.env.sample

### Base Configuration ###
FQDN=misp.example.com
EGRESS_IP_SUBNET=192.168.200
INTERNAL_IP_SUBNET=192.168.201
DOCKER_PROXY_IP_SUBNET=192.168.202
BASE_FOLDER=/opt/git/cdc-platform
## This is required in the case of SSL inspection on your firewalls:
SSL_ROOT_CA=${BASE_FOLDER}/DATA/ssl/ssl-cert-snakeoil.pem
SSL_CA_BUNDLE=./DATA/ssl/ca-certificates.crt


### Traefik ###
## SSL Certificate and key for traefik
SSL_CERT=${BASE_FOLDER}/DATA/ssl/ssl-cert-snakeoil.pem
SSL_KEY=${BASE_FOLDER}/DATA/ssl/ssl-cert-snakeoil.key
## https://blog.roberthallam.org/2020/05/generating-a-traefik-nginx-password-hash-without-htpasswd/
##  openssl passwd -apr1
TRAEFIK_BASIC_AUTH_USER=traefik:$apr1$EsK/7TSe$JfV.KuI1a68xWaq2AmlAa/


### Cortex ###
# Default local auth:
#CORTEX_AUTH=ad
#CORTEX_AUTH_AD_SERVERNAMES=ad1.mydomain.local, ad2.mydomain.local
#CORTEX_AUTH_AD_DOMAINNAME=MYDOMAIN
#CORTEX_AUTH_AD_DOMAINFQDN=mydomain.local
#CORTEX_CONFIG_FILE=/etc/cortex/application.conf
#CORTEX_DEBUG=1
#CORTEX_DOCKER_HOST=unix:///var/run/docker.sock
CORTEX_ES_URL=http://elasticsearch:9200
#CORTEX_ES_AUTH_USER=
#CORTEX_ES_AUTH_PW=
CORTEX_VERSION=3.1.1
# echo "$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1)"
CORTEX_SECRET=


### TheHive ###
TH_AUTH_AD_WINDOMAIN=${CORTEX_AUTH_AD_DOMAINNAME}
TH_AUTH_AD_DNSDOMAIN=${CORTEX_AUTH_AD_DOMAINFQDN}
#TH_AUTH_AD_USESSL=false
TH_AUTH_AD_HOSTS=${CORTEX_AUTH_AD_SERVERNAMES}
#TH_AUTH_DEFAULTUSERDOMAIN=mydomain.local
#TH_DEBUG=1
TH_CORTEX_KEY=
#TH_CORTEX_URL=http://cortex:9001
#TH_MISP_INT_URL=http://misp-internal/
TH_MISP_INT_KEY=***
TH_MISP_INT_CASE_TEMPLATE="<Template_Name_goes_here>"
#TH_MISP_INT_MAX_AGE=7 days
# Optional tags to add to each observable  imported  from an  event available on this instance.
# Comma separated and "" list of Tags
#TH_MISP_INT_TAGS="misp-server-id"
# Comma separated and "" list of MISP orgs which should be excluded
#TH_MISP_INT_EXCLUDE_ORGS="bad organisation", "other orga"
# Comma separated and "" list of MISP tags which should be excluded
#TH_MISP_INT_EXCLUDE_TAGS="tag1", "tag2"
# Comma separated and "" list of MISP tags which should be whitelisted
#TH_MISP_INT_WHITELIST_TAGS="tag1", "tag2"
#TH_MISP_PUB_URL=http://misp-public/
TH_MISP_PUB_KEY=***
TH_MISP_PUB_CASE_TEMPLATE=${TH_MISP_INT_CASE_TEMPLATE}
# The age of the last publish date
#TH_MISP_PUB_MAX_AGE=7 days
# Optional tags to add to each observable  imported  from an  event available on this instance.
# Comma separated and "" list of Tags
#TH_MISP_PUB_TAGS="misp-server-id"
# Comma separated and "" list of MISP orgs which should be excluded
#TH_MISP_PUB_EXCLUDE_ORGS="bad organisation", "other orga"
# Comma separated and "" list of MISP tags which should be excluded
#TH_MISP_PUB_EXCLUDE_TAGS="tag1", "tag2"
# Comma separated and "" list of MISP tags which should be whitelisted
#TH_MISP_PUB_WHITELIST_TAGS="tag1", "tag2"
TH_VERSION=4.1.3
# echo "$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1)"
TH_SECRET=
TH_ELASTICSEARCH_HOSTS=elasticsearch


### Synapse for TheHive ###
#DEBUG=True
#TH_SYNAPSE_TH_URL=http://thehive:9000
#TH_SYNAPSE_TH_USER=synapse@local
#TH_SYNAPSE_EWS_AUTH_TYPE=NTLM
TH_SYNAPSE_TH_API_KEY=
TH_SYNAPSE_EWS_HOST=
TH_SYNAPSE_EWS_USERNAME=
TH_SYNAPSE_EWS_PASSWORD=
TH_SYNAPSE_EWS_SMTP_ADDRESS=
TH_SYNAPSE_EWS_FOLDER_NAME=

### Mihari ###
MIHARI_THEHIVE_API_ENDPOINT=http://thehive:9000
MIHARI_THEHIVE_API_KEY=
# Further ENV Keys https://github.com/ninoseki/mihari
# please always add prefix MIHARI_


### Cerebro ###
# echo "$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1)"
# CEREBRO_SECRET=
# CEREBRO_BASE_PATH=/es-admin/
# CEREBRO_ES_URL=http://${TH_ES_HOSTNAME}:9200
# CEREBRO_ES_AUTH_USER=kibanaserver
# CEREBRO_ES_AUTH_PW=kibanaserver
# # Set it to ldap to activate ldap authorization
#     #- AUTH_TYPE=ldap
# CEREBRO_AUTH_TYPE=basic
# CEREBRO_BASIC_AUTH_USER=
# CEREBRO_BASIC_AUTH_PW=
# CEREBRO_LDAP_URL=${AUTH_LDAP_SERVER_URI}
# CEREBRO_LDAP_BASE_DN=${AUTH_LDAP_BASE_DN}
# # User identifier that can perform searches
# CEREBRO_LDAP_BIND_DN=${AUTH_LDAP_BIND_DN}
# CEREBRO_LDAP_BIND_PW=${AUTH_LDAP_BIND_PASSWORD}
# # user-template executes a string.format() operation where
#     # username is passed in first, followed by base-dn. Some examples
#     #  - %s => leave user untouched
#     #  - %s@domain.com => append "@domain.com" to username
#     #  - uid=%s,%s => usual case of OpenLDAP
# CEREBRO_LDAP_USER_TEMPLATE=%s
# # If left unset LDAP_BASE_DN will be used
#     # LDAP_GROUP_BASE_DN=OU=users,DC=example,DC=com
# #CEREBRO_LDAP_GROUP_BASE_DN=
# # Attribute that represent the user, for example uid or mail
# CEREBRO_LDAP_USER_ATTR=mail
# # If left unset LDAP_USER_TEMPLATE will be used
# #CEREBRO_LDAP_USER_ATTR_TEMPLATE=%s
# # Filter that tests membership of the group. If this property is empty then there is no group membership check
#     # AD example => memberOf=CN=mygroup,ou=ouofthegroup,DC=domain,DC=com
#     # OpenLDAP example => CN=mygroup
#     # LDAP_GROUP=memberOf=memberOf=CN=mygroup,ou=ouofthegroup,DC=domain,DC=com
# CEREBRO_LDAP_GROUP=


### Watchtower ###
WATCHTOWER_NOTIFICATION_EMAIL_FROM=
WATCHTOWER_NOTIFICATION_EMAIL_TO=
WATCHTOWER_NOTIFICATION_EMAIL_SERVER=
WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=25
WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=
WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=


### OpenCTI ###
OPENCTI_VERSION=4.3.5
#OPENCTI_BASE_PATH=/opencti
OPENCTI_ADMIN_EMAIL=admin@opencti.io
# echo $(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1)
OPENCTI_ADMIN_PASSWORD=
MINIO_ACCESS_KEY=
MINIO_SECRET_KEY=
# echo $(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 10 | head -n 1)
RABBITMQ_DEFAULT_USER=
RABBITMQ_DEFAULT_PASS=
# To create a UUIDv4 token:
# https://www.uuidgenerator.net/version4
OPENCTI_ADMIN_TOKEN=
OPENCTI_CONNECTOR_HISTORY_ID=
OPENCTI_CONNECTOR_EXPORT_FILE_STIX_ID=
OPENCTI_CONNECTOR_EXPORT_FILE_CSV_ID=
OPENCTI_CONNECTOR_IMPORT_FILE_STIX_ID=
OPENCTI_CONNECTOR_IMPORT_FILE_PDF_OBSERVABLES_ID=
OPENCTI_CONNECTOR_OPENCTI_ID=
OPENCTI_CONNECTOR_CYBER_THREAT_COALITION_ID=
OPENCTI_CONNECTOR_CVE_ID=
OPENCTI_CONNECTOR_ALIENVAULT_ID=
OPENCTI_ALIENVAULT_API_KEY=
OPENCTI_CONNECTOR_CYBERCRIMETRACKER_ID=
OPENCTI_CONNECTOR_MALPEDIA_ID=
OPENCTI_MALPEDIA_API_KEY=
OPENCTI_CONNECTOR_HYGIENE_ID=
OPENCTI_CONNECTOR_MISP_INTERNAL_ID=
OPENCTI_MISP_INTERNAL_URL=http://misp-internal
OPENCTI_MISP_INTERNAL_API_KEY=
OPENCTI_CONNECTOR_MISP_PUBLIC_ID=
OPENCTI_MISP_PUBLIC_URL=http://misp-public
OPENCTI_MISP_PUBLIC_API_KEY=
OPENCTI_CONNECTOR_URLHAUS_ID=
OPENCTI_CONNECTOR_VIRUSTOTAL_ID=
OPENCTI_VIRUSTOTAL_API_KEY=
OPENCTI_CONNECTOR_THEHIVE_ID=
OPENCTI_THEHIVE_URL=http://thehive:9000
OPENCTI_THEHIVE_API_KEY=
OPENCTI_CONNECTOR_MITRE_ID=
OPENCTI_CONNECTOR_CRYPTOLAEMUS_ID=
OPENCTI_CONNECTOR_AMITT_ID=
OPENCTI_CONNECTOR_LASTINFOSEC_ID=
OPENCTI_LASTINFOSEC_API_KEY=
OPENCTI_CONNECTOR_MALBEACON_ID=
OPENCTI_MALBEACON_API_KEY=
OPENCTI_MALBEACON_AUTO=false


### Watcher ###
# Time Zone
TZ=Europe/Berlin
# SECURITY WARNING: In production please put DJANGO_DEBUG environment variable to False
DJANGO_DEBUG=False
# SECURITY WARNING: keep the secret key used in production secret!
# use 'openssl rand -base64 33' to generate
DJANGO_SECRET_KEY=
# In case of "Bad Request" Error when accessing Watcher web interface.
# Fill this variable with your Watcher Server Instance IP / or your Server FQDN.
# It is limited to a single IP address / FQDN. Please use this syntax: ALLOWED_HOST=X.X.X.X / ALLOWED_HOST=mywebsite.com
ALLOWED_HOST=watcher.${FQDN}
# DJANGO EMAIL CONFIGURATION
EMAIL_FROM=${WATCHTOWER_NOTIFICATION_EMAIL_FROM}
SMTP_SERVER=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER}
WATCHER_URL=https://${ALLOWED_HOST}
# THE HIVE SETUP
THE_HIVE_URL=http://thehive:9000
THE_HIVE_KEY=
THE_HIVE_CASE_ASSIGNEE=watcher
## MISP Setup
MISP_URL=http://misp-internal
MISP_VERIFY_SSL=False
MISP_KEY=
## Optional
MISP_TICKETING_URL=
## LDAP Setup
AUTH_LDAP_SERVER=test.example.com:389
AUTH_LDAP_SERVER_URI=ldap://${AUTH_LDAP_SERVER}
AUTH_LDAP_BIND_DN=
AUTH_LDAP_BIND_PASSWORD=
AUTH_LDAP_BASE_DN=OU=users,DC=example,DC=com
AUTH_LDAP_FILTER=(uid=%(user)s)
AUTH_LDAP_SSL=false
## Searx Setup
SEARX_HOSTNAME=10.10.10.3:8080
SEARX_PROTOCOL=http://
## automaticaly update settings to the new version
## comment this line if you made / will make some modifications to the settings
SEARX_COMMAND=-f
## If you have a proxy, please fill these variables
HTTP_PROXY=
HTTPS_PROXY=


### MISP Internal ###
## echo $(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 10 | head -n 1)
MISP_INTERNAL_MYSQL_USER=
MISP_INTERNAL_MYSQL_PASSWORD=
MISP_INTERNAL_MYSQL_ROOT_PASSWORD=
MISP_INTERNAL_ADMIN_EMAIL=admin@admin.test
MISP_INTERNAL_ADMIN_PASSPHRASE=
#
#MISP_INTERNAL_DATA_DIR=./data
MISP_INTERNAL_MYSQL_HOST=misp-internal-db
MISP_INTERNAL_MYSQL_DATABASE=misp
MISP_INTERNAL_POSTFIX_RELAY_HOST=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER}
MISP_INTERNAL_TIMEZONE=UTC
MISP_INTERNAL_BASEURL=https://misp.${FQDN}

### MISP Public ###
## echo $(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 10 | head -n 1)
MISP_PUBLIC_MYSQL_USER=
MISP_PUBLIC_MYSQL_PASSWORD=
#
#MISP_PUBLIC_DATA_DIR=./data
MISP_PUBLIC_MYSQL_HOST=misp-public-db
MISP_PUBLIC_MYSQL_DATABASE=misp
MISP_PUBLIC_MYSQL_ROOT_PASSWORD=${MISP_INTERNAL_MYSQL_ROOT_PASSWORD}
MISP_PUBLIC__BASEURL=https://mp.${FQDN}
MISP_PUBLIC__ADMIN_EMAIL=${MISP_INTERNAL_ADMIN_EMAIL}
MISP_PUBLIC__ADMIN_PASSPHRASE=${MISP_INTERNAL_ADMIN_PASSPHRASE}
MISP_PUBLIC_POSTFIX_RELAY_HOST=${MISP_INTERNAL_POSTFIX_RELAY_HOST}
MISP_PUBLIC_TIMEZONE=${MISP_INTERNAL_TIMEZONE}


### Hedgedoc ###
#HEDGEDOC_DEBUG=true
HEDGEDOC_LDAP_SERVER_URI=ldap://ad-server
HEDGEDOC_LDAP_BINDDN="cn=binduser,cn=Users,dc=internal,dc=example,dc=com"
HEDGEDOC_LDAP_BINDCREDENTIALS="<super secret password>"
HEDGEDOC_LDAP_SEARCHBASE="dc=internal,dc=example,dc=com"
#HEDGEDOC_LDAP_SEARCHFILTER=(&(objectcategory=person)(objectclass=user)(|(sAMAccountName={{username}})(mail={{username}})))
#HEDGEDOC_LDAP_USERIDFIELD=sAMAccountName
#HEDGEDOC_LDAP_PROVIDERNAME="Example Inc AD"


### n8n ###
##  openssl passwd -apr1
##  user: test1:test test2:test45
N8N_BASIC_AUTH_USER=test:$apr1$cqiWErmZ$BwQMWsfM7U5bXiYIVnTaD.,test2:$apr1$fJse90Uu$CxGEebbvW0v5W84ONOwTG0

### IntelOWL ###