security-documents-generator/config.sample.json at main · enriquesanchez-elastic/security-documents-generator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
{
  "_comment": "API Key authentication (recommended for production and cloud deployments)",
  "elastic": {
    "node": "https://your-cluster.es.region.gcp.elastic-cloud.com",
    "apiKey": "<your-elastic-api-key-here>"
  },
  "kibana": {
    "node": "https://your-kibana.kb.region.gcp.elastic-cloud.com:9243",
    "apiKey": "<your-kibana-api-key-here>"
  },
  "_comment_alternative": "For local development, use: 'node': 'http://localhost:9200', 'username': 'elastic', 'password': 'changeme'",
  "serverless": false,
  "eventIndex": "logs-testlogs-default",
  "eventDateOffsetHours": 24,
  "useAI": true,
  "openaiApiKey": "<your-openai-api-key-here>",
  "useAzureOpenAI": false,
  "azureOpenAIApiKey": "<your-azure-openai-api-key-here>",
  "azureOpenAIEndpoint": "<your-azure-openai-endpoint-here>",
  "azureOpenAIDeployment": "<your-azure-openai-deployment-here>",
  "azureOpenAIApiVersion": "2024-08-01-preview",
  "useClaudeAI": false,
  "claudeApiKey": "<your-anthropic-api-key-here>",
  "claudeModel": "claude-3-5-sonnet-20241022",
  "mitre": {
    "enabled": true,
    "tactics": ["TA0001", "TA0002", "TA0003", "TA0004", "TA0005"],
    "maxTechniquesPerAlert": 2,
    "includeSubTechniques": true,
    "probabilityOfMitreAlert": 0.3,
    "enableAttackChains": true,
    "maxChainLength": 3,
    "chainProbability": 0.15
  },
  "generation": {
    "alerts": {
      "defaultCount": 100,
      "batchSize": 10,
      "maxFields": 50,
      "minFields": 15,
      "largeBatchSize": 25,
      "maxLargeBatchSize": 50,
      "parallelBatches": 3
    },
    "events": {
      "defaultCount": 500,
      "batchSize": 20,
      "maxFields": 40,
      "minFields": 10,
      "largeBatchSize": 40,
      "maxLargeBatchSize": 80,
      "parallelBatches": 4
    },
    "entities": {
      "defaultHosts": 20,
      "defaultUsers": 15,
      "maxHostsPerBatch": 100,
      "maxUsersPerBatch": 100
    },
    "performance": {
      "enableLargeScale": false,
      "largeScaleThreshold": 1000,
      "maxConcurrentRequests": 5,
      "requestDelayMs": 100,
      "cacheEnabled": true,
      "maxCacheSize": 200,
      "progressReporting": true
    }
  },
  "timestamps": {
    "startDate": "7d",
    "endDate": "now",
    "pattern": "uniform",
    "enableMultiDay": true,
    "daySpread": 7,
    "examples": {
      "10_minutes_ago": "10m",
      "30_minutes_ago": "30m",
      "2_hours_ago": "2h",
      "24_hours_ago": "24h",
      "7_days_ago": "7d",
      "1_week_ago": "1w",
      "1_month_ago": "1M",
      "specific_date": "2024-01-01T00:00:00Z",
      "patterns": ["uniform", "business_hours", "random", "attack_simulation", "weekend_heavy"]
    }
  }
}