<commit_before># EveBox Server configuration file.

# Path to the data directory. This directory holds data for EveBox such as the
# authentication database (not yet implemented), and SQLite database files if
# the sqlite database is being used. It needs to be writable by the user
# EveBox is running as. If not set it will default to the current directory.
#data-directory:

# Database configuration.
database:

  # Database type: elasticsearch, sqlite.
  type: elasticsearch

  elasticsearch:
    url: http://10.16.1.10:9200
    index: logstash
    disable-certificate-check: false

    # The keyword to use for terms query. EveBox will do its best to
    # figure this out on its own, but if you need to override it, you
    # can do so here. The usual values are:
    #    raw     -> Logstash / Elastic Search < 5.
    #    keyword -> Logstash / Elastic Search >= 5.
    #    ""      -> Filebeat / Elastic Search >= 5.
    # Note that a quoted empty string is required to force an empty string.
    #keyword: ""

    #username: username
    #password: password

  # Retention period in days. 0 or comment out to disable.
  #retention-period: 3

# The server can process a log file, eliminating the need for a
# separate agent process if on the same machine.
input:
  # Toggle to disable the input without commenting it out.
  enabled: false

  # Filename to read.
  filename: "/var/log/suricata/eve.json"

  # Bookmark directory, as with the agent if the server can't write to
  # the directory where the above log file is, you need to provide
  # this.
  #bookmark-directory: /var/lib/evebox

  # Custom fields to add to the event. Only top level fields can be set,
  # and only simple values (string, integer) can be set.
  custom-fields:
    # Set a host field. This will override the "host" field set by
    # Suricata if the Suricata "sensor-name" option is set.
    #host: "evebox-server"

geoip:
  disabled: false
  # Path to the MaxMind database. This must be the version 2 database
  # (http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz)
  # File must be ungzipped.
  #
  # This is temporary, EveBox will eventually support downloading and
  # updateing the geo database itself.
  database: /etc/evebox/GeoLite2-City.mmdb

# Event services: links that will be provided on events to link to additonal
# services.
event-services:

  # Custom service to link the rule in Scirius.
  - type: custom
    enabled: true
    name: Scirius

    # Only make available for alert types.
    event-types:
      - alert

    # URL template. All eve values can be used.
    url: https://10.16.1.179/rules/rule/{{alert.signature_id}}

  # Custom service to link to Dumpy for full packet capture.
  #
  # This one has no event-types meaning its available for all event types.
  - type: custom
    enabled: true
    name: Dumpy

    # The URL template, {{raw}} expands to the raw eve event as a JSON
    # string which is then url encoded.
    url: http://10.16.1.1:7000/?event={{raw}}

    # Open in new window. The default is the same window.
    target: new<commit_msg>config: disable event-services by default<commit_after># EveBox Server configuration file.

# Path to the data directory. This directory holds data for EveBox such as the
# authentication database (not yet implemented), and SQLite database files if
# the sqlite database is being used. It needs to be writable by the user
# EveBox is running as. If not set it will default to the current directory.
#data-directory:

# Database configuration.
database:

  # Database type: elasticsearch, sqlite.
  type: elasticsearch

  elasticsearch:
    url: http://10.16.1.10:9200
    index: logstash
    disable-certificate-check: false

    # The keyword to use for terms query. EveBox will do its best to
    # figure this out on its own, but if you need to override it, you
    # can do so here. The usual values are:
    #    raw     -> Logstash / Elastic Search < 5.
    #    keyword -> Logstash / Elastic Search >= 5.
    #    ""      -> Filebeat / Elastic Search >= 5.
    # Note that a quoted empty string is required to force an empty string.
    #keyword: ""

    #username: username
    #password: password

  # Retention period in days. 0 or comment out to disable.
  #retention-period: 3

# The server can process a log file, eliminating the need for a
# separate agent process if on the same machine.
input:
  # Toggle to disable the input without commenting it out.
  enabled: false

  # Filename to read.
  filename: "/var/log/suricata/eve.json"

  # Bookmark directory, as with the agent if the server can't write to
  # the directory where the above log file is, you need to provide
  # this.
  #bookmark-directory: /var/lib/evebox

  # Custom fields to add to the event. Only top level fields can be set,
  # and only simple values (string, integer) can be set.
  custom-fields:
    # Set a host field. This will override the "host" field set by
    # Suricata if the Suricata "sensor-name" option is set.
    #host: "evebox-server"

geoip:
  disabled: false
  # Path to the MaxMind database. This must be the version 2 database
  # (http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz)
  # File must be ungzipped.
  #
  # This is temporary, EveBox will eventually support downloading and
  # updateing the geo database itself.
  database: /etc/evebox/GeoLite2-City.mmdb

# Event services: links that will be provided on events to link to additonal
# services.
event-services:

  # Custom service to link the rule in Scirius.
  - type: custom
    enabled: false
    name: Scirius

    # Only make available for alert types.
    event-types:
      - alert

    # URL template. All eve values can be used.
    url: https://10.16.1.179/rules/rule/{{alert.signature_id}}

  # Custom service to link to Dumpy for full packet capture.
  #
  # This one has no event-types meaning its available for all event types.
  - type: custom
    enabled: false
    name: Dumpy

    # The URL template, {{raw}} expands to the raw eve event as a JSON
    # string which is then url encoded.
    url: http://10.16.1.1:7000/?event={{raw}}

    # Open in new window. The default is the same window.
    target: new
{'fraction_non_alphanumeric': 0.07922705314009662, 'fraction_numerical': 0.011916264090177134, 'mean_word_length': 2.96109693877551, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 13, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '69584', 'n_tokens_mistral': 1884, 'n_tokens_neox': 1789, 'n_words': 817}