move_policy_from_mbus.conf.example

[settings]

#
# Warning: Please check permissions of this file prior to saving usernames/passwords
#

#
# RabbitMQ Password; see /etc/cb/cb.conf
#
rabbitmqpassword = deworjvkdsers

#
# RabbitMQ Username; see /etc/cb/cb.conf
#
rabbitmqusername = cb

#
# Carbon Black Server IP
#
#cbserverip = localhost
cbserverip = 192.168.30.40

#
# Carbon Black Server API token
#
cbtoken = 22d9e14d1a23465f10b962fc94d85f4ef9a16bf1

#
# Enterprise Protection Server API Token
#
eptoken = 19AB261B-74EB-4C56-9434-BCE2FA55BFF6

#
# Enterprise Protection Server IP
#
epserverip = 192.168.30.34

#
# Trigger patterns
# Each section represents a set of regular expression tests that will
# be AND'ed together.  If all tests match the host will be moved into
# the policy specified by the target policy directive.
#
# Each regex should be named regex_<criteria> where <criteria> is a valid
# variable found in CbER's message bus data. 
#
# Example 1: Matches notepad.exe on the command line and moves the system
#   to a policy called end users.
# 
# [Notepad test]
# name = 'Notepad test'
# targetpolicy = 'End Users'
# regex_command_line = notepad.exe
#
# Example 2: Matches suspicious Powershell usage and moves system to
#   a policy called Penalty Box
# [Powershell IEX]
# name = 'powershell IEX+Download'
# targetPolicy = 'Penalty Box'
# regex_path = powershell.exe$
# regex_command_line = iex.+?downloadstring\('http