poc2_worked

deploy-routeros.env.example

@@ -25,20 +25,52 @@ START_SNIFFER=true
 
 # Suricata/app
 SURICATA_HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]
-MONITORED_NETWORKS=192.168.100.0/24
+SURICATA_LOG_MAX_MB=512
+MONITORED_NETWORKS=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
 AUTO_BLOCK=false
 AUTO_BLOCK_MAX_SEVERITY=1
 BLOCK_TIMEOUT=1h
 UPDATE_RULES_ON_START=false
+SURICATA_PERSIST_LIB_DIR=/data/lib/suricata
 RULE_UPDATE_INTERVAL_HOURS=24
 ALERT_RETENTION_DAYS=14
+
+# Bounded live-traffic history. Managed Redis runs inside the same RouterOS container.
+REDIS_MANAGED=true
+REDIS_DATA_DIR=/data/redis
+REDIS_PORT=6379
+REDIS_MAXMEMORY_MB=0
+REDIS_SNAPSHOT_SECONDS=1800
+REDIS_AOF=true
+TRAFFIC_RETENTION_HOURS=24
+TRAFFIC_MAX_EVENTS=0
+TRAFFIC_MEMORY_EVENTS=0
+WEBSOCKET_QUEUE_SIZE=512
+LIVE_FLOW_UPDATE_SECONDS=2.0
 ALERT_MAX_SEVERITY=2
 ALERT_DEDUP_WINDOW_SECONDS=300
 # SID 1000001 is the payload-marked pipeline self-test; keep it out of production incidents.
 ALERT_IGNORE_SIDS=1000001
 ALERT_IGNORE_CATEGORIES=
-# Long random alphanumeric value. Empty disables admin maintenance/rule editing.
-ADMIN_TOKEN=
+# Dashboard login. Use a long random password. Empty ADMIN_PASSWORD keeps the UI read-only.
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=
+SESSION_HOURS=168
+SESSION_COOKIE_SECURE=false
+ANALYTICS_SNAPSHOT_INTERVAL_SECONDS=60
+
+# MikroSuricata NDR / correlation. Keep NDR_AUTO_BLOCK=false while baselining.
+NDR_ENABLED=true
+NDR_CORRELATION_WINDOW_SECONDS=1800
+BEHAVIOR_MIN_OBSERVATIONS=50
+NDR_AUTO_BLOCK=false
+NDR_AUTO_BLOCK_RISK=92
+ROUTEROS_INVENTORY_INTERVAL_SECONDS=300
+
+# Optional high-risk incident webhook. Empty keeps telemetry local.
+NOTIFY_WEBHOOK_URL=
+NOTIFY_MIN_RISK=80
+NOTIFY_TIMEOUT_SECONDS=5
 
 # RouterOS REST. Not required for observation-only testing.
 CREATE_REST_USER=false