{
  "watchPaths": [
    "/home/node/.openclaw/workspace/builds/ai-agent-security-firewall"
  ],
  "auditLogPath": "/home/node/.aasf/audit.log",
  "rules": [
    {
      "id": "rule-001",
      "name": "Block SSH Keys",
      "type": "file",
      "action": "block",
      "pattern": "**/.ssh/*",
      "description": "Prevent AI agents from reading SSH private keys"
    },
    {
      "id": "rule-002",
      "name": "Block .env Files",
      "type": "file",
      "action": "flag",
      "pattern": "**/.env*",
      "description": "Flag access to environment files"
    },
    {
      "id": "rule-003",
      "name": "Block Credential Files",
      "type": "file",
      "action": "block",
      "pattern": "**/*.{pem,key,p12,pfx}",
      "description": "Prevent reading of private keys and certificates"
    },
    {
      "id": "rule-004",
      "name": "Flag Suspicious Network",
      "type": "network",
      "action": "flag",
      "pattern": "pastebin.com",
      "description": "Flag connections to paste services"
    },
    {
      "id": "rule-005",
      "name": "Block Untrusted Host",
      "type": "network",
      "action": "block",
      "pattern": "requests.malicious.example.com",
      "description": "Block known malicious domains"
    },
    {
      "id": "rule-006",
      "name": "Flag Process Spawning",
      "type": "process",
      "action": "flag",
      "pattern": "curl|wget|nc|netcat",
      "description": "Flag network tool process spawning"
    }
  ],
  "maxLogSizeMB": 50,
  "enableNetworkMonitoring": true,
  "enableProcessMonitoring": true,
  "blockedHosts": [
    "pastebin.com",
    "termbin.com",
    "requestbin.net"
  ],
  "blockedFilePatterns": [
    "**/.ssh/*",
    "**/.aws/*",
    "**/.config/gcloud/*",
    "**/*.pem",
    "**/*.key"
  ],
  "alertThreshold": 5
}