FileGuard/config.yaml at main · Nnutural/FileGuard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
fileguard:
  watch_dirs:
    - "./experiments/sandbox"
  exclude_patterns:
    - "*.tmp"
    - "Thumbs.db"
    - "desktop.ini"
    - ".fileguard/**"

  analyzers:
    sensitive_path:
      enabled: true
      weight: 2.0
      policies:
        - name: "财务数据目录"
          pattern: "**/financial/**"
          risk_base: 2.0
          time_restriction:
            deny_hours: [0, 1, 2, 3, 4, 5, 19, 20, 21, 22, 23]
            time_multiplier: 2.0
        - name: "配置文件目录"
          pattern: "**/config/**"
          risk_base: 5.0
        - name: "密钥与证书"
          pattern: "**/*.pem|**/*.key|**/*.pfx|**/*.cer"
          risk_base: 9.0

    entropy:
      enabled: true
      weight: 3.0
      threshold: 6.5
      high_entropy_extensions:
        - ".zip"
        - ".gz"
        - ".jpg"
        - ".png"
        - ".pdf"

    frequency:
      enabled: true
      weight: 2.5
      window_seconds: 10
      thresholds:
        created: 20
        deleted: 15
        modified: 30
        moved: 25

    honeypot:
      enabled: true
      weight: 5.0
      deploy_count: 3
      filename_templates:
        - "~$budget_draft.tmp"
        - ".~lock.confidential.docx#"
        - "~$annual_report.tmp"

    hash_diff:
      enabled: true
      weight: 1.5

    fuzzy_hash:
      enabled: true
      weight: 3.0
      block_size: 4096
      similarity_threshold: 0.3

  scoring:
    levels:
      low: [0, 3.0]
      medium: [3.0, 5.0]
      high: [5.0, 7.0]
      critical: [7.0, 10.0]

  alerting:
    cooldown_seconds: 30
    escalation:
      enabled: true
      window_seconds: 60
      threshold: 3
      group_by: "signal_type"

  snapshot:
    enabled: true
    backup_files: true
    max_file_size_mb: 50
    backup_dir: ".fileguard/backups"
    baseline_file: ".fileguard/baseline.json"
    incremental_file: ".fileguard/incremental_snapshots.jsonl"

  auto_restore:
    enabled: false
    dry_run: true

  output:
    log_file: ".fileguard/events.jsonl"
    report_file: ".fileguard/report.html"
    dashboard_refresh_ms: 500

  api:
    host: "127.0.0.1"
    port: 8000
    cors_origins:
      - "http://localhost:5173"

  general:
    debounce_ms: 200
    max_queue_size: 10000