Spiderfoot is very configurable. In this demonstration, we'll take a look at the
various Spiderfoot settings available in the web interface.
Some of the settings are global and apply across
Spiderfoot in its modules. There is also an important
configurable storage option to consider.
We'll look at how modules are configured, and how to enter API
key information for some of those modules.
These may not seem too interesting or important; however,
as we continue to work with Spiderfoot,
we can enhance our data collection process by enriching are collected data
from other information sources accessible through those APIs. We start here
on the main page in the Spiderfoot web interface. Let's move over to the
Settings tab. On the left side of the page,
there are various modules listed. At the top of the
list, there are Global Settings.
Most of these settings affect how Spiderfoot itself operates or connects to
the Internet. In Storage, there's a single setting for storing information
retrieved. In order to save space, the default setting limits the amount of
data stored in the database to 1 MB.
We can override that value or set it to 0 to store
everything. Unlimited storage will definitely affect our
database size and probably its performance.
The first module here is abuse.ch, which is a malware and botnet tracking
service. Abuse.ch has several threat tracking services available through
Spiderfoot, which can be configured here.
The modules with a lock icon are modules that take either
API keys or some other credentials.
The AbuseIPDB module takes an API key in this field. Modules with the right
API keys or credentials will allow Spiderfoot to gather information that may
be limited to registered users of that service.
Some of these services have free accounts though.
Let's enter an API key and save it. Now the AbuseIPDB
service can be used in future scans.
If we entered our API key information into Spiderfoot,
we can export those keys and credentials from this Spiderfoot instance to a
text file, and then import them into another Spiderfoot instance. That saves us
a lot of time moving to another Spiderfoot system.
We can also edit that file, add in new API keys,
replace existing ones, and import them as needed.
Here's something to consider about APIs. You won't need to go out and
sign up for every service that Spiderfoot supports.
You should consider your information needs and selectively get accounts on
those information sources that provide the details needed.
Finally, if we run into issues that could be caused by configuration problems,
we can reset everything back to the original Spiderfoot configuration
with the Reset to Factory Defaults button. Note that the message
indicates that this will affect any future scans.
Any scan already running will continue to run with those settings that
were in place when the scan started. In the next demo,
we'll focus on controlling Spiderfoot from the command line.