Skip to content

Latest commit

 

History

History
132 lines (89 loc) · 5.95 KB

.env.markdown

File metadata and controls

132 lines (89 loc) · 5.95 KB

Environment file info

If you're running in production, you should set these securely.

However, if you just want to experiment, set the following values

Django Settings

These are all Django settings, defined in obstracts/settings.py

  • DJANGO_SECRET: insecure_django_secret
  • DJANGO_DEBUG: True
  • DJANGO_ALLOWED_HOSTS: BLANK
  • DJANGO_CORS_ALLOW_ALL_ORIGINS: True
  • DJANGO_CORS_ALLOWED_ORIGINS: LEAVE EMPTY

Postgres Settings

These are all Django settings, defined in obstracts/settings.py

  • POSTGRES_HOST: pgdb
  • POSTGRES_PORT: BLANK
  • POSTGRES_DB: postgres
  • POSTGRES_USER: postgres
  • POSTGRES_PASSWORD: postgres

Celery settings

  • CELERY_BROKER_CONNECTION_RETRY_ON_STARTUP: 1

Obstracts API settings

These define how the API behaves.

  • MAX_PAGE_SIZE: 50
    • This is the maximum number of results the API will ever return before pagination
  • DEFAULT_PAGE_SIZE: 50
    • The default page size of result returned by the API

ArangoDB settings

Note, this code will not install an ArangoDB instance.

If you're new to ArangoDB, you can install the community edition quickly by following the instructions here.

The script will automatically create a database called obstracts_database when the container is spun up (if it does not exist).

For each blog added, two new collections will be created in the format

<FEED_NAME>_<FEED_ID>-<COLLECTION_TYPE>_collection

e.g.

  • graham_cluley_9288374-0298740-94875-vertex_collection

  • graham_cluley_9288374-0298740-94875-edge_collection

  • ARANGODB_HOST_URL: 'http://host.docker.internal:8529'

    • If you are running ArangoDB locally, be sure to set ARANGODB_HOST_URL='http://host.docker.internal:8529' in the .env file otherwise you will run into networking errors.

  • ARANGODB_USERNAME: root

    • Change this if neeed

  • ARANGODB_PASSWORD: USE PASSWORD OF ARANGODB_USERNAME

history4feed settings

Obstracts requires history4feed to download and store blog posts.

  • HISTORY4FEED_URL: 'http://host.docker.internal:8002/'
    • If you are running history4feed locally, be sure to set 'http://host.docker.internal:8002/' in the .env file otherwise you will run into networking errors.

AI Settings

  • INPUT_TOKEN_LIMIT: 15000
    • (REQUIRED IF USING AI MODES) Ensure the input/output token count meets requirements and is supported by the model selected. Will not allow files with more than tokens specified to be processed
  • TEMPERATURE: 0.0
    • The temperature value ranges from 0 to 2, with lower values indicating greater determinism and higher values indicating more randomness in responses.
  • OPENAI_API_KEY: YOUR_API_KEY
  • ANTHROPIC_API_KEY: YOUR_API_KEY
  • GOOGLE_API_KEY:
    • (REQUIRED IF USING GOOGLE GEMINI MODELS IN AI MODES) get it from the Google Cloud Platform (making sure the Gemini API is enabled for the project)

BIN List

CTIBUTLER

Obstracts requires ctibutler to lookup ATT&CK, CAPEC, CWE, ATLAS, and locations

  • CTIBUTLER_BASE_URL: 'http://api.ctibutler.com' (recommended)
    • If you are running CTI Butler locally, be sure to set 'http://host.docker.internal:8006/api/' in the .env file otherwise you will run into networking errors.
  • CTIBUTLER_API_KEY:

VULMATCH FOR CVE AND CPE LOOKUPS

Obstracts requires vulmatch to lookup CVEs and CPEs

  • VULMATCH_BASE_URL: 'http://api.vulmatch.com' (recommended)
    • If you are running Vulmatch locally, be sure to set 'http://host.docker.internal:8005/api/' in the .env file otherwise you will run into networking errors.
  • VULMATCH_API_KEY:

file2txt settings

R2 storage configuration

You can choose to store static assets on Cloudflare on R2. Default is local.

  • USE_S3_STORAGE: 0
    • Set to 1 to enable
  • R2_ENDPOINT_URL: BLANK
    • Will be something like https://ID.r2.cloudflarestorage.com
  • R2_BUCKET_NAME: BLANK
    • The bucket name you want to use.
  • R2_ACCESS_KEY: BLANK
    • generated when creating an R2 API token. Make sure has read+write to R2_BUCKET_NAME specified
  • R2_SECRET_KEY: BLANK
    • generated when creating an R2 API token
  • R2_CUSTOM_DOMAIN: BLANK
    • this value is optional when using R2, but if you don't set your bucket to public, your images will hit 403s as they will hit the raw endpoint (e.g. https://ID.r2.cloudflarestorage.com/BUCKET/IMAGE/PATH.jpg) which will be inaccessible. The easiest way to do this is to enable R2.dev subdomain for the bucket. Looks like pub-ID.r2.dev . Do not include the https:// part

DOGESEC COMMONS

  • SRO_OBJECTS_ONLY_LATEST: False
    • Due to the way stix2arango works, SCOs with same ID (and also relationships connecting them to other object) will be aged out . This doesn't work in Stixify because we create the same SCO for many reports, but only one is ever _is_latest=true due to S2A versioning logic. This value should always be set to false to ensure all relationships to SCOs are shown via the API. You can read more about this in this issue