Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement log shipping to Graylog via GELF #786

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

bnazare
Copy link

@bnazare bnazare commented Nov 11, 2024

Proposed changes

  • Shipping of logs to Graylog via GELF

Related issues

There are no related issues but this subject has been previously discussed with Linkare within the scope of the OpenCTI implementation for the Centre for Cybersecurity Belgium (https://ccb.belgium.be/).

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality
  • I wrote test cases for the relevant uses case
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

We enabled the new functionality in the configuration of some of the existing test cases. However, there are currently no new assertions being made as that would require the set-up of an entire Graylog infrastructure during tests, which is a much more involved task. Effectively, this means that the new code is being exercised but all log shipping is being shipped to a closed port and any network errors are silently ignored.

@bnazare bnazare force-pushed the feature/log-shipping branch from c74db80 to ea44d04 Compare November 11, 2024 18:34
@bnazare bnazare force-pushed the feature/log-shipping branch from ea44d04 to a29589a Compare November 11, 2024 19:03
@bnazare
Copy link
Author

bnazare commented Nov 11, 2024

This PR is a counterpart to OpenCTI-Platform/opencti#8410.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant