Command Center Startup Options
The eyeInspect Command Center (CC) has a number of startup options, which are described
below. To use the startup options, modify or create, if non-existent,
/opt/sdconsole/conf/application.properties and use one of the
following options in the format property=value. After saving your
changes, start the Command Center by executing the following command:
sudo supervisorctl start silentdefense-cc
If the Command Center was already running, restart it by executing the following command:
sudo supervisorctl restart silentdefense-cc
The following table describes the available eyeInspect Command Center startup options.
| Option | Default value | Description |
| sdcc.alerts.displayCountryAndFlag | true | Display source country flag and name for alerts with a
sourceip assigned to any country according to
the GeoIP database. |
|
sdcc.cronjob.countConnectedSensorsInterval |
60 | Period for recounting connected sensors. |
|
sdcc.cronjob.fetchAlertsInterval |
5 | The interval (in seconds) for fetching new alerts. |
|
sdcc.cronjob.fetchCCDiagnosticsInterval |
5 | Polling period in seconds for CC diagnostics data. |
|
sdcc.cronjob.fetchHostLinkInfoInterval |
60 |
The interval (in seconds) for fetching new host and link information for the network map. |
|
sdcc.cronjob.fetchPatrolTasksResultInterval |
10 | Period in secs for fetching active sensor tasks results. |
|
sdcc.cronjob.fetchPatrolStatusInterval |
30 | Period in secs fetching active sensor health status. |
|
sdcc.cronjob.fetchSensorDetailsInterval |
600 | The interval (in seconds) for refreshing the sensors configuration in the Command Center. |
|
sdcc.cronjob.fetchSensorStatusInterval |
5 | The interval (in seconds) for sensor status checks. |
| sdcc.cronjob.maxFetchHosts | 7500 | How many times the CC asks the sensor for new or updated hosts (in case the sensor reported that there are more hosts available) at each cronjob run. |
| sdcc.cronjob.maxFetchLinks | 30000 | How many times the CC asks the sensor for new or updated links(in case the sensor reported that there are more links available) at each cronjob run. |
|
sdcc.cronjob.reconnectPatrolSensorInterval |
60 | Period in seconds attempting reconnection to active sensors. |
| sdcc.csv.fieldSep | , |
The field separator for CSV files. Make sure to input only one character. |
|
sdcc.diagnostics.export.maxDBLogEntries |
25000 | The maximum number of database log entries exported. |
|
sdcc.diagnostics.export.maxLogFileSize |
26214400 |
The maximum file size of log files exported in bytes, default is 25 MB. |
| sdcc.dropdown.max.items | 2000 |
The maximum number of items displayed in a dropdown menu or list. |
| sdcc.druid.brokerURL | http://localhost:8082 | The URL for the Druid broker. |
| sdcc.druid.coordinatorURL | http://localhost:8081 | The URL for the Druid coordinator. |
| sdcc.druid.overlordURL | http://localhost:8090 | The URL for the Druid overlord. |
|
sdcc.dpbi.enable-all-parsable |
false | Enables or disables all parsable protocols in DPBI. |
| sdcc.ipresolve.enabled | true | Enables or disables the automatic resolving of IP addresses. |
|
sdcc.ipresolve.maxResolvingThreads |
2000 | The maximum number of IP resolving threads. |
|
sdcc.ipresolve.maxCachedItems |
1000000 | The maximum number of cached IPs. |
|
sdcc.ipresolve.resolvedTimeoutSec |
300 | The cache timeout for resolved IPs in seconds. |
|
sdcc.ipresolve.unresolvedTimeoutSec |
60 | The cache timeout for not resolved IPs in seconds. |
|
sdcc.kafka.topic.custom-events |
events | The kafka topic name for custom events. |
| sdcc.kafka.topic.flow-info | flow-info |
The kafka topic to use for the flow-info information (as used by network analytics and the dashboard). |
| sdcc.kafka.server | 127.0.0.1 |
The kafka server IP address. Note, when changing the kafka server and/or port, specify both properties. |
| sdcc.kafka.port | 9092 | The port of the kafka server. |
|
sdcc.lan.defaultMaxLearntRules |
1000 |
Default maximum number of learnt rules in a new LAN CP profile. |
|
sdcc.lan.maxLearntRulesHighLimit |
5000 |
Upper limit on the maximum number of LAN CP learnt rules the user can choose. |
| sdcc.logpath | logs/ |
The directory (relative to the base path) where the logs should be stored. |
| sdcc.map.maxHosts | 10000 | The maximum number of hosts shown in the network map. |
|
sdcc.map.maxHostPropertyPastValues |
5 |
The maximum number of previous values stored for asset properties. |
| sdcc.map.maxChangelogValueChanges | 3 | The maximum number of times a specific asset property value will generate a changelog entry. This limit is used to prevent continuous updates of property values, generated for example by conflicting software messages. |
| sdcc.map.maxLinks | 2500 | The maximum number of links shown in the network map. |
|
sdcc.map.sanitizePLCRTURole |
true |
Removes roles PLC, RTU or Slave when more accurate roles are applicable. |
|
sdcc.max.generated.monitored.networks |
10000 |
The maximum number of monitored networks automatically generated by the “Create missing networks” functionality. |
| sdcc.min-free-gb | 3 |
The minimum allowed volume space to allow uploading of PCAP files. |
| sdcc.patrol.requestTimeout | 0 | Active sensor endpoint HTTP request timeout in milliseconds. |
| sdcc.patrol.maxConnPerRo | 5 | Active sensor endpoint maximum allowed connection per route. |
| sdcc.patrol.maxTotalConn | 5 | Active sensor endpoint maximum total connections. |
| sdcc.patrol.keepAlive | 5000 | Active sensor endpoint connection keepAlive in
milliseconds. |
| sdcc.patrol.connTimeout | 2000 |
Active sensor endpoint timeout in milliseconds to attempt to establish a connection. |
| sdcc.pcap-max-mb | 1024 |
The maximum allowed size in megabytes of uploaded PCAP files. |
| sdcc.pcapDownloadPage.closeDelay | 5000 | The time in milliseconds that the Command Center will wait for the Sensor to provide the PCAP file after it has been prepared. If the PCAP cannot be downloaded, for instance when the latency between the Sensor and the Command Center is very high or when bandwidth throttling is enabled and the maximum upload speed is very low (e.g. 1024 Kbps or lower), consider increasing this value. |
| sdcc.reportpath | report/ | The directory (relative to the base path) where the reports get stored. |
| sdcc.request-cycle.timeout-secs | 60 | HTML page request cycle timeout. |
| sdcc.sensor-encryption-at-rest.enabled | true | Enables or disables the UI menu to encrypt sensor data at rest. |
| sdcc.sniff-offline-path |
/opt/nids/pcaps/sniffoffline/ |
The directory (absolute path) where the PCAP replay files get stored. |
| sdcc.vnids-grace-period | 5 | The period in seconds to let a virtual sensor to start. |
| sdcc.widget-query-timeout | 30 | The timeout in seconds after which the widget query will stop processing. |
| sdcc.workflow.maxPendingAlertsPerPlugin | 10000 | The maximum number of pending alerts per plugin. Not specifying this property will leave it at infinity. |
| sdcc.zookeeper.server | localhost | The ZooKeeper IP or hostname (used for
diagnostics). |
| sdcc.zookeeper.jmxPort | - | The ZooKeeper jmx port (used for diagnostics). Note,
when changing the zookeeper server and/or port, specify both
properties. |
Additional configuration parameters can be found and edited in the files
/opt/druid/conf/historical/runtime.properties and
/opt/icsp/icsp-cc/conf/icsp.conf.
The parameters in file runtime.properties can be used to tune the Druid
configuration to ensure the best data processing and retention strategy, based on the
available system resources. The table below lists the most relevant ones. It is required
to restart the Command Center for changes to apply.
| Option | Default Value | Description |
|---|---|---|
| druid.segmentCache.locations | [{"path": "/tmp/druid/indexCache", "maxSize": <25% of the disk size>}] | The (maximum) disk space used for segments that are to be assigned to the Druid historical node. If 95% of this limit is reached, older segments will be deleted to ensure new data can be correctly processed and displayed (this threshold is configurable from the Command Center Diagnostics page). |
The parameters in file icsp.conf can be used to tune the Active Sensor
configuration, e.g. for log collection and retention. The table below lists the most
relevant ones. It is required to restart the Command Center for changes to apply.
| Option | Default Value | Description |
|---|---|---|
| rotate | 5 | The maximum number of log files that are stored. Older files will be deleted when new ones are created. |
| maxsize | 100 | The maximum size (in MB) of log files. Log files will be rotated if this limit is reached. |
minute read