config.example.json

{
  "_comment": "Copy this to config.json and edit, then run: python3 run.py -c config.json. All fields are optional; anything omitted uses built-in defaults.",

  "mode": "demo",
  "_mode_help": "demo = simulated network under attack (safe, default) | live = monitor a real interface (needs scapy + sudo).",

  "interface": null,
  "_interface_help": "Live mode NIC, e.g. \"en0\" (macOS) or \"eth0\"/\"wlan0\" (Linux). null = auto-detect.",

  "subnet": null,
  "_subnet_help": "Live mode subnet to ARP-scan, e.g. \"192.168.1.0/24\". null = derive a /24 from the interface IP.",

  "host": "127.0.0.1",
  "port": 8899,
  "open_browser": true,

  "learning_period_sec": 20,
  "_learning_help": "Seconds spent profiling normal behavior before unknown-device alerts arm.",

  "device_timeout_sec": 90,
  "demo_speed": 1.0,
  "_demo_speed_help": ">1 runs the simulated attack timeline faster, <1 slower.",

  "baseline_path": "baseline.json",

  "thresholds": {
    "port_scan_distinct_ports": 15,
    "port_scan_window_sec": 10,
    "host_sweep_distinct_hosts": 12,
    "host_sweep_window_sec": 10,
    "exfil_ratio_over_baseline": 6.0,
    "exfil_floor_bytes": 8000000,
    "exfil_window_sec": 30,
    "beacon_min_hits": 8,
    "beacon_max_jitter": 0.25,
    "beacon_window_sec": 120,
    "traffic_ratio_over_baseline": 5.0,
    "traffic_floor_bytes": 3000000
  }
}