alphasoc/nfr

GELF output support

chrisforce1 opened this issue · 0 comments

We need to support sending of alerts using GELF over TCP, as per http://docs.graylog.org/en/2.4/pages/gelf.html#. Once we have the data coming into GELF (likely encoding our content within full_message or using _field1, _field2, _fieldn to communicate threat, severity, flags, and so on) we need to put together a "content pack" which describes the data and how it should be rendered in Graylog, e.g.

https://marketplace.graylog.org/addons/9e13e6bd-5439-48ac-8065-73b24e6ca027
https://github.com/colin-stubbs/graylog-cb-defense/blob/master/content_pack.json

Just FYI, other output formats will later include CEF (IBM ArcSight) and LEEF (IBM QRadar). I'll write these up another time. They are far lower priority than Graylog.