TraceHunter/default-config.yaml at master · Viriliter/TraceHunter · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
application:
  name: RansomwareDetector
  version: 1.0.0
  environment: development
network:
  backend:
    host: 0.0.0.0
    port: 4100
  redis:
    host: localhost
    port: 6379
    db: 0
    password: null
    prefix: 'default:'
  frontend:
    host: localhost
    port: 4200
logging:
  level: 0
  console:
    enabled: true
    level: null
  file:
    enabled: false
    path: logs/application.log
    level: null
    max_size_mb: 10
    max_time_hours: null
    backup_count: 5
  format: '[%(levelname)-8s] [%(source)-15s] %(filename)s:%(lineno)-5s %(message)s'
tasks:
  FilesystemMonitor:
    enabled: false
    description: Monitors file system operations using ETW
    priority: high
  IOMonitor:
    enabled: false
    description: Monitors I/O operations and CPU usage
    priority: medium
  PerformanceMonitor:
    enabled: false
    description: Monitors system performance metrics
    priority: medium
  ProcessMonitor:
    enabled: false
    description: Monitors process creation and termination
    priority: high
  RegistryMonitor:
    enabled: false
    description: Monitors registry modifications
    priority: low
  TestMonitor:
    enabled: false
    description: Generates test alerts for development
    priority: low
whitelist:
  processes: null
  directories:
  - C:\Windows\System32\LogFiles\WMI\RtBackup\
  - C:\Users\MSI\AppData\
  - C:\Program Files\WindowsApps\
  - C:\Users\MSI\OneDrive\
  - C:\ProgramData\
  - C:\Device\
  - C:\Windows\Temp\
system_indexer:
  enabled: true
detection:
  entropy_threshold: 7.0
  file_operation_threshold: 50
  rapid_deletion_threshold: 20
  time_window_seconds: 10
  suspicion_score_alert_threshold: 70.0
  enable_machine_learning: false
  process_tree_cleanup_interval: 300
  max_events_per_process: 1000
response:
  auto_response_enabled: false