Organization Level
Admins can go to the Organizations section, where all registered organizations are listed. Clicking Edit on an organization opens a configuration panel with settings such as allowed token usage and trust level. The Configuration Settings section within this panel is an editable JSON block.Example
{
"live": {
"index_name": "poc_traffic",
"score_name": "score",
"elastic_url": "default",
"action_name": "action",
"date_time_name": "@timestamp",
"allow_value": [
"Allow",
"pass"
],
"deny_value": [
"Deny",
"decline"
],
"low_score": [
1,
60
],
"medium_score": [
60,
120
],
"high_score": [
120,
150
],
"critical_score": [
150,
1000
],
"device_name": [
"firewall"
],
"direction_name": [
"direction"
],
"service_name": [
"service"
]
},
"reserved_ips": [
"1.1.1.1",
"62.49.0.0/16",
"125.209.84.250",
"1.4.6.7",
"6.7.8.9"
],
"blocking_roule": {
"score": 20,
"tags": [
"tor_exit_nodeXXX"
]
}
}
Explanation of the keys
| Key | Description |
|---|---|
| live | Settings for how the LIVE page parses data for the final report |
| live.index_name | The ELK index where the data is saved. Default poc_traffic |
| live.score_name | The field name for the OFA Crime Score. Default score |
| live.elastic_url | The ElasticSearch URL, if not the default. Default default |
| live.action_name | The field name for Allow/Deny traffic status. Default action |
| live.date_time_name | The field name for the timestamp. Default @timestamp |
| live.allow_value | Array of strings marking traffic as accepted/allowed by the customer’s firewall. Default ["Allow"] |
| live.deny_value | Array of strings marking traffic as blocked by the customer’s firewall. Default ["Deny"] |
| live.low_score | Two-element array with the min/max value for LOW score. Default [1, 60] |
| live.medium_score | Two-element array with the min/max value for MEDIUM score. Default [60, 120] |
| live.high_score | Two-element array with the min/max value for HIGH score. Default [120, 150] |
| live.critical_score | Two-element array with the min/max value for CRITICAL score. Default [150, 1000] |
| live.device_name | Array of strings representing the Device field in the parsed data. Default ["firewall"] |
| live.direction_name | Array of strings representing the Direction field in the parsed data. Default ["direction"] |
| live.service_name | Array of strings representing the Service field in the parsed data. Default ["service"] |
| reserved_ips | IPs (CIDR format) used by the organization that are excluded from being reported as malicious. Functions as a whitelist scoped to the organization. See Release notes |
| blocking_roule | Additional blocking rules based on tags and score. See Release notes |
| blocking_roule.score | Minimum score for blocking. Combined with tags using AND |
| blocking_roule.tags | Tags (matched with OR) the IP must have before blocking; combined with blocking_roule.score using AND |
WCF Agent Level
Each installed WCF Agent has configurable settings that are centrally managed by the server. To view or modify them, go to the Agent Status section and click Edit on the listed agent to open its JSON configuration panel.Example
{
"gaid": "OFA-AGENT-ID-D6NmSW62hUZW",
"score_threshold": 150,
"version": "v4.60.4",
"proxy": "CLOUD",
"sync_time": 1,
"maximum_rules": 99999998,
"ids": {
"iptables": {
"active": false
},
"ebtables": {
"active": false
},
"pflist": {
"active": false
},
"modsec": {
"active": false,
"modsec_logs": "/var/log/apache2/modsec_audit.log"
},
"cloudflare": {
"active": false,
"cloudflare_x_auth_email": "",
"cloudflare_x_auth_key": ""
},
"luna": {
"active": false,
"json": []
},
"sshlog": {
"active": false,
"ssh_log_location": "/var/log/auth.log"
}
},
"ips": {
"httpd": {
"active": true,
"command": "cp blacklist_onefirewall.txt httpd/blacklist.txt"
},
"iptables": {
"active": true,
"acl": "/opt/onefirewall/acl/ipset.txt",
"reload_command": "sudo ipset flush blacklist && sudo ipset restore < /opt/onefirewall/acl/ipset.txt "
},
"checkpoint": {
"active": false,
"username": "admin",
"password": "",
"address": "https://10.47.2.48",
"group": "OneFirewall_IPS",
"policy": "standard",
"domain": "Test_domain_Server",
"gateways": "Test_gw"
},
"checkpoint_securexl": {
"active": false,
"connections": "[email protected]",
"password": "************",
"command": "bash artifacts/checkpoint/install-securexl.sh",
"vsids": "1,2"
},
"fortigate": {
"active": false,
"connections": "[email protected]",
"password": "************",
"command": "bash artifacts/fortigate/install-fortigate-url-feed.sh",
"feeds": "/api/v1/feeds",
"updates": "5"
},
"csp": {
"active": false,
"connections": "[email protected]",
"password": "************",
"command": "bash artifacts/csp.sh",
"feeds": "onefirewall.txt",
"updates": "5"
},
"ebtables": {
"active": false
},
"pflist": {
"active": false,
"ofa_ips_txt": "/opt/apps/onefirewall-cloud-client/ofa-ips.txt",
"pflist_reload_command": "sudo pfctl -f /etc/pf.conf;"
},
"modsec": {
"active": false,
"ruleset": "/usr/share/modsecurity-crs/rules/onefirewall_rules.conf",
"modsec_reload_command": "sudo apachectl -k graceful;"
},
"cloudflare": {
"active": false,
"cloudflare_x_auth_email": "",
"cloudflare_x_auth_key": ""
},
"cisco": {
"active": false,
"cisco_host": "",
"cisco_user": "",
"cisco_password": ""
},
"haproxy": {
"active": false,
"haproxy_logs": "/opt/onefirewall/acl/haproxy.txt",
"haproxy_reload_command": "sudo service haproxy reload"
},
"csv": {
"active": false,
"csv_logs": "/opt/onefirewall/feeds.csv",
"csv_reload_command": "wc /opt/onefirewall/feeds.csv"
},
"aws": {
"active": false,
"accessKeyId": "",
"secretAccessKey": "",
"region": ""
},
"sophos": {
"active": false,
"user": "",
"password": "",
"address": "",
"command": "bash artifacts/sophos/update_blacklist_sophos.sh"
},
"trellix": {
"active": false,
"username": "",
"password": "",
"api": "",
"fileslist_file": "",
"broker_ca_bundle": "",
"cert_file": "",
"private_key": ""
},
"infoblox": {
"active": false,
"username": "",
"password": "",
"api": "",
"group": "",
"policy": "",
"action": "",
"view": "",
"domains_file": "",
"domains_file_whitelist": "",
"api_whitelist_url": ""
},
"forcepoint": {
"active": false,
"username": "",
"password": "",
"api": "",
"group": "",
"policy": "",
"action": "",
"parent": null,
"urls_file": ""
}
},
"running": "yes"
}
Explanation of the keys
| Key | Description |
|---|---|
| gaid | Unique agent ID, generated during Agent install |
| score_threshold | Minimum score for the Agent to instruct the IPS/firewall to block traffic |
| version | Installed Agent version, used for troubleshooting |
| sync_time | How often the Agent must communicate with the server to be considered alive, in minutes |
| maximum_rules | Maximum rules to block, for firewalls that can’t handle more than X rules |
| running | Whether the Agent is active. Values yes or no. Default yes |
| ids | Intrusion Detection systems the Agent reads data from |
| ids.active | Whether the specific IDS integration is in use |
| ids.[*] | Integration-specific settings; see the Install Agent page for details |
| ips | Intrusion Prevention systems (firewalls) the Agent injects/blocks traffic on |
| ips.active | Whether the specific IPS integration is in use |
| ips.[*] | Integration-specific settings; see the Install Agent page for details |