-
Notifications
You must be signed in to change notification settings - Fork 41
/
config.yml-sample
95 lines (86 loc) · 3.09 KB
/
config.yml-sample
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
################################################
# FalconHound Configuration File
################################################
# This file contains the configuration for FalconHound
# Add your API keys here in the proper section
################################################
# Add your Keyvault information here
# This is optional, when used, FalconHound will pull the
# API keys from Keyvault instead of this file
# start with the -keyvault flag
################################################
keyvault:
uri: https://XXXXXXXX.vault.azure.net/
tenantID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appSecret: xxxxxxxxxxxxxx
################################################
# Add your Sentinel connection information here
################################################
sentinel:
workspaceID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
subscriptionID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
resourceGroup: "XXXXXXX"
sharedKey: xxxxxxxxxxxxxx
targetTable: "FalconHound"
tenantID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appSecret: xxxxxxxxxxxxxx
workspaceName: "XXXXXXXX"
################################################
# Add your MDE connection information here
# This can be the same app as Sentinel
# or preferably a different one
################################################
MDE:
tenantID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appSecret: xxxxxxxxxxxxxx
################################################
# Add your Neo4j connection information here
################################################
neo4j:
uri: bolt://XX.XX.XX.XX:7687
password: xxxxxxxxxxxxxx
username: neo4j
################################################
# Add your BloodHound connection information here
################################################
bloodhound:
url: http://xxxxx:8080
tokenID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
tokenKey: xxxxxxxxxxxxxx==
################################################
# Add your Splunk connection information here
################################################
splunk:
url: https://10.10.2.140
index: wineventlog
hecport: 8088
hectoken: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
apiport: 8089
apitoken:
################################################
# Add your LogScale / Humio connection information here
################################################
logscale:
url: https://cloud.community.humio.com
token:
repository:
################################################
# Add your Elastic cloud connection information here
################################################
elastic:
cloudid:
apikey:
################################################
# Add your Azure Data Explorer connection information here
# This can be the same app as Sentinel or a different one
################################################
adx:
clusterUrl: https://xxx.westeurope.kusto.windows.net
database: enrichments
table: FalconHound
tenantID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appSecret: xxxxxxxxxxxxxx