mirror of
https://github.com/ComodoSecurity/openedr/
synced 2026-06-06 15:24:33 +00:00
Vasily Plotnikov
397 lines
8.7 KiB
INI
397 lines
8.7 KiB
INI
//
|
|
// Config for testing
|
|
//
|
|
{
|
|
//"dataPath": "c:\...",
|
|
|
|
// Default service start mode
|
|
"serviceStartMode": "manual", // "auto" | "off"
|
|
|
|
// Control sending events to cloud
|
|
"enableMainReceiver": true,
|
|
|
|
// Delay between two failed submission attemps (in milliseconds)
|
|
//"mainReceiverRetryDelay": 10000,
|
|
|
|
// Enable output filter (instead of legacy transform-for-cloud)
|
|
//"enableOutputFilter": false,
|
|
|
|
// Enable GCP event receiver (instead of AWS)
|
|
//"useGcpReceiver": false,
|
|
|
|
// Enable GCP statistic gathering
|
|
"enableGcpStatistic": true,
|
|
|
|
// Send events to a receiver in batch mode
|
|
//"enableMainReceiverBatchMode": false,
|
|
|
|
// Control sending events to file: <%app.logPath%\output_events.log>
|
|
"enableLogReceiver": true,
|
|
|
|
// Control sending events to directory: <%app.logPath%\output_events>
|
|
//"enableDirReceiver": false,
|
|
|
|
// Debug receiver for events sending
|
|
//"enableDebugReceiver": false,
|
|
//"debugReceiver": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0x694C9C8E", // CLSID_JsonRpcClient
|
|
// "port": 9630,
|
|
// "host": "127.0.0.1",
|
|
// "protocol": "TCP"
|
|
//},
|
|
|
|
// Control saving disarded events into file: <%app.logPath%\discarded_events.log>
|
|
//"enableDiscardedLog": true,
|
|
|
|
// Main Logger subsystem settings
|
|
"log": {
|
|
// Root log level
|
|
"logLevel": 2,
|
|
|
|
// Log level of log components
|
|
"components": {
|
|
//"cloudsvc": 0,
|
|
//"httpclnt": 0
|
|
}
|
|
},
|
|
|
|
// Hand after memory leaks dumping for N ms
|
|
"hangOnMemoryLeaks": 0,
|
|
|
|
"serialization": {
|
|
"encryption": "",
|
|
"compression": ""
|
|
},
|
|
|
|
//
|
|
// Custom RawEvent reciever
|
|
// Command gets event as "data" parameter.
|
|
// rawEventRecieverCmd can be IDataReciever for backward compatibility.
|
|
//"rawEventRecieverCmd": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0x61A30254", // CLSID_Scenario
|
|
// "name": "lleRecieverCmd",
|
|
// "addParams": true,
|
|
// "code": [
|
|
// {
|
|
// "$if": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0x3C365C39", // CLSID_VariantCtxCmd
|
|
// "operation": "contain",
|
|
// "item": [9,10,11,12,13], // Registry events
|
|
// "args": [ {"$path": "params.data.type", "$default": 0 } ]
|
|
// },
|
|
// "clsid": "0x3C365C39", // CLSID_VariantCtxCmd
|
|
// "operation": "loginf",
|
|
// "args": ["lleRecieverCmd: ", { "$path": "params.data" } ]
|
|
// }
|
|
// ]
|
|
//},
|
|
|
|
|
|
//
|
|
// Before (instead) apply_policy hook
|
|
// Command gets event as "data" parameter.
|
|
//
|
|
//"lleRecieverCmd": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0x61A30254", // CLSID_Scenario
|
|
// "name": "lleRecieverCmd",
|
|
// "addParams": true,
|
|
// "code": [
|
|
// {
|
|
// "clsid": "0x3C365C39", // CLSID_VariantCtxCmd
|
|
// "operation": "loginf",
|
|
// "args": ["lleRecieverCmd: ", { "$path": "params.data.rawEventId" } ]
|
|
// }
|
|
// ]
|
|
//},
|
|
|
|
// Valkyrie check options
|
|
"valkyrieCheck": {
|
|
//"enableCache": false,
|
|
|
|
// FLS verdict filter override
|
|
// Value can be a single number or a sequence of numbers
|
|
//"flsVerdict": 3 // Unknown
|
|
|
|
// Custom check command (totally overrides the main one)
|
|
// Receives a file descriptor in <file> parameter and returns <true>
|
|
// if the file is needed to be submitted to the Valkyrie.
|
|
//"checkCmd": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0x61A30254", // CLSID_Scenario
|
|
// "addParams": true,
|
|
// "code": [
|
|
// {
|
|
// "clsid": "0x59D2EF6E", // CLSID_CallCtxCmd
|
|
// "command": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0xACE892B6", // CLSID_Command
|
|
// "processor": "objects.application",
|
|
// "command": "log"
|
|
// },
|
|
// "ctxParams": {
|
|
// "message": {"$path": "params.file.path"}
|
|
// }
|
|
// },
|
|
// { "$ret": false }
|
|
// ]
|
|
//}
|
|
},
|
|
|
|
// Valkyrie submit options
|
|
"valkyrieSubmit": {
|
|
//"retryDelay": 10000, // delay on failed submit in milliseconds
|
|
//"queueMaxSize": 10000, // Queue limit
|
|
//"queueSaveSize": 7500,
|
|
|
|
// Support replacement of submit command for ATS
|
|
// Command should support interface of the ValkyrieService::submit command
|
|
//"submitCmd": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0x61A30254", // CLSID_Scenario
|
|
// "addParams": true,
|
|
// "code": [
|
|
// {
|
|
// "clsid": "0x59D2EF6E", // CLSID_CallCtxCmd
|
|
// "command": {
|
|
// "$$proxy": "cachedObj",
|
|
// "clsid": "0xACE892B6", // CLSID_Command
|
|
// "processor": "objects.application",
|
|
// "command": "log"
|
|
// },
|
|
// "ctxParams": {
|
|
// "message": {"$path": "params.file.path"}
|
|
// }
|
|
// },
|
|
|
|
// { "$ret": true }
|
|
// ]
|
|
//}
|
|
},
|
|
|
|
// Statical trusted vendors for file "verdict"
|
|
//"trustedVendorList" : ["Microsoft"],
|
|
|
|
// Set edrdrv.sys config
|
|
"edrdrv": {
|
|
//"logLevel" : 3
|
|
//"sentRegTypes": 4294967295,
|
|
"disableSelfProtection": true
|
|
},
|
|
|
|
// Service options
|
|
"service": {
|
|
//"allowUnload" : true
|
|
},
|
|
|
|
// RPC options
|
|
"rpc": {
|
|
// Channel mode for RPC server objects. Supported: "plain", "encrypted", "both"
|
|
//"serverChannelMode": "both"
|
|
|
|
// Channel mode for RPC client objects. Supported: "plain", "encrypted"
|
|
//"clientChannelMode": "plain"
|
|
|
|
// Display more verbose information on client's inner operations
|
|
//"clientVerbose": true
|
|
},
|
|
|
|
// Set self protection config
|
|
"selfprotect": {
|
|
"processRules": [
|
|
{
|
|
"type": 3, // EnableInject
|
|
"mode": 1, // Replace
|
|
"persistent": true,
|
|
"rules": [
|
|
// MSVS debugger
|
|
{
|
|
"imagePath": "msvsmon.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "msvsmon"
|
|
},
|
|
// VTune: amplxe-runss.exe
|
|
{
|
|
"imagePath": "amplxe-runss.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// VTune: emon.exe
|
|
{
|
|
"imagePath": "emon.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// amplxe-node.exe
|
|
{
|
|
"imagePath": "amplxe-node.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// amplxe-backend.exe
|
|
{
|
|
"imagePath": "amplxe-backend.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// edrsvc.exe
|
|
{
|
|
"imagePath": "edrsvc.exe",
|
|
"value": false,
|
|
"inherit": true
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": 4, // SendEvent
|
|
"mode": 1, // Replace
|
|
"persistent": true,
|
|
"rules": [
|
|
// MSVS debugger
|
|
{
|
|
"imagePath": "msvsmon.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "msvsmon"
|
|
},
|
|
// VTune: amplxe-runss.exe
|
|
{
|
|
"imagePath": "amplxe-runss.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// VTune: emon.exe
|
|
{
|
|
"imagePath": "emon.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// amplxe-node.exe
|
|
{
|
|
"imagePath": "amplxe-node.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// amplxe-backend.exe
|
|
{
|
|
"imagePath": "amplxe-backend.exe",
|
|
"value": false,
|
|
"inherit": false,
|
|
"tag": "vtune"
|
|
},
|
|
// edrsvc.exe
|
|
{
|
|
"imagePath": "edrsvc.exe",
|
|
"value": false,
|
|
"inherit": true
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
|
|
"systemMonitorController": {
|
|
//"injectNewProcesses": 2 // 0 - disable, 1 - driver, 2 - service
|
|
},
|
|
|
|
"networkMonitorController": {
|
|
//"enable": false
|
|
},
|
|
|
|
|
|
"scenarioManager": {
|
|
"collectStatistic": true
|
|
},
|
|
|
|
"processMonitorController": {
|
|
"injectAllOnStart": false,
|
|
"uninjectAllOnExit": true,
|
|
//"targetProcessName": "notepad.exe",
|
|
"injectionConfig": {
|
|
//"queueSize": 4096, //
|
|
//"sendTimeout": 500, // Send event timeout
|
|
//"waitTimeout": 1000, // Timeout after error (send event or update config)
|
|
//"waitAnswer": false, // Wait for answer from service on event sending
|
|
//"events": [
|
|
//{
|
|
//"id": 0, // Id of event
|
|
//"timeout": 1000 // Timeout between events sending
|
|
//},
|
|
//{
|
|
//"id": 1, // Id of event
|
|
//"timeout": 500 // Timeout between events sending
|
|
//}
|
|
//]
|
|
}
|
|
},
|
|
|
|
"processDataProvider": {
|
|
//"purgeTimeout": 600000, // 10 min
|
|
//"purgeMask": 255, // 0xFF
|
|
},
|
|
|
|
"fileDataProvider": {
|
|
//"purgeTimeout": 600000 // 10 min
|
|
},
|
|
|
|
"license": {
|
|
//"token": ""
|
|
//"endpointId": "",
|
|
//"customerId": "",
|
|
//"legacyCustomerId": ""
|
|
//"machineId": ""
|
|
},
|
|
|
|
//
|
|
// Cloud parameters
|
|
//
|
|
"cloud": {
|
|
//"rootUrl": "127.0.0.1:9990",
|
|
//"rootLegacyUrl": "127.0.0.1:9990",
|
|
//"heartbeatPeriod": 5000,
|
|
//"provider": "0xF5530012", // CLSID_LegacyCloudService
|
|
|
|
// FLS parameters
|
|
"fls": {
|
|
//"url": ""
|
|
},
|
|
|
|
// GCP parameters
|
|
"gcp": {
|
|
//"pubSubTopic": "",
|
|
//"saCredentials": "",
|
|
//"logTracers" : [] // See the "initializeLogging" command of GcpController
|
|
//"logLevel" : -1 // GCP library log level -1-disabled, 0-debug, 1-info, 2-error (default)
|
|
},
|
|
|
|
// AWS parameters
|
|
"aws": {
|
|
//"accessKey": ""
|
|
//"secretKey": "",
|
|
//"deliveryStream": "",
|
|
},
|
|
|
|
// Valkyrie parameters
|
|
"valkyrie": {
|
|
//"apiKey": "",
|
|
//"url": "",
|
|
}
|
|
},
|
|
|
|
// Policy compiler options
|
|
"policy": {
|
|
//"verbose": true // Show warnings in log during policy compiling
|
|
}
|
|
}
|