> ## Documentation Index > Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt > Use this file to discover all available pages before exploring further. # Configurations The OneFirewall platform has two configurable components. Both are configured through an editable JSON block in the web console. # Organization Level Admins can go to the Organizations section, where all registered organizations are listed. Clicking Edit on an organization opens a configuration panel with settings such as allowed token usage and trust level. The Configuration Settings section within this panel is an editable JSON block. #### Example ```JSON theme={null} { "live": { "index_name": "poc_traffic", "score_name": "score", "elastic_url": "default", "action_name": "action", "date_time_name": "@timestamp", "allow_value": [ "Allow", "pass" ], "deny_value": [ "Deny", "decline" ], "low_score": [ 1, 60 ], "medium_score": [ 60, 120 ], "high_score": [ 120, 150 ], "critical_score": [ 150, 1000 ], "device_name": [ "firewall" ], "direction_name": [ "direction" ], "service_name": [ "service" ] }, "reserved_ips": [ "1.1.1.1", "62.49.0.0/16", "125.209.84.250", "1.4.6.7", "6.7.8.9" ], "blocking_roule": { "score": 20, "tags": [ "tor_exit_nodeXXX" ] } } ``` ### Explanation of the keys | Key | Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | live | Settings for how the `LIVE` page parses data for the final report | | live.index\_name | The ELK index where the data is saved. Default `poc_traffic` | | live.score\_name | The field name for the OFA Crime Score. Default `score` | | live.elastic\_url | The ElasticSearch URL, if not the default. Default `default` | | live.action\_name | The field name for Allow/Deny traffic status. Default `action` | | live.date\_time\_name | The field name for the timestamp. Default `@timestamp` | | live.allow\_value | Array of strings marking traffic as accepted/allowed by the customer's firewall. Default `["Allow"]` | | live.deny\_value | Array of strings marking traffic as blocked by the customer's firewall. Default `["Deny"]` | | live.low\_score | Two-element array with the min/max value for `LOW` score. Default `[1, 60]` | | live.medium\_score | Two-element array with the min/max value for `MEDIUM` score. Default `[60, 120]` | | live.high\_score | Two-element array with the min/max value for `HIGH` score. Default `[120, 150]` | | live.critical\_score | Two-element array with the min/max value for `CRITICAL` score. Default `[150, 1000]` | | live.device\_name | Array of strings representing the Device field in the parsed data. Default `["firewall"]` | | live.direction\_name | Array of strings representing the Direction field in the parsed data. Default `["direction"]` | | live.service\_name | Array of strings representing the Service field in the parsed data. Default `["service"]` | | reserved\_ips | IPs (CIDR format) used by the organization that are excluded from being reported as malicious. Functions as a whitelist scoped to the organization. See [Release notes](/releases/2025-05-22#2-custom-reserved-ips) | | blocking\_roule | Additional blocking rules based on tags and score. See [Release notes](/releases/2025-05-22#4-tag-based-prevention-rules) | | blocking\_roule.score | Minimum score for blocking. Combined with tags using `AND` | | blocking\_roule.tags | Tags (matched with `OR`) the IP must have before blocking; combined with `blocking_roule.score` using `AND` | # WCF Agent Level Each installed WCF Agent has configurable settings that are centrally managed by the server. To view or modify them, go to the Agent Status section and click Edit on the listed agent to open its JSON configuration panel. #### Example ```JSON theme={null} { "gaid": "OFA-AGENT-ID-D6NmSW62hUZW", "score_threshold": 150, "version": "v4.60.4", "proxy": "CLOUD", "sync_time": 1, "maximum_rules": 99999998, "ids": { "iptables": { "active": false }, "ebtables": { "active": false }, "pflist": { "active": false }, "modsec": { "active": false, "modsec_logs": "/var/log/apache2/modsec_audit.log" }, "cloudflare": { "active": false, "cloudflare_x_auth_email": "", "cloudflare_x_auth_key": "" }, "luna": { "active": false, "json": [] }, "sshlog": { "active": false, "ssh_log_location": "/var/log/auth.log" } }, "ips": { "httpd": { "active": true, "command": "cp blacklist_onefirewall.txt httpd/blacklist.txt" }, "iptables": { "active": true, "acl": "/opt/onefirewall/acl/ipset.txt", "reload_command": "sudo ipset flush blacklist && sudo ipset restore < /opt/onefirewall/acl/ipset.txt " }, "checkpoint": { "active": false, "username": "admin", "password": "", "address": "https://10.47.2.48", "group": "OneFirewall_IPS", "policy": "standard", "domain": "Test_domain_Server", "gateways": "Test_gw" }, "checkpoint_securexl": { "active": false, "connections": "ofa@192.168.1.40", "password": "************", "command": "bash artifacts/checkpoint/install-securexl.sh", "vsids": "1,2" }, "fortigate": { "active": false, "connections": "ofa@192.168.1.40", "password": "************", "command": "bash artifacts/fortigate/install-fortigate-url-feed.sh", "feeds": "/api/v1/feeds", "updates": "5" }, "csp": { "active": false, "connections": "ofa@192.168.1.40", "password": "************", "command": "bash artifacts/csp.sh", "feeds": "onefirewall.txt", "updates": "5" }, "ebtables": { "active": false }, "pflist": { "active": false, "ofa_ips_txt": "/opt/apps/onefirewall-cloud-client/ofa-ips.txt", "pflist_reload_command": "sudo pfctl -f /etc/pf.conf;" }, "modsec": { "active": false, "ruleset": "/usr/share/modsecurity-crs/rules/onefirewall_rules.conf", "modsec_reload_command": "sudo apachectl -k graceful;" }, "cloudflare": { "active": false, "cloudflare_x_auth_email": "", "cloudflare_x_auth_key": "" }, "cisco": { "active": false, "cisco_host": "", "cisco_user": "", "cisco_password": "" }, "haproxy": { "active": false, "haproxy_logs": "/opt/onefirewall/acl/haproxy.txt", "haproxy_reload_command": "sudo service haproxy reload" }, "csv": { "active": false, "csv_logs": "/opt/onefirewall/feeds.csv", "csv_reload_command": "wc /opt/onefirewall/feeds.csv" }, "aws": { "active": false, "accessKeyId": "", "secretAccessKey": "", "region": "" }, "sophos": { "active": false, "user": "", "password": "", "address": "", "command": "bash artifacts/sophos/update_blacklist_sophos.sh" }, "trellix": { "active": false, "username": "", "password": "", "api": "", "fileslist_file": "", "broker_ca_bundle": "", "cert_file": "", "private_key": "" }, "infoblox": { "active": false, "username": "", "password": "", "api": "", "group": "", "policy": "", "action": "", "view": "", "domains_file": "", "domains_file_whitelist": "", "api_whitelist_url": "" }, "forcepoint": { "active": false, "username": "", "password": "", "api": "", "group": "", "policy": "", "action": "", "parent": null, "urls_file": "" } }, "running": "yes" } ``` ### Explanation of the keys | Key | Description | | ---------------- | --------------------------------------------------------------------------------------- | | gaid | Unique agent ID, generated during Agent install | | score\_threshold | Minimum score for the Agent to instruct the IPS/firewall to block traffic | | version | Installed Agent version, used for troubleshooting | | sync\_time | How often the Agent must communicate with the server to be considered alive, in minutes | | maximum\_rules | Maximum rules to block, for firewalls that can't handle more than X rules | | running | Whether the Agent is active. Values `yes` or `no`. Default `yes` | | ids | Intrusion Detection systems the Agent reads data from | | ids.active | Whether the specific IDS integration is in use | | ids.\[\*] | Integration-specific settings; see the Install Agent page for details | | ips | Intrusion Prevention systems (firewalls) the Agent injects/blocks traffic on | | ips.active | Whether the specific IPS integration is in use | | ips.\[\*] | Integration-specific settings; see the Install Agent page for details |