There are two core components of the OneFirewall platform, each offering extensive configuration capabilities. These components are designed to be highly adaptable, ensuring they align with the specific needs and use cases of every alliance member based on how they interact with the platform. To support a developer-friendly approach without compromising the user experience, we’ve adopted a JSON-based configuration model for managing changes. This page serves to provide clear guidance and a comprehensive understanding of how to work with these configurations. The two configurable components are:

Organization Level

If you are an Admin on the platform, you can navigate to the Organizations section, where all registered organizations are listed. By clicking Edit on any organization, you’ll open a configuration panel that displays key settings such as allowed token usage, trust level, and more. One of the core elements in this panel is the Configuration Settings section, presented as an editable JSON block.

Example

{
  "live": {
    "index_name": "poc_traffic",
    "score_name": "score",
    "elastic_url": "default",
    "action_name": "action",
    "date_time_name": "@timestamp",
    "allow_value": [
      "Allow",
      "pass"
    ],
    "deny_value": [
      "Deny",
      "decline"
    ],
    "low_score": [
      1,
      60
    ],
    "medium_score": [
      60,
      120
    ],
    "high_score": [
      120,
      150
    ],
    "critical_score": [
      150,
      1000
    ],
    "device_name": [
      "firewall"
    ],
    "direction_name": [
      "direction"
    ],
    "service_name": [
      "service"
    ]
  },
  "reserved_ips": [
    "1.1.1.1",
    "62.49.0.0/16",
    "125.209.84.250",
    "1.4.6.7",
    "6.7.8.9"
  ],
  "blocking_roule": {
    "score": 20,
    "tags": [
      "tor_exit_nodeXXX"
    ]
  }
}

Explanation of the keys

Key	Description
live	A JSON object including all configurable settings on how `LIVE` page should parase the data for the final report
live.index_name	The ELK Index where the data are saved. Default `poc_traffic`
live.score_name	The OFA Crime Score name, on how is saved during the parsing. Default `score`
live.elastic_url	The ElasticSearch URL used, in case in not saved on the default. Default `default`
live.action_name	The name of the how the data should be read for Allow or Deny the traffic. Default `action`
live.date_time_name	The name of the TimeStamp used to save the data. Default `@timestamp`
live.allow_value	An Array of Strings with the values that used to define the traffic is accepted/allowed from the customers firewalls. Default `["Allow"]`
live.deny_value	An Array of Strings with the values that used to define the traffic is not-accepted/blocked from the customers firewalls. Default `["Deny"]`
live.low_score	An Array of 2 elements, representing the minimum and maximum value for `LOW` score. Default `[1, 60]`
live.medium_score	An Array of 2 elements, representing the minimum and maximum value for `MEDIUM` score. Default `[60, 120]`
live.high_score	An Array of 2 elements, representing the minimum and maximum value for `HIGH` score. Default `[120, 150]`
live.critical_score	An Array of 2 elements, representing the minimum and maximum value for `CRITICAL` score. Default `[150, 1000]`
live.device_name	An array with all possible strings used to representing the Device in the parsed data. Default `["firewall"]`
live.direction_name	An array with all possible strings used to representing the Direction in the parsed data. Default `["direction"]`
live.service_name	An array with all possible strings used to representing the Service in the parsed data. Default `["service"]`
reserved_ips	An array with all possible IPs (in CIDR format) used by the organization, these IPs will not be allowed to be reported as malicious or involved in cyber attacks, these list can be also viewed as an Whitelisted list affecting only the given organization. Read more Release notes
blocking_roule	An Object of and if additional rules are needed to block based on specific tags and score. Read more Release notes
blocking_roule.score	Minimum Score for blocking. Is working in `AND` with the tags
blocking_roule.tags	An array of tags (in `OR`) that the IP should have assocated, before is blocked (this works in `AND` with blocking_roule.score)

WCF Agent Level

Each installed WCF Agent comes with a set of configurable settings that can be centrally managed by the server. To view or modify these settings, navigate to the Agent Status section. For any listed agent, click the Edit button to access a JSON configuration panel that defines the rules and behaviors the WCF Agent should follow.

Example

{
  "gaid": "OFA-AGENT-ID-D6NmSW62hUZW",
  "score_threshold": 150,
  "version": "v4.60.4",
  "proxy": "CLOUD",
  "sync_time": 1,
  "maximum_rules": 99999998,
  "ids": {
    "iptables": {
      "active": false
    },
    "ebtables": {
      "active": false
    },
    "pflist": {
      "active": false
    },
    "modsec": {
      "active": false,
      "modsec_logs": "/var/log/apache2/modsec_audit.log"
    },
    "cloudflare": {
      "active": false,
      "cloudflare_x_auth_email": "",
      "cloudflare_x_auth_key": ""
    },
    "luna": {
      "active": false,
      "json": []
    },
    "sshlog": {
      "active": false,
      "ssh_log_location": "/var/log/auth.log"
    }
  },
  "ips": {
    "httpd": {
      "active": true,
      "command": "cp blacklist_onefirewall.txt httpd/blacklist.txt"
    },
    "iptables": {
      "active": true,
      "acl": "/opt/onefirewall/acl/ipset.txt",
      "reload_command": "sudo ipset flush blacklist && sudo ipset restore < /opt/onefirewall/acl/ipset.txt "
    },
    "checkpoint": {
      "active": false,
      "username": "admin",
      "password": "",
      "address": "https://10.47.2.48",
      "group": "OneFirewall_IPS",
      "policy": "standard",
      "domain": "Test_domain_Server",
      "gateways": "Test_gw"
    },
    "checkpoint_securexl": {
      "active": false,
      "connections": "[email protected]",
      "password": "************",
      "command": "bash artifacts/checkpoint/install-securexl.sh",
      "vsids": "1,2"
    },
    "fortigate": {
      "active": false,
      "connections": "[email protected]",
      "password": "************",
      "command": "bash artifacts/fortigate/install-fortigate-url-feed.sh",
      "feeds": "/api/v1/feeds",
      "updates": "5"
    },
    "csp": {
      "active": false,
      "connections": "[email protected]",
      "password": "************",
      "command": "bash artifacts/csp.sh",
      "feeds": "onefirewall.txt",
      "updates": "5"
    },
    "ebtables": {
      "active": false
    },
    "pflist": {
      "active": false,
      "ofa_ips_txt": "/opt/apps/onefirewall-cloud-client/ofa-ips.txt",
      "pflist_reload_command": "sudo pfctl -f /etc/pf.conf;"
    },
    "modsec": {
      "active": false,
      "ruleset": "/usr/share/modsecurity-crs/rules/onefirewall_rules.conf",
      "modsec_reload_command": "sudo apachectl -k graceful;"
    },
    "cloudflare": {
      "active": false,
      "cloudflare_x_auth_email": "",
      "cloudflare_x_auth_key": ""
    },
    "cisco": {
      "active": false,
      "cisco_host": "",
      "cisco_user": "",
      "cisco_password": ""
    },
    "haproxy": {
      "active": false,
      "haproxy_logs": "/opt/onefirewall/acl/haproxy.txt",
      "haproxy_reload_command": "sudo service haproxy reload"
    },
    "csv": {
      "active": false,
      "csv_logs": "/opt/onefirewall/feeds.csv",
      "csv_reload_command": "wc /opt/onefirewall/feeds.csv"
    },
    "aws": {
      "active": false,
      "accessKeyId": "",
      "secretAccessKey": "",
      "region": ""
    },
    "sophos": {
      "active": false,
      "user": "",
      "password": "",
      "address": "",
      "command": "bash artifacts/sophos/update_blacklist_sophos.sh"
    },
    "trellix": {
      "active": false,
      "username": "",
      "password": "",
      "api": "",
      "fileslist_file": "",
      "broker_ca_bundle": "",
      "cert_file": "",
      "private_key": ""
    },
    "infoblox": {
      "active": false,
      "username": "",
      "password": "",
      "api": "",
      "group": "",
      "policy": "",
      "action": "",
      "view": "",
      "domains_file": "",
      "domains_file_whitelist": "",
      "api_whitelist_url": ""
    },
    "forcepoint": {
      "active": false,
      "username": "",
      "password": "",
      "api": "",
      "group": "",
      "policy": "",
      "action": "",
      "parent": null,
      "urls_file": ""
    }
  },
  "running": "yes"
}

Explanation of the keys

Key	Description
gaid	Unique ID for the agent. Generated during the Agent Install procedure
score_threshold	Minimum value of Score for the Agent to instruct the IPs (Firewall) to block the traffic
version	For troubleshooting reason, a version of Agent installed
sync_time	How often the Agent should communicated with the server to be considered alive (numeric value of minutes)
maximum_rules	The maximum rules to block, this is used in case the firewall in question is not capable to handle more the X amount of rules
running	If the Agent is considered active or not active (possible values are `yes` or `no`). Default behavior is `yes`
ids	List of Intrusion Detection systems in place. From where to read the data
ids.active	True or False, if the specific Agent is in use
ids.[*]	Dynamic configurations used in any specific Agent. Consult the Install Agent page for the details
ips	List of Intrusion Prevention systems in place (firewall). Where the Agent shoudl inject/prevent traffic
ips.active	True or False, if the specific Agent is in use
ips.[*]	Dynamic configurations used in any specific Agent. Consult the Install Agent page for the details

Get Started

Essentials

Releases

Case Studies

WCF Agent

Products

Updates

Configurations

Organization Level

Example

Explanation of the keys

WCF Agent Level

Example

Explanation of the keys

​Organization Level

​Example

​Explanation of the keys

​WCF Agent Level

​Example

​Explanation of the keys

Organization Level

Example

Explanation of the keys

WCF Agent Level

Example

Explanation of the keys