-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathconfig.yaml
More file actions
155 lines (135 loc) · 6.24 KB
/
Copy pathconfig.yaml
File metadata and controls
155 lines (135 loc) · 6.24 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
# VirtualBox EDR Sample Analysis System Configuration File
# HTTP Server Configuration
server:
host: "0.0.0.0" # Listen address
port: 8000 # Listen port
api_key: "edr-analysis-2025" # API key
upload_dir: "./uploads" # File upload directory
max_file_size: 104857600 # Maximum file size (100MB)
# Virtualization Platform Configuration
virtualization:
controller_type: "virtualbox" # Use VirtualBox
vboxmanage_path: "auto" # VBoxManage path, auto for auto-detection
vm_startup_mode: "gui" # VM startup mode: "gui" or "headless"
# Task Configuration
task_settings:
default_analysis_timeout: 180 # Default analysis timeout (seconds) - further reduced to 180s (3 minutes)
max_analysis_timeout: 1800 # Maximum analysis timeout (seconds)
cleanup_after_analysis: true # Whether to auto cleanup after analysis
concurrent_tasks: 10 # Number of concurrent tasks - increased from 8 to 10
max_queue_size: 100 # Maximum queue size
# Logging Configuration
logging:
level: "DEBUG" # Log level (DEBUG, INFO, WARNING, ERROR)
file: "./logs/vmm_edr.log" # Log file path
max_size: "10MB" # Maximum log file size
backup_count: 5 # Number of log files to keep
# Windows Analysis Configuration
windows:
# EDR Sample Analysis Configuration
edr_analysis:
# Virtual Machine Configuration
vms:
- name: "win10-64-defender"
antivirus: "defender"
username: "vboxuser"
password: "123456"
baseline_snapshot: "edr-baseline"
desktop_path: "C:\\Users\\vboxuser\\Desktop"
- name: "win10-64-mcafee"
antivirus: "mcafee"
username: "vboxuser"
password: "123456"
baseline_snapshot: "edr-baseline"
desktop_path: "C:\\Users\\vboxuser\\Desktop"
- name: "win10-64-kaspersky"
antivirus: "kaspersky"
username: "vboxuser"
password: "123456"
baseline_snapshot: "edr-baseline"
desktop_path: "C:\\Users\\vboxuser\\Desktop"
- name: "win10-64-avira"
antivirus: "avira"
username: "vboxuser"
password: "123456"
baseline_snapshot: "edr-baseline"
desktop_path: "C:\\Users\\vboxuser\\Desktop"
- name: "win10-64-trend"
antivirus: "trend"
username: "vboxuser"
password: "123456"
baseline_snapshot: "edr-baseline"
desktop_path: "C:\\Users\\vboxuser\\Desktop"
# Analysis Configuration - Further optimized timing settings for performance improvement
analysis_settings:
initial_check_delay: 2 # Wait time after sample delivery for detection (seconds) - further reduced to 2s
runtime_monitor_time: 60 # Monitor time after sample execution (seconds) - reduced from 90s to 60s
vm_startup_timeout: 300 # VM startup timeout (seconds) - reduced from 600s to 300s (5 minutes)
file_transfer_timeout: 10 # File transfer timeout (seconds)
# Sample File Configuration
sample_settings:
max_sample_size: 52428800 # Maximum sample size (50MB)
allowed_extensions: [".exe", ".dll", ".bat", ".ps1", ".vbs", ".jar", ".zip"] # Allowed file extensions
# Sysmon Analysis Configuration
sysmon_analysis:
# Whether to enable Sysmon analysis
enabled: true
# Sysmon dedicated virtual machine configuration
vm:
name: "win10-64-sysmon"
antivirus: "defender"
username: "vboxuser"
password: "123456"
baseline_snapshot: "edr-baseline"
desktop_path: "C:\\Users\\vboxuser\\Desktop"
# Sysmon configuration type
config_type: "light" # "light", "full", "custom"
# Custom configuration file path (used when config_type is custom)
custom_config_path: ""
# Event collection configuration
event_collection:
max_events: 1000 # Maximum number of events collected per analysis
collection_timeout: 30 # Event collection timeout (seconds)
# Sysmon Event Type IDs to collect:
# 1 - Process creation
# 2 - File creation time changed
# 3 - Network connection (TCP/UDP)
# 4 - Sysmon service state changed
# 5 - Process terminated
# 6 - Driver loaded
# 7 - Image loaded
# 8 - CreateRemoteThread (Thread injection)
# 9 - RawAccessRead (Raw disk access)
# 10 - ProcessAccess (Process memory access)
# 11 - FileCreate
# 12 - RegistryEvent (Object create and delete)
# 13 - RegistryEvent (Value Set) - includes startup entries
# 14 - RegistryEvent (Key and Value Rename)
# 15 - FileCreateStreamHash (NTFS stream created)
# 16 - ServiceConfigurationChange (Service configuration change)
# 17 - PipeEvent (Named pipe created)
# 18 - PipeEvent (Named pipe connected)
# 19 - WmiEvent (WMI filter)
# 20 - WmiEvent (WMI consumer)
# 21 - WmiEvent (WMI consumer filter)
# 22 - DNSEvent (DNS query)
# 23 - FileDelete (A file delete was detected)
# 24 - ClipboardChange (New content in the clipboard)
# 25 - ProcessTampering (Process image change)
# 26 - FileDeleteDetected (File delete logged)
# 27 - FileBlockExecutable (File block executable)
# 28 - FileBlockShredding (File block shredding)
event_types: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28]
# Analysis configuration
analysis_settings:
pre_execution_delay: 3 # Wait time before sample execution (seconds) - reduced from 5s to 3s
post_execution_delay: 45 # Wait time after sample execution (seconds) - reduced from 60s to 45s
enable_process_tree: true # Whether to build process tree
enable_network_analysis: true # Whether to analyze network connections
enable_file_analysis: true # Whether to analyze file operations
enable_registry_analysis: true # Whether to analyze registry operations
# Output configuration
output_settings:
save_raw_events: true # Whether to save raw event JSON
save_analysis_report: true # Whether to save analysis report
output_format: "json" # Output format: "json", "xml", "csv"