server:
  host: "0.0.0.0"
  port: 8080

database:
  path: "nids.db"

capture:
  default_interface: "eth0"
  snaplen: 65535
  promiscuous: true

detectors:
  port_scan:
    enabled: true
    threshold: 15
    window_seconds: 10
    severity: "high"

  brute_force:
    enabled: true
    threshold: 10
    window_seconds: 30
    severity: "critical"
    ports: [22, 21, 23, 3389, 5900, 25, 110, 143]

  dos:
    enabled: true
    pps_threshold: 1000
    window_seconds: 1
    severity: "critical"

  arp_spoof:
    enabled: true
    severity: "critical"

  dns_anomaly:
    enabled: true
    max_label_length: 50
    query_threshold: 200
    window_seconds: 60
    severity: "medium"