ews.cfg.default

[MAIN]
homedir = /opt/ews
spooldir = /opt/ews/spool
logdir = /opt/ews
del_malware_after_send = false
send_malware = true
sendlimit = 5000
contact = sender@example.com
proxy = None
ip_int = 1.1.1.1
ip_ext = 1.2.3.4

[EWS]
ews = false
username = <your ews portal username>
token = <your ews portal token>
rhost_first = https://<your ews portal 1>
rhost_second = https://<your ews portal 2>
ignorecert = false

[HPFEED]
hpfeed = false
host = localhost
port = 1337
channels = test
ident = username
secret= passwort
# path/to/certificate for tls broker - or "none" for non-tls broker
tlscert = none
# hpfeeds submission format: "ews" (xml) or "json"
hpfformat = ews

[EWSJSON]
json = false
jsondir = /opt/ewsposter/json

[INFLUXDB]
influxdb = false
host = http://influxdb
port = 8086
username = <your username for influx 1.8>
password = <your password for influx 1.8>
token = <your token for influx 2.0>
bucket = <your bucket/database for 2.0/1.8>
org = <your org for influx 2.0>

[GLASTOPFV3]
glastopfv3 = false
nodeid = <your unique analyzer id>
sqlitedb = /opt/honeypot/glastopf/data/db/glastopf.db
malwaredir = /opt/honeypot/glastopf/data/files

[COWRIE]
cowrie = false
nodeid = <your unique analyzer id>
logfile = /opt/cowrie/cowrie.json

[DIONAEA]
dionaea = false
nodeid =  <your unique analyzer id>
malwaredir = /opt/honeypot/dionaea/var/download
sqlitedb = /opt/honeypot/dionaea/var/logsql.sqlite

[HONEYTRAP]
honeytrap = false
nodeid =  <your unique analyzer id>
newversion = true
payloaddir = /opt/honeypot/honeytrap/attacks
attackerfile = /opt/honeypot/honeytrap/log/attacker.log

[EMOBILITY]
eMobility = false
nodeid = <your unique analyzer id>
logfile = /work2/ewsposter/emobility/emobility.log

[CONPOT]
conpot = false
nodeid = <your unique analyzer id>
logfile = /opt/conpot/conpot.json

[ELASTICPOT]
elasticpot = false
nodeid = <your unique analyzer id>
logfile = /opt/elasticpot/log/elasticpot.json

[SURICATA]
suricata = false
nodeid = <your unique analyzer id>
logfile = /opt/suricata/logs/suricata_ews.log

[MAILONEY]
mailoney = false
nodeid = <your unique analyzer id>
logfile = /opt/mailoney/commands.log

[RDPY]
rdpy = false
nodeid = <your unique analyzer id>
logfile = /opt/rdpy/log/rdpy.log

[VNCLOWPOT]
vnclowpot = false
nodeid = <your unique analyzer id>
logfile = /opt/vnclowpot/log/vnclowpot.log

[HERALDING]
heralding = false
nodeid = <your unique analyzer id>
logfile = /opt/heralding/log/auth.csv

[CISCOASA]
ciscoasa = false
nodeid = <your unique analyzer id>
logfile = /opt/ciscoasa/log/ciscoasa.log

[TANNER]
tanner = false
nodeid = <your unique analyzer id>
logfile = /opt/tanner/log/tanner_report.json

[GLUTTON]
glutton = false
nodeid = <your unique analyzer id>
logfile = /opt/glutton/log/tanner.log

[HONEYSAP]
honeysap = false
nodeid = <your unique analyzer id>
logfile = /opt/honeysap/log/honeysap-external.log

[ADBHONEY]
adbhoney = false
nodeid = <your unique analyzer id>
logfile = /opt/adbhoney/log/adbhoney.json
malwaredir = /opt/adbhoney/downloads

[FATT]
fatt = false
nodeid = <your unique analyzer id>
logfile = /opt/fatt/log/fatt.log

[IPPHONEY]
ipphoney = false
nodeid = <your unique analyzer id>
logfile = /opt/ipphoney/log/ipphoney.log

[DICOMPOT]
dicompot = false
nodeid = <your unique analyzer id>
logfile = /opt/dicompot/log/dicompot.log

[MEDPOT]
medpot = false
nodeid = <your unique analyzer id>
logfile = /opt/medpot/log/medpot.log

[HONEYPY]
honeypy = false
nodeid = <your unique analyzer id>
logfile = /opt/honeypy/log/json.log

[CITRIX]
citrix = false
nodeid = <your unique analyzer id>
logfile = /opt/citrixhoneypot/log/server.log

[REDISHONEYPOT]
redishoneypot = false
nodeid = <your unique analyzer id>
logfile = /opt/redishoneypot/log/redishoneypot.log

[ENDLESSH]
endlessh = false
nodeid = <your unique analyzer id>
logfile = /opt/endlessh/log/endlessh.log

[SENTRYPEER]
sentrypeer = false
nodeid = <your unique analyzer id>
logfile = /opt/sentrypeer/log/sentrypeer.json

[LOG4POT]
log4pot = false
nodeid = <your unique analyzer id>
logfile = /opt/log4pot/log/log4pot.log