Configuration
Every on-prem setting — scope, oversight, tools, OT safety, AI models, data, and reporting.
The agent is configured three ways, and most settings are optional with safe defaults:
- In the installer — the common choices (profile, tools, service, oversight, custom instructions, retention, residency, report language).
- In the engagement file —
.neurostrike/engagement.yaml, the scope and rules of a run. Create it withneurostrike-agent initor edit by hand. - As environment variables — operational toggles, set on the service or host.
You rarely need most of these. Set scope and oversight for every engagement; leave the rest at their defaults unless you have a reason to change them.
Rules of engagement
Defined in .neurostrike/engagement.yaml. These are enforced — the agent gates on them.
| Setting | What it does |
|---|---|
engagement | Name of the engagement, as it appears in the agreement |
scope.allow | Hosts / CIDRs in scope — nothing outside is touched |
scope.deny | Hosts / CIDRs never touched, probed, or reported |
limits.max_class | Highest tool class allowed: read_only → low_impact_active → intrusive_active → exploit |
limits.max_breadth | Cap on how wide a single run may spread |
limits.max_egress | Cap on how much data may leave a target |
limits.max_persistence | Cap on persistence actions |
limits.hours | Allowed testing windows — timezone plus windows of days / from / to |
tools.deny | Specific tools to block by name |
supervision | attended (a human oversees) or unattended |
require_target | Refuse to run without an explicit target |
guidance | Free-form instructions for the AI (advisory — see below) |
Oversight & human-in-the-loop
| Setting | Where | What it does |
|---|---|---|
REQUIRE_APPROVAL | env (AI relay) | Hold every proposed command for operator approval on the console |
APPROVAL_MIN_CLASS | env (AI relay) | Lowest class that triggers approval — read_only … exploit, or all. Default intrusive_active; exploit / AI-generated payloads always require it |
supervision | engagement | Record that a human oversees the run (attended) |
Custom instructions — what the AI should, and shouldn't, do
Free-text direction for the AI: focus areas, tone, and things to avoid.
| Setting | Where | What it does |
|---|---|---|
guidance: | engagement file | Advisory instructions, inline |
.neurostrike/instructions.md | file beside the engagement | Free-form house rules in plain text — no YAML to learn |
| Custom instructions | dashboard → New Strike (Adaptive) | A prompt sent with the run, injected as Operator Instructions — e.g. "don't brute-force logins; focus on the API." |
guidance, instructions.md, and the dashboard custom-instructions prompt are advisory — the AI
reads them as context, but they are not gated. A hard "never touch this" must also go in the
exclusions below, which are enforced. Say it in instructions and enforce it in scope.
Exclusions — areas to avoid
| Setting | Where | What it does |
|---|---|---|
scope.deny | engagement file | Hosts / CIDRs the on-prem agent never touches, probes, or reports (enforced) |
ot.zones … posture: excluded | engagement file | OT ranges with no traffic originated toward them at all |
| Out of scope | dashboard → assessment / template | Domains excluded from a relay or cloud assessment |
Internal, loopback, and cloud-metadata addresses are refused by a built-in SSRF guard and are never reachable — that protection is always on and isn't something you configure.
Enrollment & connection
| Setting | What it does |
|---|---|
AGENT_TOKEN | Agent token for relay mode (exchanged for a short-lived JWT) |
RELAY_URL | Relay WebSocket URL (wss://…) |
NEUROSTRIKE_TOKEN_PATH | Where a provisioned token is stored |
NEUROSTRIKE_ACTIVATION_URL | Platform URL used by activate (device flow) |
RELAY_PUBLIC_KEY_B64 | Pin the relay's public key |
ALLOW_INSECURE_RELAY | Allow ws:// — testing only |
NEUROSTRIKE_LICENSE / NEUROSTRIKE_LICENSE_FILE | Air-gapped licence, inline or as a file path |
AI models
| Setting | What it does |
|---|---|
LOCAL_LLM_URL / LOCAL_LLM_BASE_URL | Local reasoning model endpoint (vLLM / OpenAI-compatible) |
LOCAL_LLM_MODEL | Local model name |
LOCAL_LLM_API_KEY | Key for the local model, if it needs one |
OLLAMA_URL | Ollama endpoint for a local model |
ANTHROPIC_API_KEY / GOOGLE_API_KEY | Cloud model keys — only if an organization has opted in to cross-border models |
OT / ICS safety
| Setting | Where | What it does |
|---|---|---|
NEUROSTRIKE_OT_MODE | env | Turn OT safety on |
NEUROSTRIKE_OT_ZONE | env | Default zone posture: passive / active / excluded |
NEUROSTRIKE_OT_ASSET | env | Default asset class: plc, rtu, historian, hmi, … |
NEUROSTRIKE_ASSET_MAP | env | Path to an IP → asset-class map |
ot.default_posture, ot.zones | engagement | Per-CIDR posture, asset class, and vendor validation |
Data, storage & residency
| Setting | Where | What it does |
|---|---|---|
NEUROSTRIKE_DB_PATH | env | SQLite state path (audit chain, findings) |
NEUROSTRIKE_HOST_ROOT | env | Mounted host filesystem to assess (for container deployments) |
NEUROSTRIKE_NUCLEI_TEMPLATES | env | Directory of nuclei templates |
NEUROSTRIKE_CREDENTIAL_MODE | env | Credential-guard (redaction) mode; on by default, off to disable |
data.residency | engagement | Data-residency constraint for the engagement |
data.approved_endpoints | engagement | Outbound endpoints the run may use |
data.retention_days | engagement | How long customer data is kept before certified purge |
Reporting & output
| Setting | What it does |
|---|---|
NEUROSTRIKE_REPORT_LANG | Report language (e.g. en, nb) |
NEUROSTRIKE_MIN_SEVERITY | Minimum severity to include in results |
NEUROSTRIKE_BRAND_ACCENT | Report accent colour (white-label) |
NEUROSTRIKE_OAST_SERVER | Out-of-band interaction (OAST) collector for blind-vuln checks |
A worked example
engagement: "ACME Q1 assessment"
supervision: attended
scope:
allow: [10.20.0.0/16]
deny: [10.20.9.0/24]
limits:
max_class: low_impact_active
hours:
timezone: Europe/Oslo
windows:
- { days: [Sat, Sun], from: "02:00", to: "06:00" }
tools:
deny: [sqlmap]
data:
residency: EEA
retention_days: 30
guidance: >
Focus on the public web tier and the VPN gateway. Prefer verification over breadth.setx NEUROSTRIKE_REPORT_LANG nb /M
setx REQUIRE_APPROVAL true /M
setx APPROVAL_MIN_CLASS intrusive_active /M