You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+32-4Lines changed: 32 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -108,7 +108,8 @@ fastfinder [OPTIONS]
108
108
109
109
### Scan and export file match according to your needs
110
110
configuration examples are available [there](./examples)
111
-
```
111
+
112
+
```yaml
112
113
input:
113
114
path: [] # match file path AND / OR file name based on simple string
114
115
content:
@@ -128,8 +129,34 @@ output:
128
129
advancedparameters:
129
130
yaraRC4Key: ''# yara rules can be (un)/ciphered using the specified RC4 key
130
131
maxScanFilesize: 2048# ignore files up to maxScanFileSize Mb (default: 2048)
131
-
cleanMemoryIfFileGreaterThanSize: 512 # clean fastfinder internal memory after heavy file scan (default: 512Mb)
132
+
cleanMemoryIfFileGreaterThanSize: 512# clean fastfinder internal memory after heavy file scan (default: 512Mb)
133
+
eventforwarding:
134
+
enabled: true
135
+
buffer_size: 5
136
+
flush_time_seconds: 10
137
+
file:
138
+
enabled: true
139
+
directory_path: "./event_logs"
140
+
rotate_minutes: 1# Rotate every minute for testing
141
+
max_file_size_mb: 1# Rotate at 1MB for testing
142
+
retain_files: 5# Keep 5 old files
143
+
http:
144
+
enabled: false
145
+
url: "https://your-forwarder-url.com/api/events"
146
+
ssl_verify: false
147
+
timeout_seconds: 10
148
+
headers:
149
+
Authorization: "Bearer YOUR_API_KEY"
150
+
MY-CUSTOM-HEADER: "My-Header-Value"
151
+
retry_count: 3
152
+
filters:
153
+
min_severity: "info"
154
+
event_types:
155
+
- "error"
156
+
- "alert"
157
+
- "info"
132
158
```
159
+
133
160
### Search everywhere or in specified paths:
134
161
* use '?' in paths for simple char wildcard (eg. powershe??.exe)
135
162
* use '\\\*' in paths for multiple chars wildcard (eg. \\\*.exe)
@@ -161,15 +188,15 @@ cd fastfinder
161
188
162
189
# Install dependencies (see compilation guides)
163
190
# Build from source
164
-
go build -tags yara_static -a -ldflags '-s -w'.
191
+
go build -tags yara_static,gio -a -ldflags '-s -w' .
165
192
166
193
# Run tests
167
194
go test ./...
168
195
```
169
196
170
197
## 📜 License
171
198
172
-
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
199
+
This project is licensed under the AGPL License - see the [LICENSE](LICENSE) file for details.
173
200
174
201
## 🚀 Support
175
202
@@ -188,6 +215,7 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
188
215
* **Hilko Bengen (@hillu)** for his wonderful [yara implementation in Go](https://github.com/hillu/go-yara) and also for his precious help debugging CGO issues
189
216
* **Marc Ochsenmeier** for his precious help, feedbacks but also for having talking on my project
190
217
* **Vitali Kremez** ✝ for inspiring me on many aspects that made me build fastfinder
218
+
* **m0n4** (https://github.com/m0n4) for regularly challenging me technically and contributing much more to the birth of this project than he could ever imagine.
0 commit comments