--active-rdns [=false]

enable active rDNS enrichment for src/dst IPs

--active-rdns-cache-expiry =2m0s

cache expiry interval for rDNS lookups

--active-rdns-private-only [=false]

only do active rDNS enrichment for RFC1918 IPs

--bloom-alert-prefix ="BLF"

String prefix for Bloom filter alerts

--bloom-blacklist-iocs =[/,/index.htm,/index.html]

Blacklisted strings in Bloom filter (will cause filter to be rejected)

-b , --bloom-file =""

Bloom filter for external indicator screening

-z , --bloom-zipped [=false]

use gzipped Bloom filter file

-c , --chunksize =50000

chunk size for batched event handling (e.g. inserts)

--context-cache-timeout =1h0m0s

time for flow metadata to be kept for uncompleted flows

--context-enable [=false]

collect and forward flow context for alerted flows

--context-submission-exchange ="context"

Exchange to which flow context events will be submitted

--context-submission-url ="amqp://guest:guest@localhost:5672/"

URL to which flow context will be submitted

-d , --db-database ="events"

database DB

--db-enable [=false]

write events to database

-s , --db-host ="localhost:5432"

database host

--db-maxtablesize =500

Maximum allowed cumulative table size in GB

-m , --db-mongo [=false]

use MongoDB

-p , --db-password ="sensor"

database password

--db-rotate =1h0m0s

time interval for database table rotations

-u , --db-user ="sensor"

database user

--dummy [=false]

log locally instead of sending home

--flowextract-bloom-selector =""

IP address Bloom filter to select flows to extract

--flowextract-enable [=false]

extract and forward flow metadata

--flowextract-submission-exchange ="flows"

Exchange to which raw flow events will be submitted

--flowextract-submission-url ="amqp://guest:guest@localhost:5672/"

URL to which raw flow events will be submitted

-n , --flowreport-interval =0s

time interval for report submissions

--flowreport-nocompress [=false]

send uncompressed flow reports (default is gzip)

--flowreport-submission-exchange ="aggregations"

Exchange to which flow reports will be submitted

--flowreport-submission-url ="amqp://guest:guest@localhost:5672/"

URL to which flow reports will be submitted

--flushcount =100000

maximum number of events in one batch (e.g. for flow extraction)

-f , --flushtime =1m0s

time interval for event aggregation

-T , --fwd-all-types [=false]

forward all event types

-t , --fwd-event-types =[alert,stats]

event types to forward to socket

--heartbeat-enable [=false]

Forward HTTP heartbeat event

--heartbeat-times =[]

Times of day to send heartbeat (list of 24h HH:MM strings)

-h , --help [=false]

help for run

--in-buffer-drop [=true]

drop incoming events on FEVER side instead of blocking the input socket

--in-buffer-length =500000

input buffer length (counted in EVE objects)

-r , --in-redis =""

Redis input server (assumes "suricata" list key, no pwd)

--in-redis-nopipe [=false]

do not use Redis pipelining

-i , --in-socket ="/tmp/suri.sock"

filename of input socket (accepts EVE JSON)

--ip-alert-prefix ="IP-BLACKLIST"

String prefix for IP blacklist alerts

--ip-blacklist =""

List with IP ranges to alert on

--logfile =""

Path to log file

--logjson [=false]

Output logs in JSON format

--metrics-enable [=false]

submit performance metrics to central sink

--metrics-submission-exchange ="metrics"

Exchange to which metrics will be submitted

--metrics-submission-url ="amqp://guest:guest@localhost:5672/"

URL to which metrics will be submitted

-o , --out-socket ="/tmp/suri-forward.sock"

path to output socket (to forwarder), empty string disables forwarding

--pdns-enable [=false]

collect and forward aggregated passive DNS data

--pdns-submission-exchange ="pdns"

Exchange to which passive DNS events will be submitted

--pdns-submission-url ="amqp://guest:guest@localhost:5672/"

URL to which passive DNS events will be submitted

--profile =""

enable runtime profiling to given file

--reconnect-retries =0

number of retries connecting to socket or sink, 0 = no retry limit

--toolname ="fever"

set toolname

-v , --verbose [=false]

enable verbose logging (debug log level)

--config =""

config file (default is $HOME/.fever.yaml)

--mgmt-host =""

hostname:port definition for management server

--mgmt-network ="tcp"

network (tcp/udp) definition for management server

--mgmt-socket ="/tmp/fever-mgmt.sock"

Socket path for management server