You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/en/docs/getting-started/_index.md
+21Lines changed: 21 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -98,6 +98,7 @@ LOG_FORMAT: "json"
98
98
ENABLE_FINS: false
99
99
MQTT_BROKER: "localhost"
100
100
MQTT_PORT: 1883
101
+
VALIDATION_SCHEMA_URL: ""
101
102
{{< /tab >}}
102
103
{{< /tabpane >}}
103
104
@@ -113,3 +114,23 @@ make build
113
114
cp .env.example .env
114
115
./build/soarca
115
116
```
117
+
118
+
### Configuring SOARCA
119
+
120
+
|variable |content |description
121
+
|---|---|---|
122
+
|PORT |port |Set the exposed port of SOARCA the default is `8080`
123
+
|DATABASE |true \| false | Set if you want to run with external database default is `false`
124
+
|MONGODB_URI |uri |Set the Mongo DB uri default is `mongodb://localhost:27017`
125
+
|DATABASE_NAME |name |Set the Mongo DB database name when using docker default is `soarca`
126
+
|DB_USERNAME |user |Set the Mongo DB database user when using docker default is `root`
127
+
|DB_PASSWORD |password |Set the Mongo DB database users password when using docker default is `rootpassword`. IT IS RECOMMENDED TO CHANGE THIS IN PRODUCTION!
128
+
|MAX_REPORTERS |number |Set the maximum number of downstream reporters default is `5`
129
+
|LOG_GLOBAL_LEVEL |[Log levels] |One of the specified log levels. Defaults to `info`
130
+
|LOG_MODE |development \| production |If production is chosen the `LOG_GLOBAL_LEVEL` is used for all modules defaults to `production`
131
+
|LOG_FILE_PATH |filepath |Path to the logfile you want to use for all logging. Defaults to `""` (empty string)
132
+
|LOG_FORMAT |text \| json |The logging can be in plain text format or in JSON format. Defaults to `json`
133
+
|MQTT_BROKER | dns name or ip | The broker address for SOARCA to connect to, for communication with fins default is `localhost`
134
+
|MQTT_PORT | port | The broker address for SOARCA to connect to, for communication with fins default is `1883`
135
+
|ENABLE_FINS| true \| false | Enable fins in SOARCA defaults to `false`
136
+
|VALIDATION_SCHEMA_URL|url| Set a custom validation schema to be used to validate playbooks defaul is `""` to use internal. NOTE: changing this heavily impacts performance.
"description": "In a CACAO playbook, agents are the entities that execute commands (see section 5) on or against targets. Agents are stored in a dictionary where the ID is the key and the value is an 'agent-target' object (see section 10.1). Targets are stored in a dictionary where the ID is the key and the value is an 'agent-target' object (see section 10.1). Common properties for agents and targets are defined in section 7.1. \n\nAgents can involve either manual or automated processing. For example, an individual may process a command manually, while a firewall may process a command automatically. An agent and target type vocabulary is defined in section 7.2, and each agent and target type is further defined in the rest of the sections. Types include security infrastructure such as firewalls, routers, and threat intelligence platforms, as well as specific network addressable agents like URLs and IPv4/IPv6/MAC addresses. \n\nAgents and targets can use and refer to variables just like other parts of the playbook. For any agent or target property value, the producer may define a variable substitution such that the actual property value is determined at runtime based on the variable assigned to the agent or target. In Example 7.1, an agent is referenced within a workflow step, but the agent's actual values are based on variables (e.g., name, email, phone, location) instead of being hard-coded by the agent itself. \n\nEach object (agent or target) contains base properties that are common across all objects. These properties are defined in the following table. The ID for each object is stored as the key in the agent_definitions dictionary or the target_definitions dictionary.",
6
+
"type": "object",
7
+
"properties": {
8
+
"type": {
9
+
"$ref": "#/$defs/agent-target-type-ov",
10
+
"description": "The type of object being used. The value of this property SHOULD come from the 'agent-target-type-ov' vocabulary."
11
+
},
12
+
"name": {
13
+
"type": "string",
14
+
"description": "The name that represents this object that is meant to be displayed in a user interface or captured in a log message. This property MUST be populated."
15
+
},
16
+
"description": {
17
+
"type": "string",
18
+
"description": "More details, context, and possibly an explanation about this object. This property SHOULD be populated."
19
+
},
20
+
"location": {
21
+
"$ref": "../data-types/civic-location.json",
22
+
"description": "Physical address information for this object."
"description": "This property declares the extensions that are in use on this action or target and contains any of the properties and values that are to be used by that extension. \n\nThe key for each entry in the dictionary MUST be an 'identifier' (see section 10.10 for more information on identifiers) that uniquely identifies the extension. The value for each key is a JSON object that contains the structure as defined in the extension definition's schema property. The actual step extension definition is located in the 'extension_definitions' property found at the Playbook level."
"description": "This type defines a group object and is used for commands that need to be processed or executed by a group. This object inherits the common agent properties. In addition to the inherited properties, this section defines the following additional property that is valid for this type.",
6
+
"type": "object",
7
+
"allOf": [
8
+
{
9
+
"$ref": "agent-target.json"
10
+
},
11
+
{
12
+
"properties": {
13
+
"type": {
14
+
"type": "string",
15
+
"description": "The value of this property MUST be 'group'.",
16
+
"enum": [
17
+
"group"
18
+
]
19
+
},
20
+
"contact": {
21
+
"$ref": "../data-types/contact.json",
22
+
"description": "Contact information for this agent."
0 commit comments