[Oisf-users] Question on eve.json file
jason.ish at oisf.net
Mon Dec 2 18:53:19 UTC 2019
On 2019-12-01 10:38 p.m., Leonard Jacobs wrote:
> I have noticed that several log items are nested under alert. In
> particular, signature and action are nested under alert. Is there a way
> to not have those log items nested under alert with eve.json file?
No, there is a not way to do this with Suricata. Post-processing tools
like Logstash could likeley be configured to make the transformation though.
Eve is a generic format with mostly generic event parameters at the top
level. Anything event_type specific is placed under the object for that
More information about the Oisf-users