Custom CSV output

[hippyjm]

Firstly. thank you for creating this. its an incredibly powerful tool and we have looked around on the market for something similar but nothing fits our use case.

only issue is the output is missing a couple features that would be incredible.
Would it be possible to add the criticality level to the output csv/JSON (unless this is already there and ive missed it)

Would it be possible to have the file name that it got the events from in the output. ( this is a good to have and not necessary)

[alexkornitzer]

I am away from my computer this week, but those should be easy enough to add and I don't think anyone would be against them.

From what I remember level (severity) should already be available in the JSON output as is maybe filename.

Either way I can tweak these on the weekend.

[alexkornitzer]

I remember why we can't show severity with the current CSV output. At the moment rules are grouped per entry so there is no easy way to do this unless we explode the groupings, which would then result in a lot of duplicated data. The issue here is we are hitting the limits of a very basic format, JSON is far more powerful. I could add a levels column that mirrors the size of the rules column using the same ; for delimiting?

Path is very achievable so I have added that:

[hippyjm]

yeah was a bit hesitant with json as not hugely experienced with it. but spent a bit of time changing bits and yes. it provides so much good data. thank you
having to play around with the data to see what we can do with it. its definitely giving us better quality of information and hunting than before.
might need to be some power bi or something. who knows.
thanks again

[alexkornitzer]

Ah that is good to hear. Depending on what you want to do I would suggest pumping the data into a database like ElasticSearch, or you can manipulate the data on the command line using something like jq.

[hippyjm]

Hey. Deleted the comment as I was being dumb haha. All good. Power bi is giving sweet reports now. Can't believe there's not any tools for our use case like yours out there that fit as well. Thanks again.

…

________________________________ From: Alex Kornitzer ***@***.***> Sent: Friday, June 30, 2023 10:47:13 AM To: WithSecureLabs/chainsaw ***@***.***> Cc: hippyjm ***@***.***>; Author ***@***.***> Subject: Re: [WithSecureLabs/chainsaw] Custom CSV output (Discussion #136) Ah that is good to hear. Depending on what you want to do I would suggest pumping the data into a database like ElasticSearch, or you can manipulate the data on the command line using something like jq. — Reply to this email directly, view it on GitHub<#136 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BAXJIZMQTCRZQTREIPY5TP3XN2OB7ANCNFSM6AAAAAAZOKY4SY>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[dooooken]

@hippyjm What is your use case if you're permitted/willing to share?

[SoWeBegin]

Hi, I am assuming that we can't show the tags in the .csv output for the same reasons?

[alexkornitzer]

I'll need to have a look again to see what we output in the CSV as I don't use Chainsaw day to day. I will try and find some time over the next week.

[SoWeBegin]

Sure. Thanks. I will have a look as well meanwhile

[alexkornitzer]

Yep so this is the same problem, because we concatenate the detection names there is no way to add the tags in a non lossy process. It really depends on the use case for the best approach I would say.