4. Advanced options for deployment - stanfrbd/cyberbro GitHub Wiki

Advanced options for deployment

[!TIP] All variables from secrets.json can be converted to environment variables (uppercase).

[!NOTE] You can add these environment variables in a docker-compose-custom.yml. If you don't specify proxy, no proxy will be used.

Here is a list of all available environment variables that can be used with examples:

PROXY_URL=http://127.0.0.1:9000
VIRUSTOTAL=api_key_here
ABUSEIPDB=api_key_here
IPINFO=api_key_here
GOOGLE_SAFE_BROWSING=api_key_here
MDE_TENANT_ID=api_key_here
MDE_CLIENT_ID=api_key_here
MDE_CLIENT_SECRET=api_key_here
MISP_URL=https://misp.local
MISP_API_KEY=api_key_here
SHODAN=api_key_here
OPENCTI_API_KEY=api_key_here
OPENCTI_URL=https://demo.opencti.io
CROWDSTRIKE_CLIENT_ID=client_id_here
CROWDSTRIKE_CLIENT_SECRET=client_secret_here
CROWDSTRIKE_FALCON_BASE_URL=https://falcon.crowdstrike.com
WEBSCOUT=token_here
SUPERVISORD_WORKERS_COUNT=4
SUPERVISORD_THREADS_COUNT=4
SUPERVISORD_TIMEOUT=200
API_PREFIX=my_api
MAX_FORM_MEMORY_SIZE=1048576
GUI_ENABLED_ENGINES=reverse_dns,rdap
CONFIG_PAGE_ENABLED=true
SSL_VERIFY=true
GUI_CACHE_TIMEOUT=1800
API_CACHE_TIMEOUT=86400

Example of custom docker compose file

[!TIP] This can be useful when you don't want to build the image yourself. This image is produced by the GitHub actions workflow

ghcr.io/stanfrbd/cyberbro:latest

Example of docker-compose-custom.yml (note: no " in environment variables)

services:
  web:
    image: ghcr.io/stanfrbd/cyberbro:latest
    container_name: cyberbro
    ports:
      - "5000:5000"
    environment:
      - FLASK_ENV=production
      - VIRUSTOTAL=api_key_here
      - ABUSEIPDB=api_key_here
      - GUI_ENABLED_ENGINES=reverse_dns,rdap,ipquery,abuseipdb,virustotal,spur,google_safe_browsing,phishtank
      - API_CACHE_TIMEOUT=1800
    restart: always
    volumes:
      - ./data:/app/data
      - ./logs:/var/log/cyberbro

[!NOTE] ./data:/app/data: This maps the data directory on your host machine to the /app/data directory inside the container. This is mandatory for persisting the database results.db that is used by Cyberbro.
./logs:/var/log/cyberbro: This maps the logs directory on your host machine to the /var/log/cyberbro directory inside the container. This is useful for persisting log files generated by the application, allowing you to access and analyze logs even after the container is stopped or removed.

Supervisord options (for docker only)

This options will be applied only if the script prod/advanced_config.py is run (automatic in docker)

In secrets.json:

  • Adding "supervisord_workers_count": 4 in secrets.json will set -w 4 in supervisord.conf
  • Adding "supervisord_threads_count": 4 in secrets.json will set -t 4 in supervisord.conf
  • Adding "supervisord_timeout": 200 in secrets.json will set --timeout 200 in supervisord.conf

Or using environment variables:

export SUPERVISORD_WORKERS_COUNT=4
export SUPERVISORD_THREADS_COUNT=4
export SUPERVISORD_TIMEOUT=200

[!NOTE] These variables are optional, so if they don't exist in secrets.json, the original config (in prod/supervisord.conf) will be applied by default.

API prefix in app.py and index.html options

In secrets.json:

[!IMPORTANT] By default, the API is accessible at http://<cyberbro_instance:5000>/api

  • Adding "api_prefix": "my_api" in secrets.json will set all the original prefix /api/ endpoints to be renamed by prefix /my_api/ endpoints in the files app.py and index.html

Or using environment variables:

export API_PREFIX=my_api

[!NOTE] This variable is optional, so if it doesn't exist in secrets.json, the API will be accessible at /api/ by default.

Selected engines in the GUI (index.html only)

In secrets.json:

  • Adding "gui_enabled_engines": ["reverse_dns", "rdap"] in secrets.json will restrict usage of these two engines in the GUI.

Or using environment variables:

export GUI_ENABLED_ENGINES=reverse_dns,rdap

[!NOTE] This variable is optional, so if it doesn't exist in secrets.json or ENV, all engines will be displayed in the GUI.

[!TIP] Example: for the demo instance of cyberbro, only these engines are used: "gui_enabled_engines": ["reverse_dns", "rdap", "ipquery", "abuseipdb", "virustotal", "spur", "google_safe_browsing", "shodan", "phishtank", "threatfox", "urlscan", "google", "github", "opencti", "abusix", "hudsonrock"]
With environment variable: GUI_ENABLED_ENGINES=reverse_dns,rdap,ipquery,abuseipdb,virustotal,spur,google_safe_browsing,shodan,phishtank,threatfox,urlscan,google,github,opencti,abusix,hudsonrock

SSL verification settings for requests (backend)

[!CAUTION] This is really insecure to do disable it, do it at your own risk.

You can change the default behavior using the following:

In secrets.json:

Adding "ssl_verify": false in secrets.json will disable the certificate trust verification in the requests (backend).

Or using environment variables:

export SSL_VERIFY=false

[!TIP] This variable is optional, so if it doesn't exist in secrets.json or ENV, it will use the default parameter (True) which is more secure.

Config page in the GUI (config.html) http://cyberbro.local:5000/config

[!CAUTION] This is unsecure so it is disabled by default.

You can add it using the following:

In secrets.json:

Adding "config_page_enabled": true in secrets.json will enable the config page in the GUI at http://cyberbro.local:5000/config

Or using environment variables:

export CONFIG_PAGE_ENABLED=true

[!NOTE] This variable is optional, so if it doesn't exist in secrets.json or ENV, it will be disabled by default.

Upload more than 1MB observables in the form

By default, the form in the GUI only accepts 1MB of data. You can change this limit using the following: In secrets.json: Adding "max_form_memory_size": 1048576 in secrets.json will set the limit to 1MB (1048576 bytes) in the form. Or using environment variables:

export MAX_FORM_MEMORY_SIZE=1048576

[!NOTE] The value must be set in bytes, so 1MB = 1048576 bytes, 2MB = 2097152 bytes, etc.
Don't set it too high, it can cause problems with the database or treatment of the data.
This variable is optional, so if it doesn't exist in secrets.json or ENV, it will use the default parameter (1MB).

Source: https://flask.palletsprojects.com/en/stable/config/#MAX_FORM_MEMORY_SIZE

Cache timeout for the GUI

[!NOTE] This is the timeout for the cache in the GUI, not the API. The default value is 1800 seconds (30 minutes).
You can change this value using the following: In secrets.json: Adding "gui_cache_timeout": 1800 in secrets.json will set the timeout to 30 minutes (1800 seconds) in the GUI. Or using environment variables:

export GUI_CACHE_TIMEOUT=1800

[!NOTE] The value must be set in seconds, so 1 minute = 60 seconds, 1 hour = 3600 seconds, etc.
Don't set it too high, it can cause problems with the database or treatment of the data.
This variable is optional, so if it doesn't exist in secrets.json or ENV, it will use the default parameter (30 minutes).

Cache timeout for the API

[!NOTE] This is the timeout for the cache in the API, not the GUI. The default value is 86400 seconds (24 hours).
You can change this value using the following: In secrets.json: Adding "api_cache_timeout": 86400 in secrets.json will set the timeout to 24 hours (86400 seconds) in the API. Or using environment variables:

export API_CACHE_TIMEOUT=86400

[!NOTE] The value must be set in seconds, so 1 minute = 60 seconds, 1 hour = 3600 seconds, etc.
Don't set it too high, it can cause problems with the database or treatment of the data.
This variable is optional, so if it doesn't exist in secrets.json or ENV, it will use the default parameter (24 hours).