SilkETW icon indicating copy to clipboard operation
SilkETW copied to clipboard

Request: Flatten JSON for easier parsing in 3rd Party SIEM's

Open ion-storm opened this issue 5 years ago • 1 comments

If we flatten the JSON, it makes it easier for 3rd party SIEM's to parse the data. See if you can flatten it without having nested json in a clean manner.

ion-storm avatar Sep 13 '19 16:09 ion-storm

I'll look into this, one issue I foresee is that the XML event data may contain duplicate elements. That means I will need to add a function which goes through the event and removes those elements. I can do that but I'm not sure what the performance overhead will be if you are collecting from a high volume source. (Maybe I can add a flag to toggle on and off?)

FuzzySecurity avatar Sep 20 '19 08:09 FuzzySecurity