GhostWire_CTI/env.example at master · cyberprogramming1/GhostWire_CTI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# ============================================================
#  GhostWire CTI v6.1 — Environment Configuration
#
#  INSTRUCTIONS:
#  1. cp .env.example .env
#  2. Fill in your actual API keys
#  3. NEVER commit .env to Git (already in .gitignore)
#
#  Free API keys:
#    VirusTotal  → https://www.virustotal.com/gui/join-us
#    AbuseIPDB   → https://www.abuseipdb.com/register
#    Shodan      → https://account.shodan.io
# ============================================================
# ── VirusTotal ───────────────────────────────────────────────
# Free tier: 500 lookups/day, 4 requests/minute
VIRUSTOTAL_API_KEY=your_virustotal_api_key_here
# ── AbuseIPDB ────────────────────────────────────────────────
# Free tier: 1,000 checks/day
ABUSEIPDB_API_KEY=your_abuseipdb_api_key_here
# Free tier: 100 submissions/month (public only — samples visible to everyone)
# Hunter plan ($99/mo): private submissions, PCAP, 180s analysis
# ── Shodan ───────────────────────────────────────────────────
# Free tier: InternetDB (no key needed, auto-used)
# Paid: full banner grab, CVE list
SHODAN_API_KEY=your_shodan_api_key_here
# ── GreyNoise ────────────────────────────────────────────────
# Community API: free, no key required
# Paid: intent, actor, CVE exploitation tracking
GREYNOISE_API_KEY=your_greynoise_api_key_here
# ── URLhaus (abuse.ch) ───────────────────────────────────────
# Free — key is OPTIONAL but recommended for higher rate limits
# Without key: ~10 req/min (public tier)
# With key   : higher rate limits + submission capabilities
# Get key    : https://auth.abuse.ch/user/me → copy "API Auth Key"
URLHAUS_API_KEY=your_urlhaus_api_key_here
# ── Hybrid Analysis ──────────────────────────────────────────────
# Free account: https://www.hybrid-analysis.com/signup
# 200 req/min, 5 submissions/hour on free tier
# Supports: URL / File / Hash / Domain / IP sandbox analysis
HYBRID_ANALYSIS_API_KEY=your_hybrid_analysis_api_key_here

# ── HA Key Rotation (optional) ───────────────────────────────────
# Add extra keys for automatic round-robin rotation.
# On 429 the pool cools that key for 65s and switches to the next.
# HYBRID_ANALYSIS_API_KEY_2=your_second_ha_key_here
# HYBRID_ANALYSIS_API_KEY_3=your_third_ha_key_here

# ── Ollama (Local AI — no data leaves machine) ───────────────
OLLAMA_BASE_URL=http://localhost:11434
# Options: phi3:mini (fast, 2.3GB) | llama3 (accurate, 4.7GB) | mistral
OLLAMA_MODEL=phi3:mini
# ── App Behaviour ─────────────────────────────────────────────
# Max page content fetched by sandbox engine (bytes)
SANDBOX_MAX_BYTES=524288

# HTTP request timeout (seconds)
REQUEST_TIMEOUT=8

# Debug logging (true/false)
DEBUG=false
# ── Audit Log ────────────────────────────────────────────────
# Default: ~/.ghostwire/audit.jsonl
# Override path:
# GHOSTWIRE_LOG_PATH=/var/log/ghostwire/audit.jsonl

# Mapbox token
MAPBOX_TOKEN=   # boş qoya bilərsin — st.map tokensiz işləyir
# AlienVault OTX (Open Threat Exchange) — v7 addition
# Free API key: https://otx.alienvault.com/settings
# Provides: pulse count, MITRE ATT&CK IDs, threat actor attribution
OTX_API_KEY=your_otx_key_here