Configuration

Configuration is stored in config/config.yaml (usually copied from config/config.example.yaml).

This page focuses on the configuration you most commonly adjust in real deployments.

Recommended workflow

1

Copy example config

Copy config/config.example.yaml → config/config.yaml

2

Put secrets in environment variables

Put secrets in environment variables, not in YAML

3

Validate the config

Run:

Validate config

miyabi-qualys-ai-triage-pack validate-config --config config/config.yaml

Tip:

• Use miyabi-qualys-ai-triage-pack list-inputs --config config/config.yaml to confirm what will be processed.

app (identity, timezone, language)

• app.name: Display name (used by CLI messages and some integrations)

• app.timezone: Used for time-related formatting/logging behavior

• app.language: Controls report labels and LLM output language (examples: en-US, pt-BR, es, fr, de, ja, ko)

input (where the CSVs are)

• input.input_dir: Directory containing Qualys CSV exports

• input.file_glob: Pattern used to select files (for example *.csv)

• input.encoding: Typically utf-8

• input.delimiter: Typically ,

output (where artifacts are written)

• output.output_dir: Root output folder (default output/)

• output.report_title_prefix: Prefix used in the report title (the environment/file name is appended)

See also:

• Outputs (detailed)

selection (Top X and constraints)

• selection.top_x: Number of vulnerabilities included in the final report

• selection.constraints.diversify_by_host: Encourages diversity across assets/hosts

• selection.constraints.avoid_duplicate_qid: Avoids repeating the same QID when possible

• selection.constraints.max_hosts_per_vuln_in_report: Caps evidence size per vulnerability

limits (performance and size controls)

These controls protect you from extremely large inputs and overly long LLM prompts/outputs:

• limits.max_rows_to_scan: 0 means “no limit” (be careful with huge CSVs)

• limits.max_candidates_for_llm: Candidate cap before LLM selection

• limits.llm_chunk_size: How many candidates are sent per LLM chunk

• limits.llm_text_max_chars: Truncation guardrails for evidence sent to the LLM

• limits.report_section_max_chars, limits.report_results_max_chars, limits.report_ports_max_items: Output-size guards

openai (LLM settings)

Key fields:

• openai.api_key_env_var: Name of the environment variable to read (default: OPENAI_API_KEY)

• openai.api_key: Optional (not recommended). Prefer env var.

• openai.base_url: API base URL (default OpenAI). Can be OpenAI-compatible endpoints.

• openai.model: Model name (example: gpt-4.1-mini)

• openai.temperature, openai.max_output_tokens: Output behavior and size

• Timeouts/retries: request_timeout_s, retries

Security recommendation: Avoid committing API keys into Git. Keep openai.api_key empty and set OPENAI_API_KEY in the runtime environment.

rendering (templates, assets, branding)

• rendering.templates_src_dir: Jinja templates directory (default: templates)

• rendering.assets_src_dir: Static assets directory (default: assets)

• rendering.theme: Visual theme (currently light)

• rendering.branding.enabled: When true, the report header includes a logo

  • logo_filename must exist in the assets folder and is copied into each report’s assets/

notifications (what events are emitted)

• notifications.enabled: Master switch for Slack/Email notifications

• notifications.event_types: Which event types generate notifications (default includes start, end, error, report_ready)

• notifications.include_run_metadata: When enabled, writes run.json into each report directory

• notifications.fail_on_integration_error: When true, integration failures can fail the run

integrations (external systems)

Integrations are disabled by default; enable only what you need.

Common patterns:

• Slack/Email require notifications.enabled: true plus the specific integration enabled.

• OpenSearch “events” publishing uses integrations.opensearch.enabled: true.

• OpenSearch “datasets” require integrations.opensearch.datasets_enabled: true.

• Metabase requires Postgres connectivity and credentials.

See also:

• Integrations

Secret handling (recommended)

Use environment variables for secrets, for example:

• OPENAI_API_KEY

• SLACK_BOT_TOKEN

• SENDGRID_API_KEY

• OPENSEARCH_API_KEY

• SPLUNK_HEC_TOKEN

• METABASE_PG_PASSWORD

Avoid placing tokens/passwords directly in config/config.yaml unless you are in a controlled dev environment and fully understand the risk.