-
Notifications
You must be signed in to change notification settings - Fork 305
Firstly. thank you for creating this. its an incredibly powerful tool and we have looked around on the market for something similar but nothing fits our use case.
only issue is the output is missing a couple features that would be incredible.
Would it be possible to add the criticality level to the output csv/JSON (unless this is already there and ive missed it)
Would it be possible to have the file name that it got the events from in the output. ( this is a good to have and not necessary)
All reactions
Replies: 3 comments 7 replies
I am away from my computer this week, but those should be easy enough to add and I don't think anyone would be against them.
From what I remember level (severity) should already be available in the JSON output as is maybe filename.
Either way I can tweak these on the weekend.
All reactions
I remember why we can't show severity with the current CSV output. At the moment rules are grouped per entry so there is no easy way to do this unless we explode the groupings, which would then result in a lot of duplicated data. The issue here is we are hitting the limits of a very basic format, JSON is far more powerful. I could add a levels column that mirrors the size of the rules column using the same ; for delimiting?
Path is very achievable so I have added that:
Screenshot 2023年06月26日 at 17 53 56
All reactions
yeah was a bit hesitant with json as not hugely experienced with it. but spent a bit of time changing bits and yes. it provides so much good data. thank you
having to play around with the data to see what we can do with it. its definitely giving us better quality of information and hunting than before.
might need to be some power bi or something. who knows.
thanks again
All reactions
Ah that is good to hear. Depending on what you want to do I would suggest pumping the data into a database like ElasticSearch, or you can manipulate the data on the command line using something like jq.
All reactions
All reactions
@hippyjm What is your use case if you're permitted/willing to share?
All reactions
Hi, I am assuming that we can't show the tags in the .csv output for the same reasons?
All reactions
I'll need to have a look again to see what we output in the CSV as I don't use Chainsaw day to day. I will try and find some time over the next week.
All reactions
Sure. Thanks. I will have a look as well meanwhile
All reactions
Yep so this is the same problem, because we concatenate the detection names there is no way to add the tags in a non lossy process. It really depends on the use case for the best approach I would say.