connection.yml.sample

notify:
  redacted: True
  suppress_duplicates: True
  slack:
    webhook_url: https://hooks.slack.com/services/T0XXXXXXXXXXX/BXXXXXXXX/1CIyXXXXXXXXXXXXXXX
  jira:
    username: "amce@org.com"
    server_url: "https://amce.atlassian.net"
    api_token: "JIRA_API_TOKEN_HERE"
    project: "SEC"
    issue_type: "Task"
    labels:
      - "hawk-eye"
    assignee: "soc-team@amce.com"
    issue_fields:
      summary_prefix: "[Hawk-eye] PII Exposed - "
      description_template: |
        A Data Security issue has been identified:
        
        {details}
severity_rules:
  Highest:
    - query: "length(matches) > `10` && contains(['EMAIL', 'PAN'], pattern_name)"
      description: "Detected more than 10 Email or Pan exposed"
  High:
    - query: "length(matches) > `10` && contains(['EMAIL', 'PAN'], pattern_name) && data_source == 'slack'"
      description: "Detected more than 10 Email or Pan exposed in Slack"
  Medium:
    - query: "length(matches) > `5` && length(matches) <= `10` && contains(['EMAIL', 'PAN'], pattern_name) && data_source == 'slack' && profile == 'customer_support'"
      description: "Detected more than 5 and less than 10 Email or Pan exposed in Customer support Slack workspace"
  Low:
    - query: "length(matches) <= `5`"
      description: "Detected less than 5 PII or Secrets"
options:
  quick_exit: True
  max_matches: 5 ## Default is 1
sources:
  redis:
    redis_example:
      host: YOUR_REDIS_HOST
      password: YOUR_REDIS_PASSWORD
  s3:
    s3_example:
      access_key: YOUR_S3_ACCESS_KEY
      secret_key: YOUR_S3_SECRET_KEY
      bucket_name: YOUR_S3_BUCKET_NAME
      cache: true
  gcs:
    gcs_example:
      credentials_file: /path/to/your/credential_file.json
      bucket_name: YOUR_GCS_BUCKET_NAME
      cache: true
      exclude_patterns:
        - .pdf
        - .docx
  firebase:
    firebase_example:
      credentials_file: /path/to/your/credential_file.json
      bucket_name: YOUR_FIREBASE_BUCKET_NAME
      cache: true
      exclude_patterns:
        - .pdf
        - .docx
  mysql:
    mysql_example:
      host: YOUR_MYSQL_HOST
      port: YOUR_MYSQL_PORT
      user: YOUR_MYSQL_USERNAME
      password: YOUR_MYSQL_PASSWORD
      database: YOUR_MYSQL_DATABASE_NAME
      limit_start: 0   # Specify the starting limit for the range
      limit_end: 500   # Specify the ending limit for the range
      tables:
        - table1
        - table2
      exclude_columns:
         - column1
         - column2
  postgresql:
    postgresql_example:
      host: YOUR_POSTGRESQL_HOST
      port: YOUR_POSTGRESQL_PORT
      user: YOUR_POSTGRESQL_USERNAME
      password: YOUR_POSTGRESQL_PASSWORD
      database: YOUR_POSTGRESQL_DATABASE_NAME
      limit_start: 0   # Specify the starting limit for the range
      limit_end: 500   # Specify the ending limit for the range
      tables:
        - table1
        - table2
  mongodb:
    mongodb_example:
      uri: YOUR_MONGODB_URI
      host: YOUR_MONGODB_HOST
      port: YOUR_MONGODB_PORT
      username: YOUR_MONGODB_USERNAME
      password: YOUR_MONGODB_PASSWORD
      database: YOUR_MONGODB_DATABASE_NAME
      uri: YOUR_MONGODB_URI  # Use either URI or individual connection parameters
      limit_start: 0   # Specify the starting limit for the range
      limit_end: 500   # Specify the ending limit for the range
      collections:
        - collection1
        - collection2
  fs:
    fs_example:
      path: /path/to/your/filesystem/directory
      exclude_patterns:
        - .pdf
        - .docx
        - private
        - venv
        - node_modules
  
 gdrive:
    drive_example:
      folder_name:
      credentials_file: /Users/kumarohit/Downloads/client_secret.json ## this will be oauth app json file
      cache: true
      exclude_patterns:
        - .pdf
        - .docx

  gdrive_workspace:
    drive_example:
      folder_name:
      credentials_file: /Users/kumarohit/Downloads/client_secret.json ## this will be service account json file
      impersonate_users:
        - usera@amce.org
        - userb@amce.org
      cache: true
      exclude_patterns:
        - .pdf
        - .docx
  text:
    profile1:
      text: "Hello World HHXXXXX"
  slack:
    slack_example:
      channel_types: "public_channel,private_channel"
      token: xoxp-XXXXXXXXXXXXXXXXXXXXXXXXX
      onlyArchived: False ## By default False, set to True if you want to scan archived channels only
      archived_channels: True ## By default False, set to True if you want to scan archived channels also
      limit_mins: 15 ## By default 60 mins
      read_from: last_message ## By default current Unix timestamp, available options - UNIX Timestamp (e..g: 1737354387), last_message
      isExternal: True ## By default None (Scan everything even if its external or not external), set to True if you want to scan external channels only
      channel_ids:
      - XXXXXXXX
      blacklisted_channel_ids:
      - XXXXXXXX