71 lines
2.2 KiB
C#
71 lines
2.2 KiB
C#
using System.Text.Json;
|
|
|
|
namespace OCSentinelCli;
|
|
|
|
internal sealed record ScannerConfiguration
|
|
{
|
|
public int WarningEventThreshold { get; init; } = 10;
|
|
|
|
public int CriticalEventThreshold { get; init; } = 30;
|
|
|
|
public int WarningUniqueIpThreshold { get; init; } = 5;
|
|
|
|
public int CriticalUniqueIpThreshold { get; init; } = 12;
|
|
|
|
public int LoginBurstWindowMinutes { get; init; } = 15;
|
|
|
|
public int WarningLoginBurstCount { get; init; } = 5;
|
|
|
|
public int CriticalLoginBurstCount { get; init; } = 20;
|
|
|
|
public int WarningSprayAccountCount { get; init; } = 5;
|
|
|
|
public int CriticalSprayAccountCount { get; init; } = 10;
|
|
|
|
public int CorrelationWarningCveThreshold { get; init; } = 1;
|
|
|
|
public int CorrelationCriticalCveThreshold { get; init; } = 1;
|
|
|
|
public bool RansomwareBetaEnabled { get; init; } = true;
|
|
|
|
public bool RansomwareBetaAlertingEnabled { get; init; }
|
|
|
|
public int RansomwareLookbackMinutes { get; init; } = 15;
|
|
|
|
public int RansomwareWarningSignalCount { get; init; } = 2;
|
|
|
|
public int RansomwareCriticalSignalCount { get; init; } = 3;
|
|
|
|
public bool RansomwareCaptureSmbSessions { get; init; } = true;
|
|
|
|
public bool RansomwareFileChurnEnabled { get; init; }
|
|
|
|
public int RansomwareFileChurnWindowMinutes { get; init; } = 15;
|
|
|
|
public int RansomwareFileChurnWarningDeleteCount { get; init; } = 50;
|
|
|
|
public int RansomwareFileChurnWarningWriteCount { get; init; } = 250;
|
|
|
|
public int RansomwareFileChurnCriticalDeleteCount { get; init; } = 200;
|
|
|
|
public int RansomwareFileChurnCriticalWriteCount { get; init; } = 1000;
|
|
|
|
public int RansomwareFileChurnMaxAuditEvents { get; init; } = 5000;
|
|
|
|
public List<string> RansomwareExcludedProcesses { get; init; } = [];
|
|
|
|
public List<string> FtpRoots { get; init; } = [];
|
|
|
|
public List<string> FileZillaRoots { get; init; } = [];
|
|
|
|
public List<string> ExcludedIps { get; init; } = [];
|
|
|
|
public static ScannerConfiguration Load(string path)
|
|
{
|
|
string fullPath = Path.GetFullPath(path);
|
|
string json = File.ReadAllText(fullPath);
|
|
ScannerConfiguration? config = JsonSerializer.Deserialize<ScannerConfiguration>(json, JsonOptions.Default);
|
|
return config ?? new ScannerConfiguration();
|
|
}
|
|
}
|