Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to feed findings to a local Syslog/Siem systems #95

Open
bararchy opened this issue Sep 15, 2020 · 2 comments
Open

Add option to feed findings to a local Syslog/Siem systems #95

bararchy opened this issue Sep 15, 2020 · 2 comments
Assignees
Labels
Type: enhancement New feature or request.

Comments

@bararchy
Copy link
Member

  • Add tag to CLI which enables feeding "found issues" directly to TCP/UDP syslog server
  • Also add TLS option for TCP
  • The issue data should be converted into 1 of 2 formats: CEF (https://www.npmjs.com/package/cef) and standard syslog When running the command nexploit-cli logfeed you will have more options like:
    • --syslog-host: address to syslog server
    • --port: port of syslog host, default to syslog default
    • --protocol: UDP or TCP/TLS, should default to UDP
    • --format: cef or format-string (i.e {DATE} {SEVERITY} {DETIALS} {LINK}), default to cef
    • --severity-map: cef has severity levels from 0 to 10, we should be able to allow mapping our severity against specified cef numbers, defaults are low=6 medium=8 high=10
  • all the relevant auth parameters
  • The CLI needs to actively pull new findings from nexploit.app via api
  • The back-end should tag which issues have been pulled by the feeder already and the CLI should skip them when polling
@derevnjuk derevnjuk added the Type: enhancement New feature or request. label Sep 15, 2020
@derevnjuk
Copy link
Member

@ArtLinkov should the command log the findings of specific scan or all of them?

@ArtLinkov
Copy link
Contributor

@derevnjuk all of them, I think this should be an organization level service

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: enhancement New feature or request.
Projects
None yet
Development

No branches or pull requests

3 participants