Skip to content

Conversation

@HermessNRJ
Copy link

Hello,

This is already a great project, and it's really interesting for testing and POCs for the AI SIEM part!

Changes

Refactoring

  • Parser mappings externalization: Moved marketplace and product parser mappings from code to parser_mappings.json file
  • Loading from a file: Updated hec_sender.py to load mappings from JSON file instead of hardcoded values

Configuration standardization #23

  • Environment variables: Standardized naming across .env.example / .env copy and docker-compose.yml
  • Documentation: Created comprehensive .env.example with detailed documentation
  • HEC configuration: Added S1_HEC_URL and related batching parameters to docker-compose and environment files

Bug fixes

  • Error handling: Display actual error messages in UI alerts instead of generic errors
  • Logging: Improved verbosity and endpoint handling in hec_sender.py for better debugging

Parser corrections

Moved marketplace and product parser mappings to a new parser_mappings.json file and updated hec_sender.py to load mappings from JSON. Updated environment variable names in .env copy, .env.example, and docker-compose files for consistency. Added S1_HEC_URL and related HEC batching configuration to docker-compose and .env.example. Improved verbosity and endpoint handling in hec_sender.py. Updated several parser config files for AWS VPC DNS, Buildkite, Cloudflare, GCP DNS, Imperva WAF, Teleport, and Zscaler Firewall (change line ending CRLF to LF).
- Display real error messages in UI alerts
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant