[redis]
; Redis server
; used for task scheduling and other non-persistent data
host=localhost
port=6379

[minio]
; MinIO server
; used to store job queue and analysis results
address=localhost:9000
bucket=karton
secure=0

; MinIO access credentials
access_key=
secret_key=

[drakrun]
; if set, drakrun dumps raw VM guest memory after finished analysis with drakvuf
; compressed dumps are stored as "post_sample.raw_memdump.gz" in analysis folder
raw_memory_dump=0

; whether guest VMs should have access to the Internet or no
net_enable=0

; through which host interface the Internet traffic from guest VMs should be routed
out_interface=

; the address of DNS server as reported to the guest VM by DHCP
; if you want to have a DNS on a gateway IP, use this setting:
;   dns_server=use-gateway-address
dns_server=8.8.8.8

; path to syscalls filter file for syscalls plugin
; leave empty to use no filter
syscall_filter=

; default analysis timeout if not specified by the user
;   analysis_timeout=600

; store analysis artifacts under root_uid of the Karton's task
; instead of storing it under the uid of actual task;
; this is more user friendly but your task trees
; won't be able to invoke DRAKVUF Sandbox more than once
;   use_root_uid=1

; (advanced) override Karton instance name for this service:
;   identity=karton.drakrun-prod

; (advanced) override Karton input filters for this service:
;   filters=[{"type": "sample", "stage": "recognized", "platform": "win32"}, {"type": "sample", "stage": "recognized", "platform": "win64"}]

; (advanced) override Karton output headers for this service:
;   headers=[{"type": "analysis", "kind": "drakrun"}]

; (advanced) Enable testing codepaths. Test sample artifacts will not be uploaded
; to persistent storage. Their lifetime will be bound to karton tasks produced by drakrun
; sample_testing=0
;
; (advanced) override Karton test filters for this service:
; test_filters=[ { "type": "sample-test", "platform": "win32", }, { "type": "sample-test", "platform": "win64" }]

; (advanced) override Karton test headers for this service:
; test_headers={ "type": "analysis-test", "kind": "drakrun" }

; (advanced) maximum number of times a trap can be triggered within 10 seconds period
; protects against API hammering techniques, default 0 (means: off)
;   anti_hammering_threshold=0

; (advanced) Attach DLL profiles to analyses
; attach_profiles=0
; (advanced) Attach static ApiScout profile to analyses
; attach_apiscout_profile=0

[drakvuf_plugins]
; Pick DRAKVUF plugins that you want to use by default.
; _all_=apimon,bsodmon,clipboardmon,cpuidmon,crashmon,debugmon,delaymon,exmon,filedelete,librarymon,memdump,procdump,procmon,regmon,rpcmon,ssdtmon,tlsmon,windowmon,wmimon

; uncomment this to override plugins used for tasks with quality=low
; (you can override plugins for other priorities too)
; low=apimon,memdump

[capa]
; configure whether to analyze the dynamic output of DRAKVUF (apimon.log all syscall.log)
analyze_drakmon_log=true

; configure whether to analyze the memory dumps extracted by DRAKVUF
analyze_memdumps=false

; choose whether to analyze the malware process and its children only
analyze_only_malware_pids=false

; how many processes should be used for processing parallelization
worker_pool_processes=4

[draktestd]
; path to the extraction modules for
; https://github.com/CERT-Polska/malduck
modules=/opt/extractor-modules/

