| 1 | min_confidence: 65 |
| 2 | output_dir: output |
| 3 | fixtures_dir: fixtures |
| 4 | use_fixtures: false |
| 5 | |
| 6 | wazuh_etc_dir: /var/ossec/etc |
| 7 | |
| 8 | feeds: |
| 9 | threatfox: |
| 10 | enabled: true |
| 11 | days: 1 |
| 12 | feodo: |
| 13 | enabled: true |
| 14 | urlhaus: |
| 15 | enabled: true |
| 16 | otx: |
| 17 | enabled: true |
| 18 | openphish: |
| 19 | enabled: true |
| 20 | leaks: |
| 21 | enabled: false |
| 22 | endpoint: "" |
| 23 | watch_domains: |
| 24 | - example.com |
| 25 | |
| 26 | rules: |
| 27 | base_id: 100300 |
| 28 | |
| 29 | approval: |
| 30 | base_url: https://cti.lab.local |
| 31 | token_ttl: 86400 |
| 32 | analyst_email: soc-analyst@example.com |
| 33 | |
| 34 | email: |
| 35 | backend: smtp |
| 36 | from_addr: cti-pipeline@lab.local |
| 37 | smtp_host: smtp.lab.local |
| 38 | smtp_port: 587 |
| 39 | use_tls: true |