Go Package for ArcSight's Common Event Format
Learning Go, help people who need to generate CEF events in Golang.
$ go get github.com/pcktdmp/cef/cefeventpackage main
import (
"fmt"
"github.com/pcktdmp/cef/cefevent"
)
func main() {
f := make(map[string]string)
f["sourceAddress"] = "127.0.0.1"
f["requestClientApplication"] = "Go-http-client/1.1"
event := cefevent.CefEvent{
Version: "0",
DeviceVendor: "Cool Vendor",
DeviceProduct: "Cool Product",
DeviceVersion: "1.0",
DeviceEventClassId: "FLAKY_EVENT",
Name: "Something flaky happened.",
Severity: "3",
Extensions: f}.Generate()
fmt.Println(event)
}$ ./cef
CEF:0|Cool Vendor|Cool Product|1.0|FLAKY_EVENT|Something flaky happened.|3|sourceAddress=127.0.0.1 requestClientApplication=Go-http-client/1.1- Field limits according to format standard for known CEF fields
- Error handling
- Mandatory header field checking