Artifact Upload maximum

[dwade5]

Hopefully this is the correct place to ask this question... I am attempting to find the max file size for PCAPs, Zeek logs, and evtx files when uploading artifacts. Only thing I could find was a post from 2020 that said Malcolm has a max size of 20 GB for PCAPs.

[mmguero]

It's currently set to 50 GB. It is a hard-coded value at the moment:

file-upload/php/php.ini
48:upload_max_filesize = 50G

nginx/nginx.conf
131:      client_max_body_size 50G;
142:      client_max_body_size 50G;

file-upload/nginx/sites-available/default
6:    client_max_body_size 50G;

This just applies to the Web UI upload interface. Larger files can be dropped directly into ./pcap/upload