wazuh-splunk icon indicating copy to clipboard operation
wazuh-splunk copied to clipboard

Logtest from the app

Open pablotr9 opened this issue 5 years ago • 3 comments

With the amazing enhancements and capabilities done to the app with version 3.9.0 the experience of creating custom decoders and rules has been greatly improved.

Almost everything can now be done through the web interface while also having the added benefit of syntax and general verification as the files are being edited.

It feels only natural to provide the users with the ability to test log messages as their rules and decoders are being written in that interface, with the possibility of providing even better feedback.

So this issue is to request a tool to test how the ruleset would react to specific log messages. As an enhancement upon the ossec-logtest, it could visually provide an interactive tree of all the rules showing the "path" taken by analysisd and highlighting why each rule and decoder matched (so like ossec-logtest -v but interactive).

The main target of this ticket is to give the user the ability to do not need to log in using SSH into the Wazuh manager instance for testing a sample log.

  • [x] Components
    • [x] Input box for reading the sample log.
    • [x] Button/action element for sending the sample log.
    • [x] Output box for showing the results.
  • [x] Design
    • [x] This feature should be easily accessible from almost every Ruleset section, the user may want to test a log when modifying decoders or after saving a new rule for example.
    • [x] By default it should be hidden.
    • [x] It should not be very intrusive, should work at the same time you are editing or creating a ruleset file. Think about a user with the strategy trial and error, the user would expect to quickly try the sample log multiple times until the ruleset modification is done.
  • [ ] Logic
    • [ ] Connect with an API endpoint.
    • [ ] Handle unexpected results properly.
    • [ ] Limit the input so we don't crash the API or the logtest tool.

pablotr9 avatar Sep 03 '19 13:09 pablotr9

Update Rules tab has been redesigned and Log test directive have been created:

image Peek 2019-09-06 13-10

pablotr9 avatar Sep 06 '19 11:09 pablotr9

Update Updated table design and Logtest directive added to both Decoders and CDB lists tabs Decoders: decoders CDB Lists: cdb lists

pablotr9 avatar Sep 06 '19 13:09 pablotr9

Update The styling has been updated and the output can now be seen in full-screen and we can copy the output of the log test: rules2

pablotr9 avatar Sep 09 '19 14:09 pablotr9