soc/soc-integrator/app/config.py

from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8")

    app_name: str = "soc-integrator"
    app_env: str = "dev"
    log_level: str = "INFO"

    soc_integrator_internal_key: str = "dev-internal-key"
    soc_integrator_db_host: str = "soc-integrator-db"
    soc_integrator_db_port: int = 5432
    soc_integrator_db_name: str = "soc_integrator"
    soc_integrator_db_user: str = "soc_integrator"
    soc_integrator_db_password: str = "soc_integrator_password"

    wazuh_base_url: str = "https://wazuh.manager:55000"
    wazuh_username: str = "wazuh-wui"
    wazuh_password: str = "MyS3cr37P450r.*-"
    wazuh_indexer_url: str = "https://wazuh.indexer:9200"
    wazuh_indexer_username: str = "admin"
    wazuh_indexer_password: str = "SecretPassword"
    wazuh_auto_sync_enabled: bool = True
    wazuh_auto_sync_interval_seconds: int = 60
    wazuh_auto_sync_query: str = "*"
    wazuh_auto_sync_limit: int = 50
    wazuh_auto_sync_minutes: int = 120
    log_loss_monitor_enabled: bool = False
    log_loss_monitor_interval_seconds: int = 60
    log_loss_monitor_window_minutes: int = 5
    log_loss_monitor_create_iris_ticket: bool = False
    log_loss_monitor_ticket_cooldown_seconds: int = 900
    c_detection_enabled: bool = True
    c_detection_window_minutes: int = 30
    c1_max_travel_speed_kmph: int = 900
    c2_offhours_start_utc: int = 20
    c2_offhours_end_utc: int = 6
    c3_host_spread_threshold: int = 5
    c3_scan_port_threshold: int = 20
    c_detection_create_iris_ticket: bool = True
    c_detection_ticket_cooldown_seconds: int = 900
    geoip_provider: str = "ipwhois"
    geoip_cache_ttl_seconds: int = 21600

    shuffle_base_url: str = "http://shuffle-backend:5001"
    shuffle_api_key: str = ""
    shuffle_username: str = ""
    shuffle_password: str = ""

    pagerduty_base_url: str = "http://pagerduty-stub"
    pagerduty_api_key: str = ""

    iris_base_url: str = "https://iriswebapp_nginx:8443"
    iris_api_key: str = ""
    iris_default_customer_id: int = 1
    iris_default_soc_id: str = ""

    virustotal_base_url: str = "https://www.virustotal.com/api/v3"
    virustotal_api_key: str = ""
    abuseipdb_base_url: str = "https://api.abuseipdb.com/api/v2"
    abuseipdb_api_key: str = ""


settings = Settings()