CyberMind-FR
7ff9ee3805
Correlation Library (correlation-lib.sh): - IP reputation tracking with configurable decay - Full context gathering from MITM, DPI, WAF streams - CrowdSec decision checking and notification - Correlation entry builder with rich context Enhanced Correlator (dpi-correlator v2): - Watches WAF alerts, CrowdSec decisions, DPI flows - Auto-ban for high-reputation IPs (threshold: 80) - Notification queue for high-severity threats - CLI: correlate, reputation, context, search, stats LuCI Timeline View: - Correlation timeline with colored event cards - IP context modal showing MITM requests + WAF alerts - Quick ban button with CrowdSec integration - Search by IP functionality - Stats: total, high-threat, banned, unique IPs RPCD Methods (8 new): - get_correlation_stats, get_ip_context, get_ip_reputation - get_timeline, search_correlations, ban_ip, set_auto_ban UCI Config: auto_ban, auto_ban_threshold, notifications Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
32 lines
761 B
Plaintext
32 lines
761 B
Plaintext
config global 'settings'
|
|
option enabled '1'
|
|
option mode 'dual'
|
|
option correlation '1'
|
|
option stats_dir '/tmp/secubox'
|
|
option flow_dir '/tmp/dpi-flows'
|
|
|
|
config mitm 'mitm'
|
|
option enabled '1'
|
|
option buffer_size '1000'
|
|
option async_analysis '1'
|
|
option replay_on_alert '1'
|
|
option buffer_dir '/tmp/dpi-buffer'
|
|
|
|
config tap 'tap'
|
|
option enabled '1'
|
|
option interface 'tap0'
|
|
option mirror_source 'eth0'
|
|
option mirror_mode 'software'
|
|
option flow_retention '300'
|
|
option netifyd_instance 'tap'
|
|
|
|
config correlation 'correlation'
|
|
option enabled '1'
|
|
option window '60'
|
|
option output '/tmp/secubox/correlated-threats.json'
|
|
option watch_crowdsec '1'
|
|
option auto_ban '0'
|
|
option auto_ban_threshold '80'
|
|
option notifications '1'
|
|
option reputation_decay '5'
|