config.example.toml

default_profile = "standard"

[rules]
# Toggle built-in rules on/off globally
# ipv4 = true
# email = true
# mac = false
# private_key = true
# ntlm_hash = true
# ad_domain_user = true
# unc_path = true

[llm]
enabled = false
model = "qwen3.5:9b"
host = "http://localhost:11434"

[custom]
values = ["ACME Corp", "Project Nighthawk"]          # case-sensitive
values_nocase = ["jsmith", "proddb"]                 # case-insensitive, one placeholder across case variants
target_domains = ["contoso.com", "acmecorp.org"]     # case-insensitive bare domain + subdomains
allowlist = ["scanme.nmap.org"]                      # pass through unredacted

[[custom.patterns]]
# Must be valid TOML + valid Python regex; DECON reports config errors cleanly.
name = "internal_domains"
pattern = '[a-z0-9-]+\.corp\.acme\.com'
replacement = "[CUSTOM_HOST_REDACTED_{n:04d}]"

[profiles.client-share]
hostname_internal = true
# custom_values_extra = ["Nighthawk"]

[profiles.internal]
ipv4 = false
mac = false