# Kismet alerts configuration
#
# This configuration file is part of the Kismet configuration.  It is loaded
# by the kismet.conf main configuration file.
#
# For more information about the configuration options, see the comments in this
# file and the documentation at:
# https://www.kismetwireless.net/docs/readme/configuring/configfiles/
#
# You can edit the values in these files, but to make it much easier to update Kismet
# in the future, you should put your changes in the kismet_site.conf override file.
# You can learn more about the override config at:
# https://www.kismetwireless.net/docs/readme/configuring/configfiles/#configuration-override-and-flavors

# The kismet alert subsystem can be tuned to control the rate and which alerts are
# generated (or if they are generated at all).
#
# Specific alerts have additional configuration options which control threshold
# values or other situations.
#
#
# Device alerts
# Kismet can raise alerts when a device is seen for the first time (or seen again
# after being idle) via the 'devicefound' alert.
#
# Masked MAC addresses may be used to match all devices which fall within
# the mask, for instance 00:11:22:00:00:00/FF:FF:FF:00:00:00 will match 
# the first 3 bytes of the MAC
# devicefound=00:11:22:33:44:55

# By default, a device is considered 'found' if it has been inactive for more
# than a minute.  This can be tuned shorter or longer as required.
devicefound_timeout=60

# Kismet can similarly raise alerts when a device has gone idle (after being
# seen).
#
# To be alerted when a device is seen, and when a device is lost, simply set
# the MAC for both alerts.
#
# Masked MAC addresses may be used to match all devices which fall within
# the mask, for instance 00:11:22:00:00:00/FF:FF:FF:00:00:00 will match 
# the first 3 bytes of the MAC
# devicelost=00:11:22:33:44:55

# By default, a device is considered 'lost' if it has been inactive for more
# than a minute.
devicelost_timeout=60

# Enable Prelude support, default is false. The analyzer is described as this:
# Name: Kismet, Model: Kismet, class: WIDS,
# Manufacturer: https://www.kismetwireless.net
prelude_alerts=false



# APSPOOF control
# The APSPOOF alert triggers when a SSID is advertised by a device not in the
# approved list.   This can be used to detect devices using the same SSID as an
# authorized network.
#
# SSIDs may be defined as a literal match (ssid="abcd") or as a regex.  SSIDs must
# be in quotes.
#
# The allowed mac list must be comma-separated and enclosed in quotes.
#
# Format:
# apspoof=name:option1,option2...

apspoof=Foo1:ssid="Foobar",validmacs="00:11:22:33:44:55,aa:bb:cc:dd:ee:ff"
apspoof=Foo2:ssid="(?i:foobar)",validmacs="00:11:22:33:44:55"



# SSIDCANARY alert control
# The SSIDCANARY alert triggers when a SSID is advertised for, responded for,
# or probed for.
#
# SSIDs may be defined as a literal match (ssid="abcd") or as a regex.  The SSID
# must be in quotes.
#
# Format:
# ssidcanary=name:option1,....

ssidcanary=FooCanary:ssid="FoobarCanary"
ssidcanary=FooCanart2:ssid="(?i:foobarcanary)"



# Kismet automatically throttles the rate at which alerts may be generated.
#
# Alert rates are controlled with:
#   alert=[alert name],[rate],[burst]
#
# The rate defines the number of total alerts per time period which may be raised
# for each alert type.
#
# The burst rate defines the number of alerts which can be sent before throttling
# takes place.
#
# For example,
#
#   alert=FOO,10/min,5/sec
#
# would allow 5 alerts per second to be sent, up to a maximum of 10 alerts per
# minute.
#
# Alerts may be disabled by setting the rate to 0, for example:
#
#   alert=DISABLEME,0/min,0/sec
#
# Valid time units are 'sec', 'min', 'hour', and 'day'
#
# See the Kismet README or web UI for information on all defined alerts.

alert=ADHOCCONFLICT,5/min,1/sec
alert=ADVCRYPTCHANGE,5/min,1/sec
alert=AIRJACKSSID,5/min,1/sec
alert=APSPOOF,10/min,1/sec
alert=BCASTDISCON,5/min,2/sec
alert=BCOM11KCHAN,10/min,1/sec
alert=BEACONRATE,5/min,1/sec
alert=BLEEDINGTOOTH,5/min,1/sec
alert=BSSTIMESTAMP,5/min,1/sec
alert=CHANCHANGE,5/min,1/sec
alert=CRYPTODROP,5/min,1/sec
alert=DEAUTHFLOOD,5/min,2/sec

# Deprecated; not typically meaningful & many modern APs seem to
# use custom codes at times
alert=DEAUTHCODEINVALID,0/min,0/sec

alert=DHCPNAMECHANGE,5/min,1/sec
alert=DHCPOSCHANGE,5/min,1/sec
alert=DHCPCLIENTID,5/min,1/sec
alert=DHCPCONFLICT,10/min,1/sec
alert=DISASSOCTRAFFIC,10/min,1/sec
alert=DISCONCODEINVALID,5/min,1/sec
alert=DOT11D,5/min,1/sec
alert=FLIPPERZERO,5/min,1/sec
alert=FORMATSTRING,5/min,1/sec
alert=KARMAOUI,5/min,1/sec

# Deprecated
alert=LUCENTTEST,0/min,0/sec

alert=LONGSSID,5/min,1/sec
alert=MSFBCOMSSID,5/min,1/sec
alert=MSFDLINKRATE,5/min,1/sec
alert=MSFNETGEARBEACON,5/min,1/sec
alert=MALFORMMGMT,5/min,1/sec

# Deprecated
alert=NETSTUMBLER,0/min,0/sec

alert=NOCLIENTMFP,10/min,1/sec
alert=NONCEDEGRADE,0/min,0/sec
alert=NONCEREUSE,0/min,0/sec
alert=NULLPROBERESP,5/min,1/sec
alert=OVERPOWERED,0/min,0/sec
alert=PROBECHAN,5/min,1/sec
alert=QCOMEXTENDED,0/min,0/sec
alert=RSNLOOP,5/min,1/sec
alert=RTL8195VD1406,5/min,1/sec
alert=RTLWIFIP2P,5/min,1/sec
alert=SSIDCANARY,5/min,1/sec
alert=VDOO202027301,5/min,1/sec
alert=VDOO202027302,5/min,1/sec
alert=WPSBRUTE,5/min,1/sec
alert=WMMOVERFLOW,10/min,1/sec
alert=WMMTSPEC,10/min,1/sec

