outliers.conf

##############################
# GENERAL
##############################
[general]

# Elasticsearch parameters
es_url=http://esnode1:9200
es_index_pattern=logstash-eagleeye-*
es_scan_size=10000
es_scroll_time=25m
es_timeout=300

# The field name representing the event timestamp in Elasticsearch
timestamp_field=@timestamp

# Save outlier detection results to Elasticsearch (if set to 0, Elasticsearch events won't be touched - great for testing)
es_save_results=1

# Print outlier matches to the console. For testing purposes, it's advised to enable this so that the analyst can directly see on the command line which outliers are detected
print_outliers_to_console=0

# How far back should we process events and look for outliers?
# Both values are combined (for example the below will look back 7 days and 12 hours, up until right now).
history_window_days=7
history_window_hours=12

# Wipe all existing outliers that fall in the history window upon first run
es_wipe_all_existing_outliers=0

# Should existing outliers be checked (and removed) for a match with the configuration whitelist
es_wipe_all_whitelisted_outliers=1


# General flags to run or test models
run_models=1
test_models=0

# 0 for no progress info,  1-4 for progressively more output, 5+ for all the log output
log_verbosity=1

# CRITICAL ERROR WARNING INFO DEBUG
log_level=INFO
log_file=/mappedvolumes/logs/outliers.log

##############################
# ASSET FIELDS
##############################
[assets]
meta.logged_in_users = user
meta.hostname = host
osqueryfilter.address = ip
suricatafilter.dest_ip = ip
suricatafilter.src_ip = ip
suricatafilter.tls.sni = domain
suricatafilter.http.hostname = domain
suricatafilter.dns.rrname = domain
brofilter.server_name = domain
brofilter.host = domain
brofilter.query = domain
brofilter.id_orig_h = ip
brofilter.id_resp_h = ip
brofilter.id_orig_h_geo_info.name = country
brofilter.id_resp_h_geo_info.name = country
brofilter.user = user
brofilter.src = ip
brofilter.dst = ip
wineventfilter.hostname = host
wineventfilter.workstationname = host
wineventfilter.ipaddress = ip
wineventfilter.targetusername = user
wineventfilter.subjectusername = user
syslogfilter.user-name = user
syslogfilter.calling-station-id = mac
syslogfilter.calling-station-id_geo_info.name = country
syslogfilter.username = user
binddnsfilter.clientip = ip
binddnsfilter.query = domain
officefilter.auditdata.userid = user
officefilter.auditdata.mailboxownerupn = user
officefilter.auditdata.clientipaddress = ip

##############################
# NOTIFIER
##############################
[notifier]
email_notifier=0
notification_email=user@user.be
smtp_user=<USERNAME>
smtp_pass=<PASSWORD>
smtp_server=<SMTP SERVER>
smtp_port=465
# Number of element keep in memory to avoid twice alerts for same notification
max_cache_ignore=1000

##############################
# DAEMON
##############################
[daemon]
# Only used when running ee-outliers in daemon mode. Below schedule will run each day at 00:00.
schedule=0 0 * * *

##############################
# SIMPLEQUERY PARAMETERS
##############################
[simplequery]
# If set to 1, ee-outliers will use the Elasticsearch highlight mechanism to find the fields and values that matched the
# search query.
# The matched fields and values are respectively added to new dictionary fields outliers.matched_fields and
# outliers.matched_values.
# If set to 0, do nothing.
highlight_match=0

##############################
# TERMS PARAMETERS
##############################
[terms]
# Define how many events should be processed at the same time, before looking for outliers.
# More often means better results, but will result in increased memory usage.
terms_batch_eval_size=100000

##############################
# METRICS PARAMETERS
##############################
[metrics]
# Define how many events should be processed at the same time, before looking for outliers.
# More often means better results, but will result in increased memory usage.
metrics_batch_eval_size=100000

##############################
# MACHINE LEARNING PARAMETERS
##############################
[machine_learning]
# Defaults to 0, so all logs are shown. Set TF_CPP_MIN_LOG_LEVEL to 1 to filter out INFO logs, 2 to additionall filter out WARNING, 3 to additionally filter out ERROR.
tensorflow_log_level=2
word2vec_batch_eval_size=1000
word2vec_use_cache=1
word2vec_use_test_data=0

training_data_size_pct=100
training_steps=100000
models_directory=/tmp/ee-outliers/trained_models/

##############################
# DERIVED FIELDS
##############################
[derivedfields]
# These fields will be extracted from all processed events, and added as new fields in case an outlier event is found.
# The format for the new field will be: outlier.derived_<field_name>, for example: outliers.derived_timestamp_year
# The format to use is GROK. These fields are extracted BEFORE the analysis happens, which means that these fields can also be used as for example aggregators or targets in use cases.
timestamp=%{YEAR:timestamp_year}-%{MONTHNUM:timestamp_month}-%{MONTHDAY:timestamp_day}[T ]%{HOUR:timestamp_hour}:?%{MINUTE:timestamp_minute}(?::?%{SECOND:timestamp_second})?%{ISO8601_TIMEZONE:timestamp_timezone}?

######################################################################################################################################################
# WHITELISTS
######################################################################################################################################################
[whitelist_literals]
slack_connection=rare outbound connection: Slack.exe

[whitelist_regexps]
scheduled_task_user_specific_2=^.*rare scheduled task:.*-.*-.*-.*-.*$
autorun_user_specific=^.*rare autorun:.*-.*-.*-.*-.*$