timesketch.conf

# Timesketch configuration

# Show debug information.
# Note: It is a security risk to have this enabled in production.
DEBUG = False

# Enable performance profiling for all backend requests.
# Profiling data will be written as .prof files to a `profiles/` directory
# in either the project root (dev) or /var/log/timesketch/ (release).
ENABLE_PROFILING = False

# Key for signing cookies and for CSRF protection.
#
# This should be a unique random string. Don't share this with anyone.
# To generate a key, you can for example use openssl:
# $ openssl rand -base64 32
SECRET_KEY = "<KEY_GOES_HERE>"

# Setup the database.
#
# For more options, see the official documentation:
# https://pythonhosted.org/Flask-SQLAlchemy/config.html
# By default sqlite is used.
#
# NOTE: SQLite should only be used in development. Use PostgreSQL or MySQL in
# production.
SQLALCHEMY_DATABASE_URI = "postgresql://<USERNAME>:<PASSWORD>@localhost/timesketch"
SQLALCHEMY_ENGINE_OPTIONS = {"pool_pre_ping": True, "pool_recycle": 3600}

# Configure where your OpenSearch server is located.
#
# Make sure that the OpenSearch server is properly secured and not accessible
# from the internet. See the following link for more information:
# https://opensearch.org/docs/latest/getting-started/security/
OPENSEARCH_HOSTS = [{"host": "opensearch", "port": 9200}]
OPENSEARCH_USER = None
OPENSEARCH_PASSWORD = None
OPENSEARCH_SSL = False
OPENSEARCH_VERIFY_CERTS = True
OPENSEARCH_CA_CERTS = None
OPENSEARCH_TIMEOUT = 10
OPENSEARCH_FLUSH_INTERVAL = 5000
OPENSEARCH_FLUSH_BYTE_SIZE = 52428800
OPENSEARCH_INDEX_WAIT_TIMEOUT = 10
OPENSEARCH_MINIMUM_HEALTH = "yellow"
# Be careful when increasing the upper limit since this will impact your
# OpenSearch clusters performance and storage requirements!
OPENSEARCH_MAPPING_BUFFER = 0.1
OPENSEARCH_MAPPING_UPPER_LIMIT = 1000

# Set the default preference for wildcard search in user settings.
# If set to True, new users will default to wildcard search instead of classic search.
OPENSEARCH_WILDCARD_DEFAULT = False

# Define what labels should be defined that make it so that a sketch and
# timelines will not be deleted. This can be used to add a list of different
# labels that ensure that a sketch and it's associated timelines cannot be
# deleted.
LABELS_TO_PREVENT_DELETION = ["protected", "preserved"]

# Number of seconds before a timeout occurs in bulk operations in the
# OpenSearch client.
TIMEOUT_FOR_EVENT_IMPORT = 180

# Location for the configuration file of the data finder.
DATA_FINDER_PATH = "/etc/timesketch/data_finder.yaml"

# -------------------------------------------------------------------------------
# Single Sign On (SSO) configuration.

# Your web server can handle authentication for you by setting a environment
# variable when the user is successfully authenticated. The standard environment
# variable is REMOTE_USER and this is the default, but if your SSO system uses
# another name you can configure that here.

SSO_ENABLED = False
SSO_USER_ENV_VARIABLE = "REMOTE_USER"

# Some SSO systems provides group information as environment variable.
# Timesketch can automatically create groups and add users as members.
# To enable this feature just provide the environment variable used in the SSO
# system of use.
SSO_GROUP_ENV_VARIABLE = None

# Different systems use different separators in the string returned in the
# environment variable.
SSO_GROUP_SEPARATOR = ";"

# Some SSO systems uses a special prefix for the group name to indicate that
# the user is not a member of that group. Set this if that is the case, i.e.
# '-'.
SSO_GROUP_NOT_MEMBER_SIGN = None

# -------------------------------------------------------------------------------
# Google Cloud Identity-Aware Proxy (Cloud IAP) authentication configuration.

# Cloud IAP controls access to your Timesketch server running on Google Cloud
# Platform. Cloud IAP works by verifying a user’s identity and determining if
# that user should be allowed to access the server.
#
# For this feature you will need to configure your Cloud IAP and HTTPS load-
# balancer. Follow the official documentation to get everything ready:
# https://cloud.google.com/iap/docs/enabling-compute-howto

# Enable Cloud IAP authentication support.
GOOGLE_IAP_ENABLED = False

# This information is available via the Google Cloud console:
# https://cloud.google.com/iap/docs/signed-headers-howto
GOOGLE_IAP_PROJECT_NUMBER = ""
GOOGLE_IAP_BACKEND_ID = ""

# DON'T EDIT: Google IAP expected audience is based on Cloud project number and
# backend ID.
GOOGLE_IAP_AUDIENCE = "/projects/{}/global/backendServices/{}".format(
    GOOGLE_IAP_PROJECT_NUMBER, GOOGLE_IAP_BACKEND_ID
)

GOOGLE_IAP_ALGORITHM = "ES256"
GOOGLE_IAP_ISSUER = "https://cloud.google.com/iap"
GOOGLE_IAP_PUBLIC_KEY_URL = "https://www.gstatic.com/iap/verify/public_key"

# -------------------------------------------------------------------------------
# Google Cloud OpenID Connect (OIDC) authentication configuration.

# Cloud OIDC controls access to your Timesketch server running on Google Cloud
# Platform. Cloud OIDC works by verifying a user’s identity and determining if
# that user should be allowed to access the server.

# Enable Cloud OIDC authentication support.
# For Google's federated identity, leave AUTH_URI and DICOVERY_URL to None.
# For others, refer to your OIDC provider configuration. Configuration can be
# obtain from the discovery url. eg. https://accounts.google.com/.well-known/openid-configuration

# Some OIDC providers expects a specific Algorithm. If so, specify in ALGORITHM.
# Eg. HS256, HS384, HS512, RS256, RS384, RS512.
# For Google, leave it to None

GOOGLE_OIDC_ENABLED = False

GOOGLE_OIDC_AUTH_URL = None
GOOGLE_OIDC_DISCOVERY_URL = None
GOOGLE_OIDC_ALGORITHM = None

GOOGLE_OIDC_CLIENT_ID = None
GOOGLE_OIDC_CLIENT_SECRET = None

# If you need to authenticate an API client using OIDC you need to create
# an OAUTH client for "other", or for native applications.
# https://developers.google.com/identity/protocols/OAuth2ForDevices
GOOGLE_OIDC_API_CLIENT_ID = None

# List of additional allowed GOOGLE OIDC clients that can authenticate to the APIs
GOOGLE_OIDC_API_CLIENT_IDS = []

# Limit access to a specific Google GSuite domain.
GOOGLE_OIDC_HOSTED_DOMAIN = None

# Additional Google GSuite domains allowed API access.
GOOGLE_OIDC_API_ALLOWED_DOMAINS = []

# If populated only these users (email addresses) will be able to login to
# this server. This can be used when access should be limited to a specific
# set of users.
GOOGLE_OIDC_ALLOWED_USERS = []

# If populated these users will be able to login using the local database
# even if Google OIDC is enabled.
LOCAL_AUTH_ALLOWED_USERS = []

# -------------------------------------------------------------------------------
# Upload and processing of Plaso storage files.

# To enable this feature you need to configure an upload directory and
# how to reach the Redis database used by the distributed task queue.
UPLOAD_ENABLED = False

# Folder for temporarily storage of Plaso dump files before being processed and
# inserted into the datastore.
UPLOAD_FOLDER = "/tmp"

# File write permission for uploaded files
UPLOAD_FILE_PERMISSION = 0o640

# Celery broker configuration. You need to change ip/port to where your Redis
# server is running.
CELERY_BROKER_URL = "redis://127.0.0.1:6379"
CELERY_RESULT_BACKEND = "redis://127.0.0.1:6379"

# File location to store the mappings used when OpenSearch indices are created
# for plaso files.
PLASO_MAPPING_FILE = "/etc/timesketch/plaso.mappings"
GENERIC_MAPPING_FILE = "/etc/timesketch/generic.mappings"

# Override/extend Plaso default message string formatters.
PLASO_FORMATTERS = "/etc/timesketch/plaso_formatters.yaml"

# Upper limits for the process memory that psort.py is allocated when ingesting
# plaso files. The size is in bytes, with the default value of
# 4294967296 or 4 GiB.
PLASO_UPPER_MEMORY_LIMIT = None

# Directory to store Plaso (psort) log files.
# If this is set, psort will write execution logs here.
# If this is NOT set, logs will be discarded to /dev/null.
# WARNING: These logs can be large. Ensure you have log rotation configured!
PLASO_LOG_FOLDER = "/var/log/timesketch/psort/"

# -------------------------------------------------------------------------------
# Analyzers.

# Which analyzers to run automatically.
AUTO_SKETCH_ANALYZERS = []

# Optional specify any default arguments to pass to analyzers.
# The format is:
# {'analyzer1_name': {
#     'param1': 'value'
#   },
#   {'analyzer2_name': {
#       'param1': 'value'
#     }
#   }
# }
AUTO_SKETCH_ANALYZERS_KWARGS = {}
ANALYZERS_DEFAULT_KWARGS = {}

# Add all domains that are relevant to your enterprise here.
# All domains in this list are added to the list of watched
# domains and compared to other domains in the timeline to
# attempt to spot "phishy" domains.
DOMAIN_ANALYZER_WATCHED_DOMAINS = []

# Defines how deep into the most frequently visited top
# level domains the analyzer should include in its watch list.
DOMAIN_ANALYZER_WATCHED_DOMAINS_THRESHOLD = 10

# The minimum Jaccard distance for a domain to be considered
# similar to the domains in the watch list. The lower this number
# is the more domains will be included in the "phishy" domain
# category.
DOMAIN_ANALYZER_WATCHED_DOMAINS_SCORE_THRESHOLD = 0.75

# A list of domains that are frequent source of false positives
# in the "phishy" domain comparison, mostly CDNs and similar.
DOMAIN_ANALYZER_EXCLUDE_DOMAINS = [
    "ytimg.com",
    "gstatic.com",
    "yimg.com",
    "akamaized.net",
    "akamaihd.net",
    "s-microsoft.com",
    "images-amazon.com",
    "ssl-images-amazon.com",
    "wikimedia.org",
    "redditmedia.com",
    "googleusercontent.com",
    "googleapis.com",
    "wikipedia.org",
    "github.io",
    "github.com",
]

# The threshold in minutes which the difference in timestamps has to cross in order to be
# detected as 'timestomping'.
NTFS_TIMESTOMP_ANALYZER_THRESHOLD = 10

# Safe Browsing API key for the URL analyzer.
SAFEBROWSING_API_KEY = ""

# For the other possible values of the two settings below, please refer to
# the Safe Browsing API reference at:
# https://developers.google.com/safe-browsing/v4/reference/rest

# Platforms to be looked at in Safe Browsing (PlatformType).
SAFEBROWSING_PLATFORMS = ["ANY_PLATFORM"]

# Types to be looked at in Safe Browsing (ThreatType).
SAFEBROWSING_THREATTYPES = ["MALWARE"]

# -- hashR integration --#
# https://github.com/google/hashr
# Uncomment and fill this section if you want to use the hashR lookup analyzer.
# Provide hashR postgres database connection information below:
# HASHR_DB_USER = 'hashRuser'
# HASHR_DB_PW = 'hashRpass'
# HASHR_DB_ADDR = '127.0.0.1'
# HASHR_DB_PORT = '5432'
# HASHR_DB_NAME = 'hashRdb'

# The total number of unique hashes that are checked against the database is
# split into multiple batches. This number defines how many unique hashes are
# checked per query. 50000 is the default value.
# HASHR_QUERY_BATCH_SIZE = '50000'

# Set as True if you want to add the source of the hash ([repo:imagename]) as
# an attribute to the event. WARNING: This will increase the processing time
# of the analyzer!
# HASHR_ADD_SOURCE_ATTRIBUTE = True

# Threatintel Yeti analyzer-specific configuration
# https://yeti-platform.io/
# URI root to Yeti's API, e.g. 'https://localhost:8000'
YETI_API_ROOT = ""

# API key to authenticate requests
YETI_API_KEY = ""

# Path to a TLS certificate that can be used to authenticate servers
# using self-signed certificates. Provide the full path to the .crt file.
YETI_TLS_CERTIFICATE = None

# Labels to narrow down indicator selection
YETI_INDICATOR_LABELS = ["domain"]

# Enable loading DFIQ templates from a Yeti instance.
# This requires DFIQ_ENABLED to be True and YETI_API_ROOT/YETI_API_KEY to be set.
# Yeti DFIQ entries will overwrite local entries if they share the same UUID!
YETI_DFIQ_ENABLED = False

# Yeti instance web base URL used for links in the UI.
# (Falls back to YETI_API_ROOT if not set.)
YETI_WEB_ROOT = ""

# Url to MISP instance
MISP_URL = ""

# API key to authenticate requests
MISP_API_KEY = ""

# Url to Hashlookup instance
HASHLOOKUP_URL = ""

# GeoIP Analyzer Settings
#
# Disclaimer: Please note that the geolocation results obtained from this analyzer
# are indicative and based upon the accuracy of the configured datasource.
# This analyzer uses GeoLite2 data created by MaxMind, available from
# https://maxmind.com.

# The path to a MaxMind GeoIP database
MAXMIND_DB_PATH = ""

# The Account ID to access a MaxMind GeoIP web service
MAXMIND_WEB_ACCOUNT_ID = ""

# The license key to access a MaxMind GeoIP web service
MAXMIND_WEB_LICENSE_KEY = ""

# The host URL of a MaxMind GeoIP web service
MAXMIND_WEB_HOST = ""

# -------------------------------------------------------------------------------
# Enable experimental UI features.

ENABLE_EXPERIMENTAL_UI = False

# -------------------------------------------------------------------------------
# Email notifications.

ENABLE_EMAIL_NOTIFICATIONS = False
EMAIL_DOMAIN = "localhost"
EMAIL_FROM_USER = "nobody"
EMAIL_SMTP_SERVER = "localhost"

# Only send emails to these users.
EMAIL_RECIPIENTS = []

# Configuration to construct URLs for resources.
EXTERNAL_HOST_URL = "https://localhost"

# SSL/TLS support for emails
EMAIL_TLS = False
EMAIL_SSL = False

# Email support for authentication
EMAIL_AUTH_USERNAME = ""
EMAIL_AUTH_PASSWORD = ""

# -------------------------------------------------------------------------------
# Sigma Settings

SIGMA_CONFIG = "/etc/timesketch/sigma_config.yaml"
SIGMA_TAG_DELAY = 5

# -------------------------------------------------------------------------------
# Flask Settings
# Everything mentioned in https://flask-wtf.readthedocs.io/en/latest/config/ can be used.
# Max age in seconds for CSRF tokens. Default is 3600. If set to None, the CSRF token is valid for the life of the session.
# WTF_CSRF_TIME_LIMIT = 7200
# WTF_CSRF_ENABLED = False # Set this to False for UI-development purposes

# The number of proxies that are chained in front of the application.
# This is used by the ProxyFix middleware to trust the X-Forwarded-* headers.
# See: https://werkzeug.palletsprojects.com/en/stable/middleware/proxy_fix/
REVERSE_PROXY_COUNT = 1

# Increase memory limit for form fields to support large legacy client uploads.
# Default: 200MB chunks
MAX_FORM_MEMORY_SIZE = 209715200

# -------------------------------------------------------------------------------
# DFIQ - Digital Forensics Investigation Questions
# How to set-up DFIQ: https://timesketch.org/guides/admin/load-dfiq/
DFIQ_ENABLED = False
DFIQ_PATH = "/etc/timesketch/dfiq/"

# Intelligence tag metadata configuration
INTELLIGENCE_TAG_METADATA = "/etc/timesketch/intelligence_tag_metadata.yaml"

# Context links configuration
CONTEXT_LINKS_CONFIG_PATH = "/etc/timesketch/context_links.yaml"

# LLM provider configs
LLM_PROVIDER_CONFIGS = {
    # Configure a LLM provider for a specific LLM enabled feature, or the
    # default provider will be used.
    # Supported LLM Providers:
    # - ollama:  Self-hosted, open-source.
    #   To use the Ollama provider you need to download and run an Ollama server.
    #   See instructions at: https://ollama.ai/
    # - google_genai: Google GenAI (supporting both Vertex AI and Gemini API).
    #   To use the Google GenAI provider you need to:
    #   1. Configure either 'api_key' (for Gemini API) or 'project_id' (for Vertex AI).
    #   2. For Vertex AI: Set the GOOGLE_APPLICATION_CREDENTIALS environment variable
    #      to the full path to your service account private key file.
    # - secgemini_log_analyzer_agent: SecGemini Log Analyzer Agent.
    #   To use the SecGemini Log Analyzer Agent you need to:
    #   1. Obtain an API key from https://secgemini.com/
    #   2. pip3 install sec-gemini
    #   IMPORTANT: Private keys must be kept secret. If you expose your private key it is
    #   recommended to revoke it immediately from the Google Cloud Console.
    "nl2q": {
        "vertexai": {
            "model": "gemini-2.0-flash",
            "project_id": "",
        },
    },
    "llm_summarize": {
        "vertexai": {
            "model": "gemini-2.0-flash",
            "project_id": "",
        },
    },
    "llm_starred_events_report": {
        "aistudio": {
            "model": "",
            "api_key": "",
        },
    },
    "llm_synthesize": {
        "aistudio": {
            "model": "gemini-2.0-flash",
            "api_key": "",
        },
    },
    "log_analyzer": {
        # NOTE: This feature will not work with default LLM providers and requires
        # a dedicated log analyzer agent service!
        # Read more: https://timesketch.org/developers/log-analyzer-agent/
        # Did you install `pip3 install sec-gemini` in your Timesketch containers?
        "secgemini_log_analyzer_agent": {
            "logs_processor_api_url": "",
            "api_key": "",
            "model": "logs_analysis_agent-1.1",
            "base_url": "",
            "wss_url": "",
            # Configuration for individual agents. This is a dictionary where the
            # key is the agent name and the value is another dictionary with
            # agent-specific configuration parameters.
            # Example:
            # "agents_config": {
            #     "logs_analysis_loop_agent": {
            #         "max_iterations": 10,
            # }
            "agents_config": {},
            "enable_logging": False,
        }
    },
    "default": {
        "ollama": {
            "server_url": "",
            "model": "",
        },
    },
}


# LLM nl2q configuration
DATA_TYPES_PATH = "/etc/timesketch/nl2q/data_types.csv"
PROMPT_NL2Q = "/etc/timesketch/nl2q/prompt_nl2q"
EXAMPLES_NL2Q = "/etc/timesketch/nl2q/examples_nl2q"

# LLM event summarization configuration
PROMPT_LLM_SUMMARIZATION = "/etc/timesketch/llm_summarize/prompt.txt"
PROMPT_LLM_SYNTHESIZE = "/etc/timesketch/llm_summarize/prompt_llm_synthesize.txt"

# LLM starred events to report default prompt
PROMPT_LLM_STARRED_EVENTS_REPORT = "/etc/timesketch/llm_starred_events_report/prompt.txt"

# LLM log_analyzer default prompt
LLM_LOG_ANALYZER_DEFAULT_PROMPT = (
    "Perform a forensics investigation on the provided logs. Determine if the "
    "host has been compromised, and if so, reconstruct the complete attacker "
    "timeline, from initial compromise to actions on objectives."
)

# -------------------------------------------------------------------------------
# Timesketch UI Option

# Get the search processing timelines setting.
# If set to True, the search processing timelines options will be displayed in the UI.
SEARCH_PROCESSING_TIMELINES = False

# Enable the investigation view running on the v3 frontend.
# Set-up instructions: https://timesketch.org/guides/admin/investigation-view-setup/
ENABLE_V3_INVESTIGATION_VIEW = False