config.example.yaml

# SSlogs 配置文件示例
#
# 安全提示：
# 1. 不要在版本控制中提交包含真实API密钥的配置文件
# 2. 建议使用环境变量存储敏感信息
# 3. 复制此文件为 config.yaml 并填入您的配置

# 日志文件配置
log_path: logs/*.log
server:
  ip: 192.168.1.100  # 目标服务器IP地址

# 日志格式配置
log_format:
  type: web
  timestamp_format: '%d/%b/%Y:%H:%M:%S %z'
  fields:
    src_ip: (\d+\.\d+\.\d+\.\d+)
    timestamp: \[(.*?)\]
    request_line: '"([A-Z]+\s+[^\s]+\s+HTTP/[\d\.]+)"'
    request_method: '"([A-Z]+)\s'
    request_path: '"[A-Z]+\s+([^\s]+)\s'
    http_version: '(HTTP/\d\.\d)"'
    status_code: '"\s+(\d{3})\s+'
    response_size: '\s+(\d+)\s+'
    processing_time: '\s+([\d.]+)\s+'
    user_agent: '"user_agent":"([^"]*)"'
    client_info: '{(.*?)}'

# 规则引擎配置
rule_dir: rules
rules:
  path: rules/
  default_severity: medium
  case_sensitive: false
  max_matches: 50
  auto_reload: true

# 分析配置
analysis:
  batch_size: 1000
  max_events: 100
  memory_limit_mb: 500
  dynamic_batch_size: true
  memory_optimization: aggressive
  rule_preloading: true

context_lines: 5

# AI分析配置
ai_analysis:
  high_risk_only: true
  successful_attacks_only: true
  # 攻击成功的HTTP状态码定义
  success_status_codes:
  - '200'
  - '201'
  - '202'
  - '204'
  - '301'
  - '302'
  - '304'
  max_ai_analysis: 5
  high_risk_severity: high

# AI服务配置
#
# 安全建议：使用环境变量存储API密钥
# export SSLOGS_AI_API_KEY="your-actual-api-key"
#
# 或者在本配置文件中使用环境变量引用：
# api_key: ${SSLOGS_AI_API_KEY}
ai:
  type: cloud
  local_provider: ollama
  cloud_provider: deepseek
  max_retries: 3
  retry_delay: 1
  retry_backoff: 2
  default_timeout: 30

# DeepSeek AI 配置
deepseek:
  api_key: YOUR_DEEPSEEK_API_KEY  # 替换为您的实际API密钥
  model: deepseek-ai/DeepSeek-V3
  base_url: https://api.siliconflow.cn/v1/chat/completions
  timeout: 30
  max_tokens: 2048

# Ollama 本地AI配置
ollama:
  model: deepseek-r1:14b
  base_url: http://localhost:11434/api/chat
  timeout: 60

# LM Studio 配置 (v3.1新增)
lm_studio:
  base_url: http://localhost:1234/v1/chat/completions
  model: auto
  timeout: 60
  max_tokens: 2048
  temperature: 0.7

# 输出配置
output_dir: output
report_type: html
report:
  template: templates/report_template.html
  output_format: html
  output_directory: reports

# 白名单配置
whitelist:
  safe_agents:
    - googlebot
    - bingbot
    - slurp
    - duckduckbot
    - baiduspider
    - yandexbot
    - facebookexternalhit
    - twitterbot
    - linkedinbot
    - pinterest
    - applebot
    - semrushbot
    - mj12bot
    - ahrefsbot
    - dotbot
    - archive.org_bot
  static_extensions:
    - .css
    - .js
    - .jpg
    - .jpeg
    - .png
    - .gif
    - .svg
    - .ico
    - .woff
    - .woff2
    - .ttf
    - .eot
    - .otf
    - .mp4
    - .mp3
    - .avi
    - .mov
    - .pdf
    - .xml
  health_paths:
    - /health
    - /healthcheck
    - /ping
    - /status
    - /metrics
    - /actuator/health
    - /ready
    - /.well-known/
    - /robots.txt
    - /favicon.ico
  internal_ips:
    - 127.0.0.1
    - ::1
    - localhost

# 规则引擎配置
rule_engine:
  enable_context_analysis: true
  threat_scoring: true
  false_positive_filter: true
  adaptive_threshold: true
  rule_cache_size: 1000
  enable_precompilation: true

# 性能监控配置
performance:
  enable_monitoring: true
  track_memory: true
  track_time: true
  error_rate_threshold: 10
  memory_warning_threshold: 500
  performance_log_interval: 100

# GeoIP数据库路径
geoip_db_path: /Users/wooluo/DEV/SSlogs/config/GeoLite2-Country.mmdb

# 日志配置
logging:
  level: INFO
  format: '%(asctime)s - %(name)s - %(levelname)s - %(message)s'
  file: logs/sslogs.log