<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hallo all,<br>
<br>
Maybe someone on the IHAP-list has some experience with splunk in
special or syslog and CEF in general and could help us here?<br>
<br>
We want to send intelmq-events to a remote syslog instance for
further processing in CEF or json-format. How could we transform the
data to CEF and maintain parseability. See my email below and the PR
and the discussion there for more details.<br>
This is the PR in question:
<a class="moz-txt-link-freetext" href="https://github.com/certtools/intelmq/pull/503">https://github.com/certtools/intelmq/pull/503</a><br>
<br>
According to this specification[0] I found,<br>
- | should be escaped to \|<br>
- \ should be escaped to \\<br>
- = should be escaped to \= (we don't use that though)<br>
- newlines should be \n (is \\n meant?)<br>
<br>
But we do have arbitrary strings (including \0 and others). It seems
CEF does not allow these values.<br>
<br>
Sebastian<br>
<br>
[0]:
<a class="moz-txt-link-freetext" href="https://kc.mcafee.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/78000/KB78712/en_US/CEF_White_Paper_20100722.pdf">https://kc.mcafee.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/78000/KB78712/en_US/CEF_White_Paper_20100722.pdf</a><br>
<br>
<div class="moz-cite-prefix">On 05/10/2016 11:01 AM, Sebastian
Wagner wrote:<br>
</div>
<blockquote cite="mid:5731A374.3080506@cert.at" type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
Dear developers, contributors, users, etc.<br>
<br>
Pedro Reis (@pedromreis) opened a pull request for an UDP output
bot, which can be used to send events to a syslog daemon (and then
picked up by further processing software).<br>
The implementation has the following features:<br>
<ul>
<li>Output formats are JSON or delimited by a configurable
character</li>
<li>a optional header (at beginning of the line) can be set</li>
<li>`raw` field can be dropped<br>
</li>
</ul>
<p>I can see some potential problems with the 'delimited'-method
here:<br>
</p>
<ul>
<li>Strings can contain the delimiter itself, which breaks
parsing.</li>
<li>Strings can contain arbitrary characters like \0 or \n which
breaks everything</li>
</ul>
<p>Possible solutions could be:<br>
</p>
<ul>
<li>ignore the problem as it's maybe not relevant<br>
</li>
<li>escape all problematic characters (solves problem with \n)<br>
</li>
<li>quote strings (solves problem with delimiters in strings)</li>
<li>strip non-printable characters</li>
<li>drop fields with non-printable characters</li>
<li>encode strings in base64<br>
</li>
</ul>
<br>
As you may have possible applications for this bot or you have
experience with events in syslog, I would appreciate some feedback
from you.<br>
<br>
Sebastian<br>
<br>
<pre class="moz-signature" cols="72">--
// Sebastian Wagner <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:wagner@cert.at"><wagner@cert.at></a> - T: +43 1 50564167201
// CERT Austria - <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.cert.at/">http://www.cert.at/</a>
// Eine Initiative der nic.at GmbH - <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.nic.at/">http://www.nic.at/</a>
// Firmenbuchnummer 172568b, LG Salzburg</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Intelmq-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Intelmq-dev@lists.cert.at">Intelmq-dev@lists.cert.at</a>
<a class="moz-txt-link-freetext" href="http://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev">http://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
// Sebastian Wagner <a class="moz-txt-link-rfc2396E" href="mailto:wagner@cert.at"><wagner@cert.at></a> - T: +43 1 50564167201
// CERT Austria - <a class="moz-txt-link-freetext" href="http://www.cert.at/">http://www.cert.at/</a>
// Eine Initiative der nic.at GmbH - <a class="moz-txt-link-freetext" href="http://www.nic.at/">http://www.nic.at/</a>
// Firmenbuchnummer 172568b, LG Salzburg</pre>
</body>
</html>