lookyloo/config/generic.json.sample

{
  "loglevel": "INFO",
  "splash_loglevel": "WARNING",
  "only_global_lookups": true,
  "public_instance": false,
  "public_domain": "lookyloo.myorg.local",
  "website_listen_ip": "0.0.0.0",
  "website_listen_port": 5100,
  "splash_url": "http://127.0.0.1:8050",
  "default_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36",
  "cache_clean_user": {},
  "time_delta_on_index": {
    "weeks": 1,
    "days": 0,
    "hours": 0
  },
  "max_depth": 1,
  "use_user_agents_users": false,
  "enable_default_blur_screenshot": false,
  "enable_context_by_users": false,
  "enable_categorization": false,
  "enable_bookmark": false,
  "auto_trigger_modules": false,
  "enable_mail_notification": false,
  "email": {
      "from": "Lookyloo <lookyloo@myorg.local>",
      "to": "Investigation Team <investigation_unit@myorg.local>",
      "subject": "Capture from Lookyloo to review",
      "smtp_host": "localhost",
      "smtp_port": "25"
  },
  "_notes": {
    "loglevel": "(lookyloo) Can be one of the value listed here: https://docs.python.org/3/library/logging.html#levels",
    "splash_loglevel": "(Splash) INFO is *very* verbose.",
    "only_global_lookups": "Set it to True if your instance is publicly available so users aren't able to scan your internal network",
    "public_instance": "true means disabling features deemed unsafe on a public instance (such as indexing private captures)",
    "public_domain": "Domain where the instance can be reached. Used for permalinks (e-mail, MISP export).",
    "website_listen_ip": "IP Flask will listen on. Defaults to 0.0.0.0, meaning all interfaces.",
    "website_listen_port": "Port Flask will listen on.",
    "splash_url": "URL to connect to splash",
    "default_user_agent": "Ultimate fallback if the capture form, or the asynchronous submission, doesn't provide a user agent.",
    "cache_clean_user": "Intially: allow a user to clear the cache for a capture. Now: that, and accessing the hidden captures. It is some kind of an admin account. Format: {username: password}",
    "time_delta_on_index": "Time interval of the capture displayed on the index",
    "max_depth": "Maximum depth for scraping. Anything > 1 will be exponentially bigger.",
    "use_user_agents_users": "Only usable for medium/high use instances: use the user agents of the users of the platform",
    "enable_default_blur_screenshot": "If true, blur the screenshot by default (useful on public instances)",
    "enable_context_by_users": "Allow the users to add context to a response body",
    "enable_categorization": "Allow the users to add contextualization to a capture",
    "enable_bookmark": "Allow to bookmark nodes on tree",
    "auto_trigger_modules": "Automatically trigger the modules when the tree is loaded",
    "enable_mail_notification": "Enable email notification or not",
    "email": "Configuration for sending email notifications."
  }
}