OpenCTI WOAP Charm

Learn about configurations >

• connector-duration-period | string

  Default: PT5M

  Determines the time interval between each launch of the connector in ISO 8601, ex- PT24H or P1D.

• connector-log-level | string

  Default: info

  The log level for this connector, could be debug, info, warn or error (less verbose).

• incident-description-template | string

  Template for the OpenCTI incident description, in the WOAP template DSL. A built-in default is used when unset.

• incident-label-rules | string

  Rules deciding which labels to create on each OpenCTI incident, as a YAML string list. Each entry is a mapping: {static: <text>} for a fixed label, or {field: <path>, prefix: <str>} for an alert field's value(s). A malformed entry is skipped; a non-list value falls back to the default. Unset uses the built-in default. No label may contain whitespace. See docs/incident-label-rules.md. Example: [{static: wazuh}, {field: rule.level, prefix: "level-"}, {field: predecoder.program_name}]

• incident-name-template | string

  Template for the OpenCTI incident name, in the WOAP template DSL. A built-in default is used when unset.

• opencti-url | string

  Override for the OpenCTI API URL. When unset, the URL comes from the opencti-connector relation (OpenCTI's ingress URL). Set this manually when the ingress hostname does not resolve from inside the connector pod.

• opensearch-queries | string

  Retrieval queries as a YAML string (see docs/opensearch-queries.md). A built-in default query is used when unset or invalid.

• opensearch-ssl-verify | boolean

  Default: True

  Whether to verify SSL certificates when connecting to OpenSearch.

• opensearch-timestamp-fields | string

  Timestamp fields in descending precedence, as a YAML string list. Defaults to ["@timestamp"] when unset.