100 lines
2.5 KiB
Go
100 lines
2.5 KiB
Go
package config
|
|
|
|
import (
|
|
"github.com/spf13/viper"
|
|
"time"
|
|
)
|
|
|
|
// ReadCfg read correlator config file and apply default values
|
|
func ReadCfg(file string) error {
|
|
viper.SetConfigFile(file)
|
|
viper.AddConfigPath(".")
|
|
viper.AddConfigPath("/etc/armaconsole")
|
|
viper.AutomaticEnv()
|
|
viper.SetEnvPrefix("CORRELATOR")
|
|
|
|
// Set defaults
|
|
viper.SetDefault(AggregatorUpdateWorkers, 1)
|
|
viper.SetDefault(AggregatorBulkCount, 100)
|
|
viper.SetDefault(AggregatorBulkFlushInterval, time.Minute)
|
|
|
|
viper.SetDefault(AggregatorNormalizedWorkers, 1)
|
|
viper.SetDefault(AggregatorNormalizerBulkCount, 100)
|
|
viper.SetDefault(AggregatorNormalizedBulkFlushInterval, time.Minute)
|
|
viper.SetDefault(AggregatorIterationDuration, time.Second*30)
|
|
|
|
viper.SetDefault(CorrelatorWorkers, 10)
|
|
viper.SetDefault(CorrelatorBulkCount, 100)
|
|
viper.SetDefault(CorrelatorFlushInterval, time.Minute)
|
|
|
|
viper.SetDefault(Threads, 10)
|
|
|
|
viper.SetDefault(ElasticAggregatedIndexName, "aggregated-2006.01.02")
|
|
viper.SetDefault(ElasticNormalizedIndexName, "arma-*")
|
|
viper.SetDefault(ElasticIgnoreSSLErrors, true)
|
|
|
|
viper.SetDefault(ActionFirewallRuleIgnoreSSLErrors, true)
|
|
|
|
viper.SetDefault(ApiPort, 5566)
|
|
|
|
viper.SetDefault(ElasticRetryCount, 10)
|
|
viper.SetDefault(ElasticConnectionTimeout, time.Second*20)
|
|
viper.SetDefault(AggregatorWindow, time.Second*30)
|
|
viper.SetDefault(SyslogTag, "correlator")
|
|
|
|
viper.SetDefault(LogFileName, "correlator.log")
|
|
viper.SetDefault(LogMaxSize, 100)
|
|
viper.SetDefault(LogMaxBkup, 10)
|
|
viper.SetDefault(LogMaxAge, 10)
|
|
viper.SetDefault(LogCompress, true)
|
|
viper.SetDefault(LogLevel, 2)
|
|
viper.SetDefault(LogFormatter, "json")
|
|
viper.SetDefault(LogForceColors, false)
|
|
|
|
viper.SetDefault(ElasticLogEncodeQuery, false)
|
|
viper.SetDefault(ElasticLogQuery, false)
|
|
|
|
viper.SetDefault(ConsoleIgnoreSSLErrors, true)
|
|
viper.SetDefault(AggregatedFields, []string{
|
|
"event_severity",
|
|
"event_protocol",
|
|
"message",
|
|
"device_vendor",
|
|
"device_product",
|
|
"device_action",
|
|
"device_version",
|
|
"device_timezone",
|
|
"sign_id",
|
|
"sign_category",
|
|
"sign_subcategory",
|
|
"application",
|
|
"source_ip",
|
|
"source_host",
|
|
"source_port",
|
|
"source_mac",
|
|
"source_timezone",
|
|
"source_software",
|
|
"source_action",
|
|
"destination_ip",
|
|
"destination_mac",
|
|
"destination_timezone",
|
|
"destination_software",
|
|
"destination_action",
|
|
"destination_host",
|
|
"destination_port",
|
|
"destination_user",
|
|
"cs1",
|
|
"cs1Label",
|
|
"cs2",
|
|
"cs2Label",
|
|
"object_type",
|
|
})
|
|
viper.SetDefault(ScrollSize, 1000)
|
|
|
|
err := viper.ReadInConfig()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|