Files
securityonion/salt/idh/soc_idh.yaml
2023-12-06 15:44:36 -05:00

135 lines
4.5 KiB
YAML

idh:
enabled:
description: You can enable or disable IDH.
helpLink: idh.html
opencanary:
config:
logger:
class: &loggingOptions
description: Logging options for IDH nodes.
readonly: True
advanced: True
global: True
helpLink: idh.html
kwargs:
formatters:
plain:
format: *loggingOptions
handlers:
console:
class: *loggingOptions
stream: *loggingOptions
file:
class: *loggingOptions
filename: *loggingOptions
portscan_x_enabled: &serviceOptions
description: To enable this opencanary module, set this value to true. To disable set to false. This option only applies to IDH nodes within your grid.
helpLink: idh.html
portscan_x_logfile: *loggingOptions
portscan_x_synrate:
description: Portscan - syn rate limiting
advanced: True
helpLink: idh.html
portscan_x_nmaposrate:
description: Portscan - nmap OS rate limiting
advanced: True
helpLink: idh.html
portscan_x_lorate:
description: Portscan - lo rate limiting
advanced: True
helpLink: idh.html
tcpbanner_x_maxnum:
description: Portscan - maxnum
advanced: True
helpLink: idh.html
tcpbanner_x_enabled: *serviceOptions
tcpbanner_1_x_enabled: *serviceOptions
tcpbanner_1_x_port: &portOptions
description: Port the service should listen on.
advanced: True
helpLink: idh.html
tcpbanner_1_x_datareceivedbanner: &bannerOptions
description: Data Received Banner
advanced: True
helpLink: idh.html
tcpbanner_1_x_initbanner: *bannerOptions
tcpbanner_1_x_alertstring_x_enabled: *serviceOptions
tcpbanner_1_x_keep_alive_x_enabled: *serviceOptions
tcpbanner_1_x_keep_alive_secret:
description: Keep Alive Secret
advanced: True
helpLink: idh.html
tcpbanner_1_x_keep_alive_probes:
description: Keep Alive Probes
advanced: True
helpLink: idh.html
tcpbanner_1_x_keep_alive_interval:
description: Keep Alive Interval
advanced: True
helpLink: idh.html
tcpbanner_1_x_keep_alive_idle:
description: Keep Alive Idle
advanced: True
helpLink: idh.html
ftp_x_enabled: *serviceOptions
ftp_x_port: *portOptions
ftp_x_banner: *bannerOptions
git_x_enabled: *serviceOptions
git_x_port: *portOptions
http_x_banner: *bannerOptions
http_x_enabled: *serviceOptions
http_x_port: *portOptions
http_x_skin: &skinOptions
description: HTTP skin
advanced: True
helpLink: idh.html
http_x_skinlist: &skinlistOptions
description: List of skins to use for the service.
advanced: True
helpLink: idh.html
httpproxy_x_enabled: *serviceOptions
httpproxy_x_port: *portOptions
httpproxy_x_skin: *skinOptions
httpproxy_x_skinlist: *skinlistOptions
mssql_x_enabled: *serviceOptions
mssql_x_version: &versionOptions
description: Specify the version the service should present.
advanced: True
helpLink: idh.html
mssql_x_port: *portOptions
mysql_x_enabled: *serviceOptions
mysql_x_port: *portOptions
mysql_x_banner: *bannerOptions
ntp_x_enabled: *serviceOptions
ntp_x_port: *portOptions
redis_x_enabled: *serviceOptions
redis_x_port: *portOptions
sip_x_enabled: *serviceOptions
sip_x_port: *portOptions
smb_x_auditfile: *loggingOptions
smb_x_enabled: *serviceOptions
snmp_x_enabled: *serviceOptions
snmp_x_port: *portOptions
ssh_x_enabled: *serviceOptions
ssh_x_port: *portOptions
ssh_x_version: *versionOptions
telnet_x_enabled: *serviceOptions
telnet_x_port: *portOptions
telnet_x_banner: *bannerOptions
telnet_x_honeycreds:
description: Credentials list for the telnet service.
advanced: True
helpLink: idh.html
tftp_x_enabled: *serviceOptions
tftp_x_port: *portOptions
vnc_x_enabled: *serviceOptions
vnc_x_port: *portOptions
openssh:
enable:
description: This is the real SSH service for the host machine.
helpLink: idh.html
config:
port:
description: Port that the real SSH service will listen on and will only be accessible from the manager.
helpLink: idh.html