admin / Syanpse-Vanguard

# Synapse-Vanguard agent config. Point the agent at SV_AGENT_CONFIG=this file.

# --- Dev / consolidated deployment: plaintext ingest on the app port (5500) ---
ingest_url = "http://vanguard.local:5500"
enrollment_token = "CHANGE_ME_matches_server_SV_ENROLLMENT_TOKEN"
agent_version = "0.1.0"
mtls_enabled = false
verify_tls = false            # true once you trust the server cert / CA

# --- Production (mTLS on a dedicated ingest port, e.g. 9443) ------------------
# ingest_url  = "https://vanguard.local:9443"
# mtls_enabled = true
# client_cert = "/etc/sv-agent/agent.crt"
# client_key  = "/etc/sv-agent/agent.key"
# ca_cert     = "/etc/sv-agent/ca.crt"
# verify_tls  = true

# --- buffering ---------------------------------------------------------------
buffer_path = "/var/lib/sv-agent/buffer.sqlite"
state_path  = "/var/lib/sv-agent/state.json"
batch_size = 500
flush_interval_s = 5.0

# --- Linux collector paths ---------------------------------------------------
syslog_paths = ["/var/log/syslog", "/var/log/auth.log"]
auditd_path = "/var/log/audit/audit.log"

# --- Windows channels (high-signal set) --------------------------------------
winlog_channels = [
  "Security",
  "System",
  "Application",
  "Microsoft-Windows-Sysmon/Operational",
  "Microsoft-Windows-PowerShell/Operational",
  "Windows PowerShell",
  "Microsoft-Windows-Windows Defender/Operational",
  "Microsoft-Windows-TaskScheduler/Operational",
  "Microsoft-Windows-WMI-Activity/Operational",
  "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational",
]