-
Notifications
You must be signed in to change notification settings - Fork 365
/
rita.yaml
291 lines (251 loc) · 13 KB
/
rita.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
# This section configures the connection to the MongoDB server and the database name to use
MongoDB:
# See https://docs.mongodb.com/manual/reference/connection-string/
ConnectionString: mongodb://localhost:27017
# Example with authentication. Be sure to change the AuthenticationMechanism as well.
# ConnectionString: mongodb://username:password@localhost:27017
# Accepted Values: null, "SCRAM-SHA-1", "MONGODB-CR", "PLAIN"
# Since Mongo version 3.0 the default authentication mechanism is SCRAM-SHA-1
AuthenticationMechanism: null
# The time in hours before RITA's connection to MongoDB times out. 0 waits indefinitely.
SocketTimeout: 2
# For encrypting data on the wire between RITA and MongoDB
TLS:
Enable: false
#If set, RITA will verify the MongoDB certificate's hostname and validity
VerifyCertificate: false
#If set, RITA will use the provided CA file instead of the system's CA's
CAFile: null
# This database holds information about the procesed files and databases.
MetaDB: MetaDatabase
Rolling:
# This is the default number of chunks to keep in rolling databases.
# This only is used if the --numchunks command argument isn't supplied.
DefaultChunks: 24
LogConfig:
# LogLevel
# 3 = debug
# 2 = info
# 1 = warn
# 0 = error
LogLevel: 2
# LogPath is the path for Rita's logs. Make sure permissions are set accordingly.
# Logs will only be written here if LogToFile is true
RitaLogPath: /var/lib/rita/logs
LogToFile: true
LogToDB: true
UserConfig:
# Number of days before checking for a new version of RITA.
# A value of zero here will disable checking.
UpdateCheckFrequency: 14
Filtering:
# These are filters that affect the import of connection logs. They
# currently do not apply to dns or http logs.
# A good reference for networks you may wish to consider is RFC 5735.
# https://tools.ietf.org/html/rfc5735#section-4
# Example: AlwaysInclude: ["192.168.1.2/32"]
# This functionality overrides the NeverInclude and InternalSubnets
# section, making sure that any connection records containing addresses from
# this range are kept and not filtered
AlwaysInclude: []
# Example: NeverInclude: ["255.255.255.255/32"]
# This functions as a whitelisting setting, and connections involving
# ranges entered into this section are filtered out at import time
NeverInclude:
- 0.0.0.0/32 # "This" Host RFC 1122, Section 3.2.1.3
- 127.0.0.0/8 # Loopback RFC 1122, Section 3.2.1.3
- 169.254.0.0/16 # Link Local RFC 3927
- 224.0.0.0/4 # Multicast RFC 3171
- 255.255.255.255/32 # Limited Broadcast RFC 919, Section 7
- ::1/128 # Loopback RFC 4291, Section 2.5.3
- fe80::/10 # Link local RFC 4291, Section 2.5.6
- ff00::/8 # Multicast RFC 4291, Section 2.7
# Example: InternalSubnets: ["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"]
# This allows a user to identify their internal network, which will result
# in any internal to internal and external to external connections being
# filtered out at import time. Reasonable defaults are provided below
# but need to be manually verified against each installation before enabling.
InternalSubnets:
- 10.0.0.0/8 # Private-Use Networks RFC 1918
- 172.16.0.0/12 # Private-Use Networks RFC 1918
- 192.168.0.0/16 # Private-Use Networks RFC 1918
# Example: AlwaysIncludeDomain: ["mydomain.com","*.mydomain.com"]
# This functionality overrides the NeverIncludeDomain
# section, making sure that any connection records containing domains
# that match this list are kept and not filtered
# NOTE: When using wildcards, make sure the added entry is in quotes,
# ie, '*.mydomain.com'. Only subdomain wildcarding
# (asterisk as the prefix) is supported
AlwaysIncludeDomain: []
# Example: NeverIncludeDomain: ["mydomain.com","*.mydomain.com"]
# This functions as a whitelisting setting, and connections involving
# ranges entered into this section are filtered out at import time
# NOTE: When using wildcards, make sure the added entry is in quotes,
# ie, '*.mydomain.com'. Only subdomain wildcarding
# (asterisk as the prefix) is supported
NeverIncludeDomain: []
# FilterExternalToInternal will ignore any entries where communication
# is occurring from an external host to an internal host
FilterExternalToInternal: true
BlackListed:
Enabled: true
# These are blacklists built into rita-blacklist. Set these to false
# to disable checks against them.
feodotracker.abuse.ch: true
# This is the name of the database which will be created as a master list of
# blacklisted ips and hostnames by rita-blacklist
BlacklistDatabase: "rita-bl"
# These are custom blacklists that you may define. They are lists of either
# file paths or urls. These custom blacklists are expected to be simple,
# line separated text documents containing a list of blacklisted entries.
# Example: CustomIPBlacklists: ["$HOME/.rita/myIPBlacklist.txt"]
# myIPBlacklist.txt would look like this:
# 192.168.0.1
# 10.10.174.1
# Lists containing both IPv4 and IPv6 addresses are acceptable
CustomIPBlacklists: []
# Lists containing hostnames, domain names, and FQDNs are acceptable
CustomHostnameBlacklists: []
Beacon:
Enabled: true
# The default minimum number of connections used for beacons analysis.
# Any two hosts connecting fewer than this number will not be analyzed. You can
# safely increase this value to improve performance if you are not concerned
# about slow beacons.
# Note: Since analyzing hosts that have fewer than at least one connection per
# hour could significantly increase both the analysis time and the number
# of false positives, 23 is the minimum allowed value for this field.
DefaultConnectionThresh: 23
# The score is currently comprised of a weighted average of 4 subscores.
# While we recommend the default setting of 0.25 for each weight,
# these weights can be altered here according to your needs.
# The sum of all the floating point weights must be equal to 1.
TimestampScoreWeight: 0.25
DatasizeScoreWeight: 0.25
DurationScoreWeight: 0.25
HistogramScoreWeight: 0.25
# The number of hours seen in a connection graph representation of a beacon must
# be greater than this threshold for an overall duration score to be calculated.
# Default value: 6
DurationMinHoursSeen: 6
# This is the minimum number of hours seen in a connection graph representation
# of a beacon for the consistency subscore of duration to score at 100%
# Default value: 12 (half the day)
DurationConsistencyIdealHoursSeen: 12
# The histogram score has a subscore that attempts to detect multiple
# flat sections in a connection graph representation of a beacon. The
# variable below controls the bucket size for grouping connections. This
# is expressed as a percentage of the largest connection count. For example,
# if the max connection count is 400 and this variable is set to 0.05 (5%),
# the bucket size will be 20 (400*0.05=20). As you make this variable
# larger, the algorithm becomes more forgiving to variation.
# Default value 0.05
HistogramBimodalBucketSize: 0.05
# This is the number of buckets that can be considered outliers and dropped
# from the calculation.
# Default value: 1
HistogramBimodalOutlierRemoval: 1
# This is the minimum number of hours seen in a connection graph representation
# of a beacon before the bimodal subscore score is used.
# Default value: 11 (sets the minimum coverage to just below half of the day)
HistogramBimodalMinHoursSeen: 11
BeaconSNI:
Enabled: true
# The default minimum number of connections used for beacons SNI analysis.
# Any two hosts connecting fewer than this number will not be analyzed. You can
# safely increase this value to improve performance if you are not concerned
# about slow beacons.
# Note: Since analyzing hosts that have fewer than at least one connection per
# hour could significantly increase both the analysis time and the number
# of false positives, 23 is the minimum allowed value for this field.
DefaultConnectionThresh: 23
# The score is currently comprised of a weighted average of 4 subscores.
# While we recommend the default setting of 0.25 for each weight,
# these weights can be altered here according to your needs.
# The sum of all the floating point weights must be equal to 1.
TimestampScoreWeight: 0.25
DatasizeScoreWeight: 0.25
DurationScoreWeight: 0.25
HistogramScoreWeight: 0.25
# The number of hours seen in a connection graph representation of a beacon must
# be greater than this threshold for an overall duration score to be calculated.
# Default value: 6
DurationMinHoursSeen: 6
# This is the minimum number of hours seen in a connection graph representation
# of a beacon for the consistency subscore of duration to score at 100%
# Default value: 12 (half the day)
DurationConsistencyIdealHoursSeen: 12
# The histogram score has a subscore that attempts to detect multiple
# flat sections in a connection graph representation of a beacon. The
# variable below controls the bucket size for grouping connections. This
# is expressed as a percentage of the largest connection count. For example,
# if the max connection count is 400 and this variable is set to 0.05 (5%),
# the bucket size will be 20 (400*0.05=20). As you make this variable
# larger, the algorithm becomes more forgiving to variation.
# Default value 0.05
HistogramBimodalBucketSize: 0.05
# This is the number of buckets that can be considered outliers and dropped
# from the calculation.
# Default value: 1
HistogramBimodalOutlierRemoval: 1
# This is the minimum number of hours seen in a connection graph representation
# of a beacon before the subscore score is used.
# Default value: 11 (sets the minimum coverage to just below half of the day)
HistogramBimodalMinHoursSeen: 11
BeaconProxy:
Enabled: true
# The default minimum number of connections used for beacons proxy analysis.
# Any two hosts connecting fewer than this number will not be analyzed. You can
# safely increase this value to improve performance if you are not concerned
# about slow beacons.
# Note: Since analyzing hosts that have fewer than at least one connection per
# hour could significantly increase both the analysis time and the number
# of false positives, 23 is the minimum allowed value for this field.
DefaultConnectionThresh: 23
# The score is currently comprised of a weighted average of 3 subscores.
# While we recommend the default setting of 0.333 for each weight,
# these weights can be altered here according to your needs.
# The sum of all the floating point weights must be equal to 1
TimestampScoreWeight: 0.333
DurationScoreWeight: 0.333
HistogramScoreWeight: 0.333
# The number of hours seen in a connection graph representation of a beacon must
# be greater than this threshold for an overall duration score to be calculated.
# Default value: 6
DurationMinHoursSeen: 6
# This is the minimum number of hours seen in a connection graph representation
# of a beacon for the consistency subscore of duration to score at 100%
# Default value: 12 (half the day)
DurationConsistencyIdealHoursSeen: 12
# The histogram score has a subscore that attempts to detect multiple
# flat sections in a connection graph representation of a beacon. The
# variable below controls the bucket size for grouping connections. This
# is expressed as a percentage of the largest connection count. For example,
# if the max connection count is 400 and this variable is set to 0.05 (5%),
# the bucket size will be 20 (400*0.05=20). As you make this variable
# larger, the algorithm becomes more forgiving to variation.
# Default value 0.05
HistogramBimodalBucketSize: 0.05
# This is the number of buckets that can be considered outliers and dropped
# from the calculation.
# Default value: 1
HistogramBimodalOutlierRemoval: 1
# This is the minimum number of hours seen in a connection graph representation
# of a beacon before the subscore score is used.
# Default value: 11 (sets the minimum coverage to just below half of the day)
HistogramBimodalMinHoursSeen: 11
DNS:
Enabled: true
UserAgent:
Enabled: true
Strobe:
# This sets the maximum number of connections between any two given hosts that are stored.
# Connections above this limit will be deleted and not used in other analysis modules. This will
# also trigger an entry in the strobe module. A lower value will reduce import & analysis time and
# hide more potential false positives from other modules. A higher value will increase import &
# analysis time, increase false positives, but reduce the risk of false negatives.
# Note: Since this value must be low enough to ensure that documents that store
# arrays based off of connections will not grow beyond 16MB in size, the maximum value allowed
# for this field is:
# 86400 - One connection every second for 24 hours
ConnectionLimit: 86400