evilsocket / evilsocket/opensnitch

[Feature Request] <Can you add logging to JSON format, please?>

Open
#947 11 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

Hi! Thanks for this great project! Can you add JSON to log formats?
It can be useful for sending logs to SIEM/Elasticsearch etc for machine parsing, while still beeng human readable.

Using Elastic Common Schema and/or Common Event Format fields' names when possible would be great.

For example:
{"ECS.Base.Timestamp":"2023-05-23T13:06:01.704054+03:00", "ECS.Host.Hostname":"firewall", "ECS.Process.Name":"opensnitch", "ECS.Event.Action":"always-deny-incoming-avahi-daemon", "CEFX.DeviceInboundInterface":"eth1", "CEFX.DeviceOutboundInterface":"", "ECS.Source.MAC":"01:00:5e:00:00:fb", "ECS.Destination.MAC":"b6:0b:e5:ed:e3:3c", "MAC_PROTO":"08:00", "ECS.Source.Address":"192.168.3.195", "ECS.Destination.Address":"224.0.0.251", "LEN":"145", "TOS":"0x00", "PREC":"0x00", "TTL":"255", "ECS.Event.ID":"14262", "ip_flags":"", "ECS.Network.Transport":"UDP", "ECS.Source.Port":"5353", "ECS.Destination.Port":"5353", "UDP-LEN":"125"}

### Summary: Please, add logging in JSON format

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.