mi
63 lines
1.7 KiB
Plaintext
63 lines
1.7 KiB
Plaintext
# Reference decisions for KESL 12.4 on HAN Processing VM2.
|
|
# Do not import this partial file into KESL. Export the installed-build
|
|
# settings, review them, and apply individual values from RUNBOOK.KESL.ru.md.
|
|
|
|
[deployment]
|
|
product_major_minor=12.4
|
|
mode=standard_standalone
|
|
gui=disabled
|
|
update_source=KLServers
|
|
interceptor=fanotify
|
|
network_features=disabled
|
|
ksn=<Yes_OR_No_AFTER_SECURITY_AND_LEGAL_APPROVAL>
|
|
|
|
[resource_budget]
|
|
# VM2 starts at 8 GiB RAM. Values require measured baseline and coexistence gate.
|
|
scan_memory_limit_mb=<1024_OR_APPROVED_VALUE>
|
|
max_memory=<2048MB_OR_APPROVED_VALUE>
|
|
use_on_demand_cpu_limit=Yes
|
|
on_demand_cpu_limit_percent=<APPROVED_VALUE>
|
|
|
|
[update_task_6]
|
|
rule_type=Hourly
|
|
required_result=completed_successfully
|
|
required_bases_loaded=Yes
|
|
stale_bases_alert_hours=240
|
|
|
|
[file_threat_protection_task_1]
|
|
steady_state=Started
|
|
action_on_threat=DisinfectDeleteIfNotPossible
|
|
scan_archived=No
|
|
|
|
[message_safety_broker]
|
|
socket=/run/han-kesl/scan.sock
|
|
max_file_bytes=5242880
|
|
scan_action=Inform
|
|
fail_closed=Yes
|
|
staging=/var/lib/han-kesl-scan/staging
|
|
# Do not add staging to ExcludedFromScanScope: KESL Scan_File can skip it.
|
|
staging_exclusion=forbidden
|
|
explicit_scan_before_allow=required
|
|
|
|
[allowed_hot_data_exclusions]
|
|
item_0000=<REDIS_SAFETY_DATA_MOUNTPOINT>
|
|
item_0001=<OTEL_QUEUE_MOUNTPOINT>
|
|
|
|
[forbidden_broad_exclusions]
|
|
item_0000=/var/lib/docker
|
|
item_0001=/var/lib/docker/overlay2
|
|
item_0002=/opt/han-chat
|
|
item_0003=/var/lib/han-deploy/incoming
|
|
item_0004=/etc/han
|
|
item_0005=/run/han-chat
|
|
item_0006=/tmp
|
|
item_0007=/
|
|
|
|
[acceptance]
|
|
host_on_access_eicar=required
|
|
broker_clean_eicar_error=required
|
|
automatic_hourly_update_observed=required
|
|
message_safety_200_403_503=required
|
|
performance_two_files_per_second=required
|
|
resource_comparison_24h=required
|