config.toml

# Rustinel Configuration File
# This file is optional - the agent will use defaults if not present

# 1. Feature Toggles & Rules
[scanner]
sigma_enabled = true
sigma_rules_path = "rules/sigma"
yara_enabled = true
yara_rules_path = "rules/yara"

[reload]
enabled = true
debounce_ms = 2000          # debounces real-time filesystem events; fallback polling is 60s

# Shared allowlist applied to:
# - response.allowlist_paths
# - ioc.hash_allowlist_paths
# - scanner.yara_allowlist_paths
#
# Platform defaults are compiled in - only set this to override them.
#
# Windows defaults:
#   C:\Windows\, C:\Program Files\, C:\Program Files (x86)\
# Linux defaults:
#   /usr/bin/, /usr/sbin/, /usr/lib/, /usr/lib64/, /usr/libexec/,
#   /bin/, /sbin/, /lib/, /lib64/
#
# [allowlist]
# paths = [
#   "/usr/bin/",
#   "/usr/sbin/",
#   "/custom/trusted/path/",
# ]

# 2. Operational Logging (The Agent's internal health)
#    Writes to: {directory}/{filename}.<date>
[logging]
level = "info"              # trace, debug, info, warn, error
# Optional target-aware filter (takes precedence over level when set)
# filter = "info,engine=info,scanner=info,ioc=info,rustinel::normalizer=info"
directory = "logs"
filename = "rustinel.log"
console_output = false      # Default outside interactive `run`; use `run --no-console` to suppress console logs

# 3. Security Alerts (The Detection Output)
#    Writes to: {directory}/{filename}.<date>
[alerts]
directory = "logs"
filename = "alerts.json"    # Will contain newline-delimited JSON (NDJSON)
match_debug = "off"         # off | summary | full (attach match details to alerts.json)

# 3a. Alert Deduplication
#   Collapses repeated identical alerts within a fixed window anchored to the
#   first occurrence into a single rollup alert carrying event.count.  The first
#   occurrence always emits immediately - there is no detection latency penalty.
#
#   event.count on the rollup is the number of *suppressed* repeats (the first
#   occurrence is already its own line, which carries no event.count).  Summing
#   event.count across lines - absent meaning 1 - gives the true event volume.
#
#   Disable for high-fidelity environments where every individual event matters.
[dedup]
enabled = true
window_secs = 60    # window length; repeats within this period are aggregated
max_entries = 10000 # memory cap on distinct alert keys tracked simultaneously

# 4. Active Response (Optional Prevention)
[response]
enabled = false
prevention_enabled = false
min_severity = "critical"   # sigma: critical only; yara always treated as critical
channel_capacity = 128
# Processes that will never be terminated, matched by image basename or full path.
# Complement the compiled-in path allowlist above for named system processes.
#
# Windows examples: smss.exe, csrss.exe, wininit.exe, lsass.exe, svchost.exe
# Linux examples:  systemd, systemd-journald, sshd, dbus-daemon, auditd
#
# allowlist_images = []

# 5. Process Metadata Cache
[process]
max_entries = 65536 # maximum process records retained when exit events are missed

# 6. Network Connection Metrics
[network]
aggregation_enabled = true
aggregation_max_entries = 20000
aggregation_window_secs = 60
aggregation_interval_buffer_size = 50

# 6a. Behavioral Recording (rustinel capture)
#   Recordings hold normalized events - command lines, file paths, destinations,
#   and user names - so treat them like alert output: they are written
#   owner-only and kept apart from alert and operational logs.
[capture]
directory = "captures"      # default parent for rustinel-capture-<UTC timestamp>.ndjson

# 6b. Pipeline Telemetry Counters
#   Every channel between a sensor and the detectors is bounded and sheds load
#   rather than blocking, so a burst produces a detection gap instead of a
#   slowdown. The counters below make that gap measurable: `rustinel doctor`
#   reads the snapshot and reports how many events were dropped, per channel.
#
#   The counters and their rate-limited warnings are always on. This section
#   only controls whether they are written to {logging.directory}/telemetry.json
#   for another process to read.
[telemetry]
enabled = true
snapshot_interval_secs = 30 # a snapshot is also written at shutdown

# 7. Atomic IOC Detection (Hashes, IPs, Domains, Path Regex)
[ioc]
enabled = true
hashes_path = "rules/ioc/hashes.txt"
ips_path = "rules/ioc/ips.txt"
domains_path = "rules/ioc/domains.txt"
paths_regex_path = "rules/ioc/paths_regex.txt"
default_severity = "high"
max_file_size_mb = 50