Graylog2 / Graylog2/graylog2-server
Add received timestamp (server time) for forensic analysis
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Having a remote copy of logs from a client is useful for forensic analysis since, once a client is compromised, the logs on the client itself cannot be trusted because they may have been modified by the attacker. Log messages sent to the server from before the time of the compromise can be trusted; log messages sent after this time cannot (even if the timestamp in the log messages is before the compromise) because the attacker may have been able to send arbitrary log messages after the compromise.
However, to allow log analysts to take advantage of this, Graylog needs to reliably record the time of receipt of the log message. Currently Graylog does not do this in most configurations because the `timestamp` field is filled in based on the timestamp in the log message (which is generated by the client) when that can be parsed.
An additional field, `gl2_receipt_timestamp`, should be added to each received message; this should be filled in with the current time on the server when the message is received. The client must not be able to override the contents of this field.
Additionally, this field should not be hidden in the UI when listing "fields of the current page (of results)" to make it clear to someone doing log analysis that the `timestamp` field is generally not the time of receipt but was generated by the client. It would also be a good idea not to hide the `gl2_remote_ip` field as well.
## Environment
* Graylog Version: 2.2.3
Contributor guide
Assessment
This issue has not been assessed yet.