wazuh-splunk
wazuh-splunk copied to clipboard
Logtest from the app
With the amazing enhancements and capabilities done to the app with version 3.9.0 the experience of creating custom decoders and rules has been greatly improved.
Almost everything can now be done through the web interface while also having the added benefit of syntax and general verification as the files are being edited.
It feels only natural to provide the users with the ability to test log messages as their rules and decoders are being written in that interface, with the possibility of providing even better feedback.
So this issue is to request a tool to test how the ruleset would react to specific log messages. As an enhancement upon the ossec-logtest, it could visually provide an interactive tree of all the rules showing the "path" taken by analysisd and highlighting why each rule and decoder matched (so like ossec-logtest -v
but interactive).
The main target of this ticket is to give the user the ability to do not need to log in using SSH into the Wazuh manager instance for testing a sample log.
- [x] Components
- [x] Input box for reading the sample log.
- [x] Button/action element for sending the sample log.
- [x] Output box for showing the results.
- [x] Design
- [x] This feature should be easily accessible from almost every Ruleset section, the user may want to test a log when modifying decoders or after saving a new rule for example.
- [x] By default it should be hidden.
- [x] It should not be very intrusive, should work at the same time you are editing or creating a ruleset file. Think about a user with the strategy trial and error, the user would expect to quickly try the sample log multiple times until the ruleset modification is done.
- [ ] Logic
- [ ] Connect with an API endpoint.
- [ ] Handle unexpected results properly.
- [ ] Limit the input so we don't crash the API or the logtest tool.
Update Rules tab has been redesigned and Log test directive have been created:
Update
Updated table design and Logtest directive added to both Decoders and CDB lists tabs
Decoders:
CDB Lists:
Update
The styling has been updated and the output can now be seen in full-screen and we can copy the output of the log test: