control_vars.conf

export CAPTURE_INTERFACE=lo
export CAPTURE_FILTER=""

export PCAP_PATH=/home/sensor/net_cap
export PCAP_TCPDUMP_FILENAME_PATTERN=%Y%m%d_%H%M%S.pcap
export PCAP_NETSNIFF_MAGIC=0xa1b2c3d4
export PCAP_ROTATE_SECONDS=3600
export PCAP_ROTATE_MEGABYTES=4096
export PCAP_SNAPLEN=0
export PCAP_MAX_DISK_FILL=90
export PCAP_PRUNE_CHECK_SECONDS=60

export ARKIME_VIEWER_PORT=8005
export ARKIME_PACKET_THREADS=5
export ARKIME_ECS_PROVIDER=arkime
export ARKIME_ECS_DATASET=session
export ARKIME_COMPRESSION_TYPE=zstd
export ARKIME_COMPRESSION_LEVEL=3
# ARKIME_VIEWER_(CERT|KEY) are under "$SUPERVISOR_PATH"/arkime/
export ARKIME_VIEWER_CERT=viewer.crt
export ARKIME_VIEWER_KEY=viewer.key
# Password hash secret for Arkime viewer cluster (see https://arkime.com/settings)
export ARKIME_PASSWORD_SECRET=Malcolm
export ARKIME_FREESPACEG=7%
export ARKIME_ROTATE_INDEX=daily
export ARKIME_DEBUG_LEVEL=0

# AUTOSTART_EXTRACTED_FILE_HTTP_SERVER below controls whether or not to serve the
#   directory containing Zeek-extracted over HTTP at ./extracted-files/
export EXTRACTED_FILE_HTTP_SERVER_PORT=8006
export EXTRACTED_FILE_HTTP_ASSETS_DIR=/opt/sensor/assets
# Whether or not Zeek-extracted files served over HTTP will be archived in a Zip file
export EXTRACTED_FILE_HTTP_SERVER_ZIP=false
# Specifies the password for encrypted Zeek-extracted files served over HTTP
#   If EXTRACTED_FILE_HTTP_SERVER_ZIP is true this is the password for the Zip file,
#   otherwise it is the AES-256-CBC decryption password
export EXTRACTED_FILE_HTTP_SERVER_KEY=infected
# Whether or not to use libmagic to show MIME types for Zeek-extracted files served
export EXTRACTED_FILE_HTTP_SERVER_MAGIC=false
# HTTP server will look in subdirectories for requested filename (e.g., in "/quarantined" and "/preserved")
export EXTRACTED_FILE_HTTP_SERVER_RECURSIVE=true

# files used for FileBeat -> Logstash TLS and extracted file HTTP server
export BEAT_LS_SSL_CLIENT_CRT=/opt/sensor/sensor_ctl/logstash-client-certificates/client.crt
export BEAT_LS_SSL_CLIENT_KEY=/opt/sensor/sensor_ctl/logstash-client-certificates/client.key
export BEAT_LS_SSL_CA_CRT=/opt/sensor/sensor_ctl/logstash-client-certificates/ca.crt

export MALCOLM_REQUEST_ACL=
export MALCOLM_REQUEST_PORTS=$ARKIME_VIEWER_PORT,$EXTRACTED_FILE_HTTP_SERVER_PORT
export DOCUMENTATION_PORT=8420
export MISCBEAT_PORT=9516
export FLUENTBIT_METRICS_INTERVAL=30
export FLUENTBIT_THERMAL_INTERVAL=10
export FLUENTBIT_AIDE_INTERVAL=86400

export ZEEK_LOG_PATH=/home/sensor/zeek_logs
export ZEEK_MAX_DISK_FILL=90
export ZEEK_PRUNE_CHECK_SECONDS=90

# Zeek performance tuning
#   See idaholab/Malcolm#475 and idaholab/Malcolm#36 for details)

# AF_Packet ring buffer size
export ZEEK_AF_PACKET_BUFFER_SIZE=67108864
# default for ZEEK_LB_PROCS_WORKER_n if unspecified; defaults to '1'
#   a value of '0' means "autocalculate based on the number of CPUs the system has"
export ZEEK_LB_PROCS_WORKER_DEFAULT=1
# if ZEEK_LB_PROCS_WORKER_DEFAULT is '0' (autocalculate), exclude this
#   number of CPUs from the autocalculation (defaults to '4' for
#   kernel, manager, proxy, and logger; may wish to increase as there
#   are other processes using CPU as well)
export ZEEK_LB_PROCS_CPUS_RESERVED=4
# automatically pin worker CPUs (default 'false')
export ZEEK_PIN_CPUS_WORKER_AUTO=
# zeekdeploy.sh will also use (if present, where n is the number of capture interfaces):
#   ZEEK_PIN_CPUS_WORKER_1 .. ZEEK_PIN_CPUS_WORKER_n
#   ZEEK_LB_PROCS_WORKER_1 .. ZEEK_LB_PROCS_WORKER_n
# ZEEK_PIN_CPUS_(LOGGER|MANAGER|PROXY) specify either a list of CPUs to pin or "true"
#   to auto-pin one CPU each, respectively, if there are enough CPUs to do so
export ZEEK_PIN_CPUS_LOGGER=
export ZEEK_PIN_CPUS_MANAGER=
export ZEEK_PIN_CPUS_PROXY=

export ZEEK_LOCAL_NETS=
export ZEEK_JSON=
export ZEEK_RULESET=local
export ZEEK_INTEL_REFRESH_ON_DEPLOY=true
export ZEEK_INTEL_REFRESH_CRON_EXPRESSION=
export ZEEK_INTEL_ITEM_EXPIRATION=-1min
export ZEEK_INTEL_FEED_SINCE=
export INTEL_DIR=/opt/sensor/sensor_ctl/zeek/intel
export ZEEK_EXTRACTOR_MODE=none
export ZEEK_EXTRACTOR_OVERRIDE_FILE=
export EXTRACTED_FILE_MIN_BYTES=64
export EXTRACTED_FILE_MAX_BYTES=134217728
export EXTRACTED_FILE_PRESERVATION=quarantined
export ZEEK_DISABLE_STATS=true
export ZEEK_DISABLE_HASH_ALL_FILES=
export ZEEK_DISABLE_LOG_PASSWORDS=
export ZEEK_DISABLE_SSL_VALIDATE_CERTS=
export ZEEK_DISABLE_TRACK_ALL_ASSETS=
export ZEEK_DISABLE_SPICY_DHCP=true
export ZEEK_DISABLE_SPICY_DNS=true
export ZEEK_DISABLE_SPICY_HTTP=true
export ZEEK_DISABLE_SPICY_IPSEC=
export ZEEK_DISABLE_SPICY_LDAP=
export ZEEK_DISABLE_SPICY_OPENVPN=
export ZEEK_DISABLE_SPICY_QUIC=true
export ZEEK_DISABLE_SPICY_STUN=
export ZEEK_DISABLE_SPICY_TAILSCALE=
export ZEEK_DISABLE_SPICY_TFTP=
export ZEEK_DISABLE_SPICY_WIREGUARD=
export ZEEK_DISABLE_ICS_ALL=
export ZEEK_DISABLE_ICS_BACNET=
export ZEEK_DISABLE_ICS_BSAP=
export ZEEK_DISABLE_ICS_DNP3=
export ZEEK_DISABLE_ICS_ENIP=
export ZEEK_DISABLE_ICS_ETHERCAT=
export ZEEK_DISABLE_ICS_GENISYS=true
export ZEEK_DISABLE_ICS_OPCUA_BINARY=
export ZEEK_DISABLE_ICS_MODBUS=
export ZEEK_DISABLE_ICS_PROFINET=
export ZEEK_DISABLE_ICS_PROFINET_IO_CM=
export ZEEK_DISABLE_ICS_S7COMM=
export ZEEK_DISABLE_ICS_SYNCHROPHASOR=
export ZEEK_SYNCHROPHASOR_PORTS=
export ZEEK_SYNCHROPHASOR_DETAILED=
export ZEEK_GENISYS_PORTS=
export ZEEK_ENIP_PORTS=
export ZEEK_DISABLE_BEST_GUESS_ICS=true

# Suricata
export SURICATA_CUSTOM_RULES_ONLY=false
export SURICATA_DISABLE_ICS_ALL=false
export SURICATA_RUNMODE=workers
export SURICATA_LIVE_CAPTURE=true
export SURICATA_AF_PACKET_BLOCK_SIZE=32768
export SURICATA_AF_PACKET_BLOCK_TIMEOUT=10
export SURICATA_AF_PACKET_BUFFER_SIZE=32768
export SURICATA_AF_PACKET_CHECKSUM_CHECKS=kernel
export SURICATA_AF_PACKET_CLUSTER_TYPE=cluster_flow
export SURICATA_AF_PACKET_DEFRAG=yes
export SURICATA_AF_PACKET_EMERGENCY_FLUSH=no
export SURICATA_AF_PACKET_IFACE_THREADS=auto
export SURICATA_AF_PACKET_MMAP_LOCKED=no
export SURICATA_AF_PACKET_RING_SIZE=2048
export SURICATA_AF_PACKET_TPACKET_V3=yes
export SURICATA_AF_PACKET_USE_MMAP=yes
export SURICATA_CAPTURE_CHECKSUM_VALIDATION=none
export SURICATA_CAPTURE_DISABLE_OFFLOADING=true
export SURICATA_MANAGED_DIR=/var/lib/suricata
export SURICATA_MANAGED_RULES_DIR="$SURICATA_MANAGED_DIR"/rules
export SURICATA_REFRESH_CRON_EXPRESSION="15 2 * * *"
export SURICATA_UPDATE_ETOPEN=true
export SURICATA_STATS_ENABLED=false
export SURICATA_STATS_EVE_ENABLED=false
export SURICATA_STATS_INTERVAL=30
export SURICATA_STATS_DECODER_EVENTS=false

# affects Arkime only for now: beats values are stored in keystores per-beat
export OS_PROTOCOL=https
export OS_HOST=127.0.0.1
export OS_PORT=9200
export OS_USERNAME=sensor
export OS_PASSWORD=%70%61%73%73%77%6F%72%64
export OS_SSL_VERIFY=none

export VTOT_REQUESTS_PER_MINUTE=4
export VTOT_API2_KEY=""
export CLAMD_MAX_REQUESTS=8
export EXTRACTED_FILE_YARA_CUSTOM_ONLY=false
export YARA_MAX_REQUESTS=8
export YARA_RULES_DIR=/opt/yara-rules
export YARA_RULES_SRC_DIR=/opt/yara-rules-src
export CAPA_VERBOSE=false
export CAPA_MAX_REQUESTS=4

export ZEEK_FILE_WATCH=false
export ZEEK_FILE_SCAN_CLAMAV=false
export ZEEK_FILE_SCAN_VTOT=false
export ZEEK_FILE_SCAN_YARA=false
export ZEEK_FILE_SCAN_CAPA=false

export AUTOSTART_ARKIME=false
export AUTOSTART_CLAMAV_UPDATES=false
export AUTOSTART_EXTRACTED_FILE_HTTP_SERVER=false
export AUTOSTART_FILEBEAT=false
export AUTOSTART_FLUENTBIT_AIDE=false
export AUTOSTART_FLUENTBIT_AUDITLOG=false
export AUTOSTART_FLUENTBIT_KMSG=false
export AUTOSTART_FLUENTBIT_METRICS=false
export AUTOSTART_FLUENTBIT_SYSTEMD=false
export AUTOSTART_FLUENTBIT_THERMAL=false
export AUTOSTART_MISCBEAT=false
export AUTOSTART_NETSNIFF=false
export AUTOSTART_PRUNE_PCAP=false
export AUTOSTART_PRUNE_ZEEK=false
export AUTOSTART_SURICATA=false
export AUTOSTART_SURICATA_UPDATES=false
export AUTOSTART_TCPDUMP=false
export AUTOSTART_ZEEK=false