> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/credential-discovery/settings.md). # Settings You can configure `parameters`, `exclusions`, and `matching rules` for the `Credential Discovery` module with the **Credential Discovery Settings** page. The page has two tabs: **General Settings** and **Matching Rules**. ### General Settings You can configure `Max Depth`, `Max File Size`,`Number of Characters Before Match` ,`Number of Characters After Match`,`Extensions`, and `Exclusions` with `General Settings`.

General Settings tab of Credential Discovery Settings — Credential Discovery General Settings

Setting	Description
Max Depth	Specifies the maximum folder depth that the Credential Discovery module will process.
Max File Size - KB	Specifies the maximum size of files that the Credential Discovery module will process.
Extensions	Specifies the file extensions that the Credential Discovery module will process.
Exclusions	Specifies what the Credential Discovery module will not process. Each exclusion has a type: `IP`, `IP CIDR` or `IP Range` exclude machines, and `General` excludes shares and folders with an IP Range, a Share Name Regex and a Folder Path Regex.
Number of Characters Before Match	Specifies the number of characters to include before the matching pattern in the processed data.
Number of Characters After Match	Specifies the number of characters to include after the matching pattern in the processed data.

#### Built-in Exclusions In addition to the exclusions listed on this page, the collector always skips the following folders. These built-in exclusions apply to every share, are not shown on the page and cannot be changed: **.venv:** Python virtual environment directories. These paths contain third-party dependencies and are not relevant for credential discovery. **node\_modules:** Node.js dependency directories. Automatically downloaded packages may cause noise and false positives. **WindowsApps:** System-managed Windows application directories. These paths do not provide meaningful credential exposure findings. **Cortana:** Cortana-related system folders. These directories are not relevant for credential discovery analysis. ### Matching Rules The **Matching Rules** tab lists the rules that decide which files are searched and what counts as a match. Use **New Inclusion** at the bottom of the tab to add a rule and **Save** to store the changes. #### Inclusion Rule Each matching rule is designated as an `Inclusion`. You can create matching rules with `Name`, `Severity`, `Is Active`, `IP Range`, `Folder Path Regex`, `File Name Regex`, and `File Content Regex` parameters. A set of built-in inclusion rules comes preinstalled, for example `Password in Powershell files`. On a built-in rule only **Severity** and **Is Active** can be changed. Its other fields are read-only and it cannot be deleted.

Setting	Description
Name	Name of the matching rule.
Severity	Risk level of matching rule: `Critical`, `High`, `Medium`, `Low` or `Info`.
Is Active	Status of the rule.
IP Range	Specifies the IP range of the machines to be scanned. IP range can be specified in formats such as 10.10.10.10, 8.8.8.0/24, or 6.6.6.20-82. If this field is empty, all machines will be scanned.
Folder Path Regex	Specifies the paths to be scanned based on the regex pattern. If this field is *`.`** all folders will be scanned.
File Name Regex	Specifies the name of the files to be scanned based on the regex pattern. If this field is *`.`** all files will be scanned.
File Content Regex	Specifies the regex pattern used to search for secrets in files. If this field is *`.`** all data will be matched.

#### Exclusion Rule Each matching rule can have multiple `Exclusion Rules` to filter the output. Open **Exclusion Rules (N)** on a rule and use **New Exclusion** to add one. You can create exclusion rules with `Name`, `Is Active`, `IP Range`, `Folder Path Regex`, `File Name Regex`, and `File Content Regex` parameters.

Setting	Description
Name	Name of the exclusion rule.
Is Active	Status of the exclusion rule.
IP Range	Specifies the IP range of the machines to be excluded. IP range can be specified in formats such as 10.10.10.10, 8.8.8.0/24, or 6.6.6.20-82. If this field is empty, the exclusion applies to all machines.
Folder Path Regex	Specifies the paths to be excluded based on the regex pattern. If this field is *`.`** all folders will be excluded.
File Name Regex	Specifies the name of the files to be excluded based on the regex pattern. If this field is *`.`** all files will be excluded.
File Content Regex	Specifies the regex pattern used to exclude content. If this field is *`.`** all data will be excluded.

#### Example This matching rule finds the passwords between `SQLSRV1.forestall.labs` and `SQLSRV100.forestall.labs`. Machines between `SQLSRV15.forestall.labs` and `SQLSRV33.forestall.labs` and matches containing `password=WqkgtnA134j` are excluded from the rule.