config.example.yaml

redis:
  host: 127.0.0.1
  port: 6379
  channel: turkeybite
  password: "YourRedisPassword" # Use a long one: https://stackoverflow.com/questions/7537905/redis-set-a-password-for-redis#:~:text=Make%20sure%20you%20choose%20something,in%20the%20config%20file%20mention.
  db: 0
  host_list_db: 1

sieve:
# browserbeat rules
  browserbeat:
    ignore:
      clients:
        # - 192.168.1.1
        # - somehost-to-ignore
      users:
        # - root
      domains:
        # - whitelisted-domain.com
      hosts:
        # - www.whitelisted-domain.com

# DNS packagebeat rules
  drop_replies: true
  drop_error_packets: true
  ignore:
    domains:
      # - whitelisted-domain.com
      - 10.in-addr.arpa
      - 192.168.in-addr.arpa
      - default.svc
      - kubernetes.default
    clients:
      - 127.0.0.1
    hosts:
      - kubernetes.default.svc

processor:
  dns:
    lookup_ips: true
    resolvers:
      - 127.0.0.1
  elastic:
    enable: true
    index_prefix: tb-index
    hosts:
      - uri: http://127.0.0.1:9200
        username: false
        password: false
      - uri: https://127.0.0.1:9201
        username: user
        password: password

  syslog:
    # Syslog UDP
    enable: false
    port: 514
    host: 127.0.0.1