jberkers42 / sophos-central-siem-integration Goto Github PK

Cloning issue 8 from source repo

I am attempting to writing parsing rules for a LogRhythm SIEM, however, am faced with the challenge that the data is not in a consistent order when using either the CEF or KeyValue output formats.

Since the parsing rules for several SIEM solutions are order-dependent, is it possible to force either a manual order, or sort the fields in a particular way, prior to outputting them to CEF or KeyValue format?

I understand that the underlying issue stems from the fact that JSON is non-pedantic about field ordering, and flattening the JSON just outputs it in whatever order the JSON data has it. Since this order changes from time to time, this is resulting in what I am seeing.

I have provided some sample logs below in KeyValue format.

UPDATING logs at different times

`2017-07-28T00:05:59.114Z rt="2017-07-28T00:05:59.114Z"; end="2017-07-28T00:05:59.101Z"; severity="low"; duid="duid"; whitelist_properties="{}"; dhost="host-a"; endpoint_type="computer"; endpoint_id="endpoint_id"; suser="user 1"; group="UPDATING"; customer_id="customer_id"; type="Event::Endpoint::UpdateSuccess"; id="id"; name="Update succeeded";

2017-08-06T10:27:42.481Z rt="2017-08-06T10:27:42.481Z"; group="UPDATING"; name="Update succeeded"; whitelist_properties="{}"; dhost="host-b"; endpoint_type="server"; endpoint_id="endpoint_id"; suser="n/a"; end="2017-08-06T10:27:42.474Z"; customer_id="customer_id"; type="Event::Endpoint::UpdateSuccess"; id="id"; severity="low";
`

PERIPHERAL logs at different times

`2017-08-06T23:15:26.039Z rt="2017-08-06T23:15:26.039Z"; end="2017-08-06T23:15:26.039Z"; name="Peripheral allowed: SAMSUNG Mobile USB Modem sophos#2"; duid="duid"; whitelist_properties="{}"; dhost="host-c"; endpoint_type="computer"; endpoint_id="endpoint_id"; suser="user a"; group="PERIPHERALS"; customer_id="customer_id"; type="Event::Endpoint::Device::AlertedOnly"; id="id"; severity="low";

2017-07-27T22:56:41.855Z rt="2017-07-27T22:56:41.855Z"; end="2017-07-27T22:56:41.855Z"; severity="low"; duid="duid"; whitelist_properties="{}"; dhost="host-d"; endpoint_type="computer"; endpoint_id="endpoint_id"; suser="user b"; group="PERIPHERALS"; customer_id="customer_id"; type="Event::Endpoint::Device::AlertedOnly"; id="id"; name="Peripheral allowed: WD My Passport 0730 USB Device";
`