GELF output support
chrisforce1 opened this issue · 0 comments
We need to support sending of alerts using GELF over TCP, as per http://docs.graylog.org/en/2.4/pages/gelf.html#. Once we have the data coming into GELF (likely encoding our content within full_message
or using _field1
, _field2
, _fieldn
to communicate threat, severity, flags, and so on) we need to put together a "content pack" which describes the data and how it should be rendered in Graylog, e.g.
https://marketplace.graylog.org/addons/9e13e6bd-5439-48ac-8065-73b24e6ca027
https://github.com/colin-stubbs/graylog-cb-defense/blob/master/content_pack.json
Just FYI, other output formats will later include CEF (IBM ArcSight) and LEEF (IBM QRadar). I'll write these up another time. They are far lower priority than Graylog.