basic ocsf support for stdout

mosajjal · Nov 2, 2024 · cd68360 · cd68360
1 parent 67ee0a6
commit cd68360
Show file tree

Hide file tree

Showing 3 changed files with 402 additions and 1 deletion.
diff --git a/internal/output/stdout.go b/internal/output/stdout.go
@@ -28,7 +28,7 @@ import (
 
 type stdoutConfig struct {
 	StdoutOutputType        uint   `long:"stdoutoutputtype"            ini-name:"stdoutoutputtype"            env:"DNSMONSTER_STDOUTOUTPUTTYPE"            default:"0"                                                       description:"What should be written to stdout. options:\n;\t0: Disable Output\n;\t1: Enable Output without any filters\n;\t2: Enable Output and apply skipdomains logic\n;\t3: Enable Output and apply allowdomains logic\n;\t4: Enable Output and apply both skip and allow domains logic"        choice:"0" choice:"1" choice:"2" choice:"3" choice:"4"`
-	StdoutOutputFormat      string `long:"stdoutoutputformat"          ini-name:"stdoutoutputformat"          env:"DNSMONSTER_STDOUTOUTPUTFORMAT"          default:"json"                                                    description:"Output format for stdout. options:json,csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields"                                                                                                                                             choice:"json" choice:"csv" choice:"csv_no_header" choice:"gotemplate"`
+	StdoutOutputFormat      string `long:"stdoutoutputformat"          ini-name:"stdoutoutputformat"          env:"DNSMONSTER_STDOUTOUTPUTFORMAT"          default:"json"                                                    description:"Output format for stdout. options:json,csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields"                                                                                                                                             choice:"json" choice:"csv" choice:"csv_no_header" choice:"gotemplate" choice:"json-ocsf"`
 	StdoutOutputGoTemplate  string `long:"stdoutoutputgotemplate"      ini-name:"stdoutoutputgotemplate"      env:"DNSMONSTER_STDOUTOUTPUTGOTEMPLATE"      default:"{{.}}"                                                   description:"Go Template to format the output as needed"`
 	StdoutOutputWorkerCount uint   `long:"stdoutoutputworkercount"     ini-name:"stdoutoutputworkercount"     env:"DNSMONSTER_STDOUTOUTPUTWORKERCOUNT"     default:"8"                                                       description:"Number of workers"`
 	outputChannel           chan util.DNSResult

diff --git a/internal/util/functions.go b/internal/util/functions.go
@@ -176,6 +176,8 @@ func OutputFormatToMarshaller(outputFormat string, t string) (OutputMarshaller,
 	switch outputFormat {
 	case "json":
 		return jsonOutput{}, "", nil
+	case "json-ocsf":
+		return OCSFMarshaler{}, "", nil
 	case "csv":
 		csvOut := csvOutput{}
 		header, _ := csvOut.Init()
@@ -193,4 +195,5 @@ func OutputFormatToMarshaller(outputFormat string, t string) (OutputMarshaller,
 	}
 	return nil, "", fmt.Errorf("%s is not a valid output format", outputFormat)
 }
+
 // vim: foldmethod=marker