Add Python module to accomplish OCSF compliant events#159

Merged

AlexRuiz7 merged 35 commits into4.9.0from 156-ocsf-compliant-events

Mar 4, 2024

+1,044-12

Commits on Feb 22, 2024

Adding Python script that receives a continuous json stream over stdin and outputs parquet to Security Lake

f-galland
authored and
AlexRuiz7
committed
Adding logstash pipeline for python script

f-galland
authored and
AlexRuiz7
committed
encode_parquet() function fixed to handle lists of dictionaries

f-galland
authored and
AlexRuiz7
committed
Correct error in encode_parquet()

f-galland
authored and
AlexRuiz7
committed
Avoid storing the block ending in the output buffer

f-galland
authored and
AlexRuiz7
committed
Add comments on handling files and streams with pyarrow for future reference

f-galland
authored and
AlexRuiz7
committed
Add s3 handling reference links

f-galland
authored and
AlexRuiz7
committed
Write parquet directly to bucket

f-galland
authored and
AlexRuiz7
committed
Added basics of map_to_ocsf() function

f-galland
authored and
AlexRuiz7
committed
Minor fixes

f-galland
authored and
AlexRuiz7
committed
Map alerts to OCSF as they are read

f-galland
authored and
AlexRuiz7
committed
Add script to convert Wazuh events to OCSF
AlexRuiz7
committed
Add OCSF converter + Parquet encoder + test scripts
AlexRuiz7
committed
Update .gitignore
AlexRuiz7
committed
Include the contents of the alert under unmapped

f-galland
authored and
AlexRuiz7
committed
Add support for different OCSF schema versions

f-galland
authored and
AlexRuiz7
committed
Use custom ocsf module to map alerts

f-galland
authored and
AlexRuiz7
committed
Modify script to use converter class

f-galland
authored and
AlexRuiz7
committed
Code polish and fix errors

f-galland
authored and
AlexRuiz7
committed
Remove unnecessary type declaration from debug flag

f-galland
authored and
AlexRuiz7
committed
Improved parquet encoding

f-galland
authored and
AlexRuiz7
committed
Initial commit for test env's docker-compose.yml

f-galland
authored and
AlexRuiz7
committed
Remove sudo references from docker-compose.yml

f-galland
authored and
AlexRuiz7
committed
Add operational Python module to transform events to OCSF
AlexRuiz7
committed
Create minimal Docker environment to test and develop the integration.
AlexRuiz7
committed
Fix events-generator's Inventory starvation
AlexRuiz7
committed
Remove files present in #147
AlexRuiz7
committed
Cleanup
AlexRuiz7
committed
Add FQDN hostnames to services for certificates creation
AlexRuiz7
committed

Commits on Mar 1, 2024

Implement OCSF severity normalize function
AlexRuiz7
committed