{ "loglevel": "INFO", "splash_loglevel": "WARNING", "only_global_lookups": true, "public_instance": false, "public_domain": "lookyloo.myorg.local", "website_listen_ip": "0.0.0.0", "website_listen_port": 5100, "systemd_service_name": "lookyloo", "default_public": true, "splash_url": "http://127.0.0.1:8050", "default_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36", "users": {}, "time_delta_on_index": { "weeks": 1, "days": 0, "hours": 0 }, "max_depth": 1, "async_capture_processes": 1, "use_user_agents_users": false, "enable_default_blur_screenshot": false, "enable_context_by_users": false, "enable_categorization": false, "enable_bookmark": false, "auto_trigger_modules": false, "enable_mail_notification": false, "email": { "from": "Lookyloo ", "to": "Investigation Team ", "subject": "Capture from Lookyloo to review", "smtp_host": "localhost", "smtp_port": "25", "confirm_message": "Message the users need to confirm before they submit a notification." }, "priority": { "sources": { "web": 10, "api": 0 }, "users": { "_default_auth": 5, "_default_anon": 0, "admin": 10 } }, "hide_captures_with_error": false, "archive": 180, "_notes": { "loglevel": "(lookyloo) Can be one of the value listed here: https://docs.python.org/3/library/logging.html#levels", "splash_loglevel": "(Splash) INFO is *very* verbose.", "only_global_lookups": "Set it to True if your instance is publicly available so users aren't able to scan your internal network", "public_instance": "true means disabling features deemed unsafe on a public instance (such as indexing private captures)", "public_domain": "Domain where the instance can be reached. Used for permalinks (e-mail, MISP export).", "website_listen_ip": "IP Flask will listen on. Defaults to 0.0.0.0, meaning all interfaces.", "website_listen_port": "Port Flask will listen on.", "systemd_service_name": "(Optional) Name of the systemd service if your project has one.", "default_public": "If true, the capture is public and will be visible on the index page by default (can be unticked on the capture page).", "splash_url": "URL to connect to splash", "default_user_agent": "Ultimate fallback if the capture form, or the asynchronous submission, doesn't provide a user agent.", "users": "It is some kind of an admin accounts. Format: {username: password}", "time_delta_on_index": "Time interval of the capture displayed on the index", "max_depth": "Maximum depth for scraping. Anything > 1 will be exponentially bigger.", "async_capture_processes": "Number of async_capture processes to start. This should not be higher than the number of splash instances you have running. A very high number will use *a lot* of ram.", "use_user_agents_users": "Only usable for medium/high use instances: use the user agents of the users of the platform", "enable_default_blur_screenshot": "If true, blur the screenshot by default (useful on public instances)", "enable_context_by_users": "Allow the users to add context to a response body", "enable_categorization": "Allow the users to add contextualization to a capture", "enable_bookmark": "Allow to bookmark nodes on tree", "auto_trigger_modules": "Automatically trigger the modules when the tree is loaded and when the capture is cached", "enable_mail_notification": "Allow users to notify a pre-configured email address about a specific capture", "email": "Configuration for sending email notifications.", "priority": "Define the priority of a new capture. A capture from the web interface has priority over a capture from the API, same for authenticated user vs. anonymous.", "hide_captures_with_error": "Capturing an URL may result in an error (domain non-existent, HTTP error, ...). They may be useful to see, but if you have a public instance, they will clutter the index.", "archive": "The captures older than this value (in days) will be archived. They're not cached by default in the Lookyloo class." } }