Configuration

This page will explain every config setting in xarf-report-generator

Reporter

Basic Information about the entity that is reporting the incident.

Organization

The name of the company

OrganizationEmail

The E-Mail of the organization

Domain

Domain of the Organization

Contact E-Mail

The e-mail address of the primary contact of the report

ContactName

The name of the primary contact of the report

ContactPhone

The phone number of the primary contact

EmailReport

Settings for the e-mail reporting feature

From

The name and address of the From header.

ex John Doe <info@example.com>

Bcc

The E-Mail address to send a blind copy to.

Leave out or empty to disable.

ex John Doe <info@example.com>

Subject

The Subject of the E-Mail

ReportTemplate

A file on the disk to use as a template for the E-Mail.

If empty sends a generic one ex (##XARF_REPORT## contains the JSON XARF Report in plain text):

[2022-04-10T00:00:00.00000000Z] 255.255.255.255:0 -> 255.255.255.255:0 | Username: ADMINISTRATOR | Reason: Unknown user name or bad password.

##XARF_REPORT##

Send using https://github.com/IT-Hock/xarf-report-generator

Variables for use in the template:

• ##XARF_REPORT## -> The XARF Report in Plain Text
• ##SOURCE_IP## -> The IP the attack originated from
• ##SOURCE_PORT## -> The Port the attack originated from
• ##DEST_IP## ->
• ##DEST_PORT## ->
• ##TIME## -> Time in ISO 8601 in UTC (ex 2022-04-10T00:00:00.00000000Z)

AutoReport

Whether or not to automatically send E-Mails to the Abuse contact in the WHOIS of the IP. (Needs a proper SMTP Configuration)

ReportOutputPath

Where to store generated E-Mail reports in EML Format

Email

Basic SMTP setup for auto reporting

SmtpServer

The server where the SMTP connection should be made to

Port

The SMTP Port of the server

Username

The SMTP Username to authenticate with

Password

The SMTP Password to authenticate with

EnableSsl

Whether or not to connect using SSL

EventViewer

Gather failed logons using EventViewer

Enabled

Whether or not to gather failed logons using EventViewer

IpBan

Gathers recent IP Bans from an IPBan Log file.

Enabled

Whether or not to gather recent IP Bans from IPBan

MyIpAddress

The public IP Address of this server.

OutputPath

Path on the disk to store XARF reports to.

Example config.json

{
  "Reporter": {
    "Organization": "Company Name",
    "OrganizationEmail": "info@example.com",
    "Domain": "example.com",
    "ContactEmail": "contact@example.com",
    "ContactName": "John Doe",
    "ContactPhone": "+1 (555) 555-5555"
  },
  "EmailReport": {
    "From": "John Doe <info@example.com>",
    "Bcc": "John Doe <info@example.com>",
    "Subject": "Test Report",
    "ReportTemplate": "myTemplate.txt",
    "AutoReport": false,
    "ReportOutputPath": "EmailReport",
  },
  "Email": {
    "SmtpServer": "smtp.example.com",
    "Port": 25,
    "Username": "username",
    "Password": "password",
    "EnableSsl": false,
  },
  "EventViewer": {
    "Enabled": true
  },
  "IpBan": {
    "Enabled": true,
    "IpBanLogFile": "logfile.txt"
  },
  "MyIpAddress": "255.255.255.255",
  "OutputPath": "xarf"
}