package config import ( "github.com/spf13/viper" "time" ) // ReadCfg read correlator config file and apply default values func ReadCfg(file string) error { viper.SetConfigFile(file) viper.AddConfigPath(".") viper.AddConfigPath("/etc/armaconsole") viper.AutomaticEnv() viper.SetEnvPrefix("CORRELATOR") // Set defaults viper.SetDefault(AggregatorUpdateWorkers, 1) viper.SetDefault(AggregatorBulkCount, 100) viper.SetDefault(AggregatorBulkFlushInterval, time.Minute) viper.SetDefault(AggregatorNormalizedWorkers, 1) viper.SetDefault(AggregatorNormalizerBulkCount, 100) viper.SetDefault(AggregatorNormalizedBulkFlushInterval, time.Minute) viper.SetDefault(AggregatorIterationDuration, time.Second*30) viper.SetDefault(CorrelatorWorkers, 10) viper.SetDefault(CorrelatorBulkCount, 100) viper.SetDefault(CorrelatorFlushInterval, time.Minute) viper.SetDefault(Threads, 10) viper.SetDefault(ElasticAggregatedIndexName, "aggregated-2006.01.02") viper.SetDefault(ElasticNormalizedIndexName, "arma-*") viper.SetDefault(ElasticIgnoreSSLErrors, true) viper.SetDefault(ActionFirewallRuleIgnoreSSLErrors, true) viper.SetDefault(ApiPort, 5566) viper.SetDefault(ElasticRetryCount, 10) viper.SetDefault(ElasticConnectionTimeout, time.Second*20) viper.SetDefault(AggregatorWindow, time.Second*30) viper.SetDefault(SyslogTag, "correlator") viper.SetDefault(LogFileName, "correlator.log") viper.SetDefault(LogMaxSize, 100) viper.SetDefault(LogMaxBkup, 10) viper.SetDefault(LogMaxAge, 10) viper.SetDefault(LogCompress, true) viper.SetDefault(LogLevel, 2) viper.SetDefault(LogFormatter, "json") viper.SetDefault(LogForceColors, false) viper.SetDefault(ElasticLogEncodeQuery, false) viper.SetDefault(ElasticLogQuery, false) viper.SetDefault(ConsoleIgnoreSSLErrors, true) viper.SetDefault(AggregatedFields, []string{ "event_severity", "event_protocol", "message", "device_vendor", "device_product", "device_action", "device_version", "device_timezone", "sign_id", "sign_category", "sign_subcategory", "application", "source_ip", "source_host", "source_port", "source_mac", "source_timezone", "source_software", "source_action", "destination_ip", "destination_mac", "destination_timezone", "destination_software", "destination_action", "destination_host", "destination_port", "destination_user", "cs1", "cs1Label", "cs2", "cs2Label", "object_type", }) viper.SetDefault(ScrollSize, 1000) err := viper.ReadInConfig() if err != nil { return err } return nil }