sophos / Sophos-Central-SIEM-Integration

Simple integration script for 3rd party systems such as SIEMs. Offers command line, file or syslog output in CEF, JSON or key-value pair formats.
121 stars 70 forks source link

null_byte appended by syslog logger not supported in all siem #68

Open BibekShrestha opened 2 years ago

BibekShrestha commented 2 years ago

SyslogHandler Module in python has introduced new variable append_nul which controls whether or not null byte should be appended to syslog message. Since, not all siem vendor support null byte at end of syslog ( especially those that conform to RFC5424), so, an option to control this flag in config would be good feature.

For now, I have made mine work by directly adding logging_handler.append_nul = False after creating SyslogHandler in api_client.py.

See Python12168.