theory/env.example at main · Aicodertrying/theory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# THEORY — Environment Configuration
# =====================================
# Copy this file to .env and fill in your values.
# The .env file is gitignored — never commit it.
#
#   cp .env.example .env
#
# Required for full functionality:
#   OTX_API_KEY     → free at otx.alienvault.com
#   GITHUB_TOKEN    → free at github.com/settings/tokens (read:public_repo only)
#   ANTHROPIC_API_KEY or OPENAI_API_KEY → for vendor intelligence synthesis

# ── AlienVault OTX ──────────────────────────────────────────────────
# Required for OTX source. Free account at otx.alienvault.com
OTX_API_KEY=your_otx_api_key_here

# ── GitHub (Sigma Rules) ─────────────────────────────────────────────
# Optional but strongly recommended — avoids GitHub Search API rate limits
# Create at: github.com/settings/tokens → New fine-grained token
# Scopes needed: read:public_repo (or no scopes for public-only access)
GITHUB_TOKEN=your_github_token_here

# ── LLM Provider (Vendor Intelligence Synthesis) ────────────────────
# Choose your preferred LLM provider for synthesizing vendor intel articles.
# Options: claude | openai | ollama
# If not set, THEORY auto-detects based on which API key is present.
THEORY_LLM_PROVIDER=claude

# Anthropic Claude (recommended — fast, accurate, supports claude-haiku)
# Get your key at: console.anthropic.com
ANTHROPIC_API_KEY=your_anthropic_api_key_here

# OpenAI (alternative to Claude)
# Get your key at: platform.openai.com
OPENAI_API_KEY=your_openai_api_key_here

# Ollama (fully local, no API costs, requires Ollama running locally)
# Install Ollama: ollama.ai — then run: ollama pull llama3.2
OLLAMA_HOST=http://localhost:11434
OLLAMA_MODEL=llama3.2

# ── Vendor Intelligence Settings ─────────────────────────────────────
# How far back to look for vendor intel articles (in days)
# Default: 365 (12 months)
THEORY_INTEL_LOOKBACK=365

# Maximum number of articles to synthesize per actor per run
# Higher = more comprehensive but more API cost
# Default: 8
THEORY_INTEL_MAX_ITEMS=8

# ── Paywalled Feed Cookies ───────────────────────────────────────────
# If you have subscriptions to paywalled threat intel sources,
# add your session cookies here. THEORY will include them in RSS requests.
# Format: FEED_COOKIE_<SOURCE_NAME_UPPERCASED>=your_cookie_value
#
# Examples (uncomment and fill in if you have access):
# FEED_COOKIE_RECORDED_FUTURE=your_rf_session_cookie
# FEED_COOKIE_MANDIANT_ADVANTAGE=your_mandiant_session_cookie
# FEED_COOKIE_FLASHPOINT=your_flashpoint_session_cookie