I am trying to make events with SimData that use the json format. The problem comes when I need to make the "template" for the event in SimData because of all of the double quotes needed for json.
When I try to escape them, SimData never gets rid of them:
Code:
event WebRequest {
required: [flow_id, event_type, src_ip, src_port, dest_ip, dest_port, proto];
//template: "{{_time}} hello world";
template: "{\"timestamp\": {{_time}}, \"flow_id\": {{flow_id}}, \"event_type\": \"{{event_type}}\", \"src_ip\": \"{{src_ip}}\", \"src_port\": \"{{src_port}}\", \"dest_ip\": \"{{dest_ip}}\", \"dest_port\": \"{{dest_port}}\", \"proto\": \"{{proto}}\"}";
source: "simdata";
sourcetype: "suricata";
}
What shows in Splunk:
{\"timestamp\": {{_time}}, \"flow_id\": {{flow_id}}, \"event_type\": \"{{event_type}}\", \"src_ip\": \"{{src_ip}}\", \"src_port\": \"{{src_port}}\", \"dest_ip\": \"{{dest_ip}}\", \"dest_port\": \"{{dest_port}}\", \"proto\": \"{{proto}}\"}
I'm sure that you can see that having \ everywhere is a problem. I honestly think this may be an error on the side of SimData not sanitizing data before sending it off to the HEC because when you print the same event to the console with the 'Text' transport then there are no \" because when printing Java makes sure to take care of that.
Does anyone have a current workaround for this, or am I just crazy and can't figure out how to do this correctly?
Thanks for your time.
... View more