Configuration¶
FreeDR works without any configuration once it is installed. Everything on this page is optional. There are three places to change settings:
| Where | What | Page |
|---|---|---|
| Console Settings | Sources, storage retention, enrichment and AI, password, notifications, appearance | This page and Sources |
C:\ProgramData\FreeDR\freedr.toml |
Startup-only service settings: API port, hot retention, ETW worker pools, artifact queue | Agent configuration file |
FreeDR-Setup.exe / /config file |
AI, threat-intel keys and rule exclusions applied at install | Getting started |
Every change made in the console goes through the authenticated local API. Each one is checked (revision, CSRF token, field validation), and changes to protected settings are audited.
Settings sections¶
| Section | Editable? | Purpose |
|---|---|---|
| Collection | Read-only | Lists the collectors running on this host (ETW, Windows Event Log, NTFS journal, artifact inventory, cold export, database worker) with their state and any degraded flag. Collection is set by the service configuration; changes need a service restart. |
| Sources | Yes | Turn optional Windows audit policies and event channels on or off, and install Sysmon. See Sources. |
| Storage | Yes | Evidence retention period. Also shows hot and cold storage sizes and free disk space. See Storage and retention. |
| Enrichment & AI | Yes | Threat-intel providers, provider keys, and AI investigator settings. See Enrichment and AI. |
| Password & access | Yes | Change the password and sign out. See Password. |
| Detection | Read-only | Counts of installed, enabled and disabled rules. Rule changes are made in Alert rules (Rules). |
| Notifications | Yes | Windows alert notifications. See Notifications. |
| Appearance | Yes, in this browser only | Time zone, time display, density, rows per page, auto-refresh. See Appearance. |
| About & status | Read-only | Agent version, readiness, number of collectors and degraded components |
Storage and retention¶
Evidence goes through two stages:
- Hot: recent events in
data\evidence.duckdb. Detections read only hot data. - Cold: older events are exported to compressed Parquet files in
data\cold\.
| Setting | Default | Range | Where to change |
|---|---|---|---|
Retention period (retention_days) |
90 days | 1–3650 days | Settings › Storage |
Hot retention (hot_retention) |
2700 s (45 min) | at least 2700 s | freedr.toml only (agent.md). Not exposed in the console. |
- Retention period: the final expiry for all sources together. Each cold-export pass deletes whole cold files older than the retention period. To shorten retention you must tick "I understand that shortening retention may permanently expire older evidence." Saves are versioned. If someone else saved in the meantime, the save is rejected and you reload.
- Hot retention: a single duration that sets both how old evidence gets before it leaves the hot database and how often cold export runs. The minimum of 45 minutes keeps a full detection window available in hot storage.
- The Storage panel also shows: hot age, hot database size, write-ahead log size, number and size of cold files, and free disk space on the volume that holds the hot database.
The policy is stored in config\evidence-lifecycle.json as
{"version":1,"revision":N,"retention_days":N}. Change it in the console,
not by editing the file.
Enrichment and AI¶
The Enrichment & AI section has three parts:
Threat-intel providers. Each provider has an on/off switch and a daily lookup limit. Providers start off, with a daily limit of 100.
| Provider | Key slot | Looks up | Max daily limit |
|---|---|---|---|
| CIRCL | none | SHA-256 | 10,000 |
| MalwareBazaar | abuse.ch | SHA-256 | 10,000 |
| ThreatFox | abuse.ch | SHA-256, public IP, public domain | 10,000 |
| URLhaus | abuse.ch | SHA-256, public domain, exact URL | 10,000 |
| AbuseIPDB | AbuseIPDB | public IP | 10,000 |
| VirusTotal | VirusTotal | SHA-256 | 500 (one request every 15 s) |
| AlienVault OTX | AlienVault OTX | SHA-256, public IP, public domain | 10,000 |
| GreyNoise | GreyNoise | public IP | 10,000 |
FreeDR sends indicators only, never files. Active provider status has an access check that sends a fixed harmless indicator, never case evidence. Endpoints, result facts, quotas and troubleshooting per provider: External enrichment (threat intel).
Service keys. Keys are write-only: once saved, they cannot be read back. Each key is stored separately per provider, encrypted with Windows DPAPI in the control database. You can replace or remove a key. Switching AI provider never copies a key over.
AI investigator. These settings are the same as in setup:
| Setting | Default |
|---|---|
| AI provider | CheaperInference |
| Model ID | the provider's default |
| Thinking | the provider's default |
| Enable AI investigation | off |
| Daily token limit | 20,000,000 (minimum 400,000) |
| Let AI contain threats it finds | off |
| Enable public web research | off |
With AI on, open cases of Medium severity or higher are investigated automatically. See AI features for details. Host isolation and permanent deletion always stay with you.
Password¶
Go to Settings › Password & access. Enter the current password and the new one twice (at least 12 characters). Changing the password signs out every browser and CLI session. Sign out of this browser ends only your current session.
The console has no password reset. See Getting started.
Notifications¶
Settings › Notifications controls Windows notifications. The service shows them to the user signed in at the console, through the tray app, even when no console tab is open.
| Setting | Default | Options |
|---|---|---|
| Notify me about new alerts | off | on / off |
| Minimum severity | High | Critical, High, Medium, Low |
- A notification shows only the severity and rule name. Click it to open the alert.
- At most one notification appears every 5 seconds. Alerts arriving during that time are collapsed into one "N new alerts" notification.
- Informational alerts never notify.
- Nothing is sent to a cloud service or another device.
- No notification appears if nobody is signed in at the console (for example, only connected over RDP).
Appearance¶
These settings are stored in the browser (localStorage). They do not affect
the service or other browsers.
| Setting | Default | Options |
|---|---|---|
| Time zone | This device | This device, UTC |
| Time display | Absolute | Absolute, Relative |
| Table density | Comfortable | Comfortable, Compact |
| Rows per page | 50 | 20, 50, 100 |
| Auto-refresh | Off | Off, every minute (Overview and Health) |
Settings API reference¶
The console uses these endpoints. Each one needs a signed-in session, and changes also need the session's CSRF token.
| Endpoint | Methods | Purpose |
|---|---|---|
/api/v1/settings/evidence-lifecycle |
GET, PUT | Retention period |
/api/v1/storage/diagnostics |
GET | Storage sizes and free space |
/api/v1/settings/enrichment |
GET, POST | Provider switches and limits, keys, AI settings |
/api/v1/settings/enrichment/status |
GET | Status of active providers |
/api/v1/settings/enrichment/{provider}/validate |
POST | Provider access check |
/api/v1/settings/sources |
GET | Optional Windows sources and their status |
/api/v1/settings/sources/{source_id} |
POST | Enable / disable / restore / install |
/api/v1/settings/sources/audit |
GET | History of source changes |
/api/v1/settings/alert-notifications |
GET, PUT | Notification preference |
/api/v1/auth/password |
PUT | Change password |