-black.list
  # set in file suricata.yaml the param - default-reputation-path: /etc/suricata/iprep & param - reputation-files:
  suri_iprep: "/etc/suricata/iprep/"
  # /var/lib/suricata/rules/ or /etc/suricata/rules/
  suri_rules: "/etc/suricata/rules/"
  
  # wazuh_log: "/var/ossec/logs/alerts/alerts.json"
  wazuh_log: "none"
  wazuh_redis: "altprobe_hids"
  # path to config file - /var/ossec/etc/ossec.conf
  wazuh_path: "/var/ossec/"
  # path for update ip-reputation list - /var/ossec/etc/lists/hids-black.list
  # add to ossec.conf <ruleset><list>etc/lists/hids-black.list</list>
  wazuh_iprep: "/var/ossec/etc/lists/"
  
controller:
  # send alerts and statistics to Controller (ActiveMQ interface)
  amq: "ssl://_amq_host:61617"
  user: "_amq_user"
  pwd: <PASSWORD>"
  cert: "/etc/alertflex/Broker.pem"
  path: "jms/alertflex/"



  

  
  



<commit_msg>Update alertflex.yaml<commit_after>%YAML 1.1
---
# Alertflex collector configuration file. In addition to the comments describing
# the parameters for this file, see project documentation - http://alertflex.org/doc/index.html

# Collector version 0.7
collector:
  node: "_node_id"
  sensor: "_sensor_id"
  
  # allow remote management of collector from controller
  active_response: "true"
  remote_upload: "true"
      
  # time difference between collector and controller's, timezones in hours
  time_zone: 0
  # save events/logs to local path - /var/log/alertflex, if controller isn't available
  # max size (MB) of the log file, if size more than this value, collector switches to the next log file
  log_size: 100
  # alerts threshold, if the threshold is exceeded, collector omits all others alerts until Redis list is not empty
  # also special alert about multiple alerts will appear (redirection of alerts to logs will not interrupted)
  alerts_threshold: 100
  
  # TIMERS
  # delay on collector startup in sec (default 30)
  startup_timer: 30  
  # sleep delay in milisecond (default 1000)
  sleep_timer:   1000  
  # period generation of reports for netflow and IDS statistics in sec, if 0 then this functionality is off (default 300)
  report_timer: 300  
  # run update of rules on sensor side after that sync them with central node
  update_timer: 1
    
  # path to MaxMind Geo DB
  geo_db: "/etc/alertflex/GeoLiteCity.dat"
  
  # Altprobe reads via Wazuh API an OSSEC agents status (use report_timer for period of reading)
  wazuh_host: "127.0.0.1"
  wazuh_port: 55000  
  wazuh_user: "_wazuh_user"
  wazuh_pwd: <PASSWORD>"
    
  # Altprobe reads sources events from Redis list by pop API call
  redis_host: "127.0.0.1"
  redis_port: 6379 
  
sources:
  # for reading of events from metricbeat and altprobe client (misc) only Redis intefrace can be used 
  metric: "altprobe_metrics"
  misc: "altprobe_misc"
  
  # Altprobe can read events of suricata, wazuh and modsec directly from log files
  # if xxx_log is "none" redis interface will be used
  
  # modsec_log: "/var/log/nginx/error.log"
  modsec_log: "none"
  modsec_redis: "altprobe_waf" 
  # path for config file - /etc/nginx/modsec/
  modsec_path: "none"
  # path for update ip-reputation list and rules - /etc/nginx/modsec/rules/
  # need add rule - SecRule REQUEST_HEADERS:User-Agent "@pmFromFile /etc/nginx/modsec/rules/waf-black.list" "id:167"
  modsec_iprep: "/etc/nginx/modsec/rules/" 
  # owasp_rules: "/usr/local/owasp-modsecurity-crs-3.0.2/"
  modsec_rules: "/usr/local/owasp-modsecurity-crs-3.0.2/"
  
  # suri_log: "/var/log/suricata/eve.json"
  suri_log: "none"
  suri_redis: "altprobe_nids"
  # path to config file - /etc/suricata/suricata.yaml
  suri_path: "/etc/suricata/" 
  # path for update ip-reputation list - /etc/suricata/iprep/nids-black.list
  # set in file suricata.yaml the param - default-reputation-path: /etc/suricata/iprep & param - reputation-files:
  suri_iprep: "/etc/suricata/iprep/"
  # /var/lib/suricata/rules/ or /etc/suricata/rules/
  suri_rules: "/etc/suricata/rules/"
  
  wazuh_log: "/var/ossec/logs/alerts/alerts.json"
  # wazuh_log: "none"
  wazuh_redis: "altprobe_hids"
  # path to config file - /var/ossec/etc/ossec.conf
  wazuh_path: "/var/ossec/"
  # path for update ip-reputation list - /var/ossec/etc/lists/hids-black.list
  # add to ossec.conf <ruleset><list>etc/lists/hids-black.list</list>
  wazuh_iprep: "/var/ossec/etc/lists/"
  
controller:
  # send alerts and statistics to Controller (ActiveMQ interface)
  amq: "ssl://_amq_host:61617"
  user: "_amq_user"
  pwd: <PASSWORD>"
  cert: "/etc/alertflex/Broker.pem"
  path: "jms/alertflex/"



  

  
  




{'fraction_non_alphanumeric': 0.10059733912571274, 'fraction_numerical': 0.017920173771382025, 'mean_word_length': 3.5279655808236017, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1321604', 'n_tokens_mistral': 2753, 'n_tokens_neox': 2583, 'n_words': 759}