Skip to content

CEF Payload original packet field

Latest
Compare
Choose a tag to compare
@skhademcis skhademcis released this 02 Nov 14:59
· 4 commits to master since this release
6e244e9

Added additional field to the CEF output to represent the original packet data, called packetData. The CEF standard does not have a field defined for the actual payload so the field 'packetData' should be considered when ingesting to a given SIEM solution (Sentinel, etc)

https://learn.microsoft.com/en-us/azure/sentinel/cef-name-mapping

Added archive() feature to the ./encore.sh script, this method will create a compressed version of the estreamer.log file in the following formatted with the system time appended to the archive filename ex.encore-log-10-26_15-42-27+0000UTC.tar.gz .