Skip to content
This repository has been archived by the owner on Aug 5, 2024. It is now read-only.

Request: Flatten JSON for easier parsing in 3rd Party SIEM's #9

Open
ion-storm opened this issue Sep 13, 2019 · 1 comment
Open

Request: Flatten JSON for easier parsing in 3rd Party SIEM's #9

ion-storm opened this issue Sep 13, 2019 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@ion-storm
Copy link

If we flatten the JSON, it makes it easier for 3rd party SIEM's to parse the data. See if you can flatten it without having nested json in a clean manner.

@FuzzySecurity
Copy link
Contributor

I'll look into this, one issue I foresee is that the XML event data may contain duplicate elements. That means I will need to add a function which goes through the event and removes those elements. I can do that but I'm not sure what the performance overhead will be if you are collecting from a high volume source. (Maybe I can add a flag to toggle on and off?)

@FuzzySecurity FuzzySecurity self-assigned this Sep 20, 2019
@FuzzySecurity FuzzySecurity added the enhancement New feature or request label Sep 20, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants