Install Configuration

Taranis can be configured on many different aspects. This chapter will guide you through the configuration options you should take a look at after installing Taranis.

Table of Contents The main configuration file Graphs via ChartDirector Web-based configuration Software/hardware definitions (CPE)

The main configuration file

Most of the settings of Taranis can be changed in the file ~taranis/etc/taranis.conf.xml. You can keep much of the default settings in this file, but not all of them.

Please see the Administration Guide about the central configuration file, which you really need to modify to suit your needs immediately.

Graphs via ChartDirector

Taranis optionally offers extensive statistics on all the information stored and produced. These statistics can be shown through different types of charts like pie charts and bar charts. Taranis makes use of ChartDirector to produce these graphs.

If you want to make use of these statistics, you are required to purchase a ChartDirector license through the website of Advanced Software Engineering (ASE).

After you purchased a license, you must create the license file chartdir.lic with the license key you received and place it here: ~taranis/etc/chartdir.lic

If you don’t purchase a license, you will see a message on the bottom of every statistic you generate.

Web-based configuration

Login to the Taranis web interface and start adding sources, parsers, users, etc. During installation, you specified the virtual hostname to be used to reach the instance. The default user is admin with password admin.

Please refer to the Administration Guide for more information or the configuration options Taranis offers. We advise you to at least configure the following items in Taranis before actual use:

• You may want to load an initial set of sources. Go to "taranis configuration" (top bar) → "collector configuration" → "Taranis sources" → "Import/Export sources" and then browse to ~taranis/sources/taranis-*/example-sources/ to pick them.
• Compile a list of possible damage descriptions if you plan to use the advisory-functionality of Taranis.
• Create at least one constituent type, followed by at least one constituent group, one constituent role and one constituent individual.
• Create another Taranis-user. You’ll need at least two users to be able to approve any product (advisory, End-of-Week)

Software/hardware definitions (CPE)

Published advisories contain information about the inflicted software and/or hardware. The international CPE (Common Platform Enumeration) registration contains over 120k unique identifiers. When you want to use them all, run:

tara$ taranis cpe dictionary --versions

This action can take up to five minutes or longer depending on your environment.

One complication with using CPEs, is that products have many versions, which are each represented as separate record. For example, when you want to link “any linux kernel version” to an advisory, you have to link over 2100 CPEs.

For the purpose of Taranis, it is sufficient to work without all the detailed version numbers. The number of products decreases to 18k. To use the simplified CPEs, run:

# --no-versions is default
tara$ taranis cpe dictionary

In either case, put your dictionary import in cron for your taranis user. Run this at least once a month.

Alternatively you may choose to add your own definitions via the web-interface. Via Taranis configuration -> publication configuration -> Software/Hardware, the product specification can be added manually. You may delete (hide) items you do not want to use anymore, even when they were imported as dictionary.

Please refer to the Administration Guide for more information.