Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for logging using OCSF #974

Closed
fzipi opened this issue Feb 1, 2024 · 1 comment
Closed

Add support for logging using OCSF #974

fzipi opened this issue Feb 1, 2024 · 1 comment
Labels
enhancement New feature or request

Comments

@fzipi
Copy link
Member

fzipi commented Feb 1, 2024

Summary

The new standard for logging looks way more enticing than the modsecurity logs. Supporting it could bring other players easily, and the attributes for logging could enhance detection.

In particular, the Application Activity Category (6001) looks like would be the one we implement.

References:

Basic example

Motivation

  • Allows better integration with external tools like SIEMs
  • Has a standard logging instead of relying on a solution like modsecurity logs or just JSON
  • Allows to enrich logs even further

Solutions

Probably we can use https://pkg.go.dev/github.com/valllabh/ocsf-schema-golang for this.

@fzipi fzipi added the enhancement New feature or request label Feb 1, 2024
@fzipi
Copy link
Member Author

fzipi commented Sep 17, 2024

This was added in #1089. Thanks to @durg78 for his efforts! 🎉

@fzipi fzipi closed this as completed Sep 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant