Skip to content

Releases: henrikrexed/SecurityEventExporter

Release list

v0.1.3

v0.1.3 Latest
Latest

Choose a tag to compare

View all tags
@henrikrexed henrikrexed released this 19 Dec 19:01
v0.1.3
48ed316

OpenTelemetry Security Event Exporter v0.1.3

🎉 Patch Release

This patch release removes specific fields from the JSON payload to streamline the security event format.

✨ Changes

JSON Payload Simplification

  • Removed Fields: The following fields are no longer included in the security event JSON payload:
    • severity - Log severity text
    • severity_number - Log severity number
    • message - Log body/message content
    • source - Source field from default attributes

What's Still Included

The security event payload now includes:

  • timestamp - Event timestamp in RFC3339 format
  • Resource attributes - All resource-level attributes
  • Log record attributes - All log-level attributes
  • trace_id - Trace ID (if available)
  • span_id - Span ID (if available)
  • Other default attributes (except source)

🔧 Example Output

Before (v0.1.2)

{
  "timestamp": "2025-12-19T10:30:00Z",
  "severity": "INFO",
  "severity_number": 9,
  "message": "Security event occurred",
  "source": "opentelemetry-collector",
  "compliance.control": "check-sysctls",
  "k8s.cluster.name": "obs-security-event"
}

After (v0.1.3)

{
  "timestamp": "2025-12-19T10:30:00Z",
  "compliance.control": "check-sysctls",
  "k8s.cluster.name": "obs-security-event"
}

📋 Breaking Changes

⚠️ Breaking Change: The following fields have been removed from the JSON payload:

  • severity
  • severity_number
  • message
  • source

If you have downstream systems that depend on these fields, you will need to update them or handle the missing fields appropriately.

✅ Testing

All existing tests pass:

  • ✅ Configuration validation tests
  • ✅ Exporter functionality tests
  • ✅ Log processing tests
  • ✅ HTTP client tests

📦 Installation

As a Go Module Dependency

go get github.com/henrikrexed/SecurityEventExporter@v0.1.3

Or add directly to your go.mod:

require github.com/henrikrexed/SecurityEventExporter v0.1.3

Using in OCB Manifest

exporters:
  - gomod: github.com/henrikrexed/SecurityEventExporter v0.1.3

Docker Image

docker pull ghcr.io/henrikrexed/securityeventexporter:v0.1.3

📝 Changelog

v0.1.3

  • ✅ Removed severity field from JSON payload
  • ✅ Removed severity_number field from JSON payload
  • ✅ Removed message field (log body) from JSON payload
  • ✅ Filtered out source field from default attributes
  • ✅ All tests passing
  • ✅ Streamlined security event format
Assets 2
Loading

v0.1.2

v0.1.2

Choose a tag to compare

View all tags
@henrikrexed henrikrexed released this 19 Dec 10:58
v0.1.2
fef2fd1

OpenTelemetry Security Event Exporter v0.1.2

🎉 Patch Release

This patch release updates OpenTelemetry dependencies to their latest versions for improved compatibility and bug fixes.

✨ Changes

Dependency Updates

  • OpenTelemetry Collector: Updated from v1.43.0 to v1.47.0
    • Includes latest bug fixes and improvements from the OpenTelemetry Collector
    • Better compatibility with newer collector versions
  • OpenTelemetry SDK/API: Updated to v1.38.0 (latest)
    • Latest stable version of the OpenTelemetry Go SDK
    • Improved performance and stability
  • Zap Logger: Updated from v1.27.0 to v1.27.1
    • Minor bug fixes and improvements

Updated Dependencies

  • go.opentelemetry.io/collector/component v1.43.0 → v1.47.0
  • go.opentelemetry.io/collector/config/configopaque v1.43.0 → v1.47.0
  • go.opentelemetry.io/collector/consumer v1.43.0 → v1.47.0
  • go.opentelemetry.io/collector/exporter v1.43.0 → v1.47.0
  • go.opentelemetry.io/collector/pdata v1.43.0 → v1.47.0
  • go.opentelemetry.io/collector/featuregate v1.43.0 → v1.47.0
  • go.opentelemetry.io/collector/pipeline v1.43.0 → v1.47.0
  • go.opentelemetry.io/collector/internal/telemetry v0.137.0 → v0.141.0
  • go.opentelemetry.io/otel v1.38.0 (already latest)
  • go.opentelemetry.io/otel/sdk v1.38.0 (already latest)
  • go.opentelemetry.io/otel/metric v1.38.0 (already latest)
  • go.opentelemetry.io/otel/trace v1.38.0 (already latest)
  • go.uber.org/zap v1.27.0 → v1.27.1

✅ Testing

All existing tests pass with the updated dependencies:

  • ✅ Configuration validation tests
  • ✅ Exporter functionality tests
  • ✅ Log processing tests
  • ✅ HTTP client tests

📦 Installation

As a Go Module Dependency

go get github.com/henrikrexed/SecurityEventExporter@v0.1.2

Or add directly to your go.mod:

require github.com/henrikrexed/SecurityEventExporter v0.1.2

Using in OCB Manifest

exporters:
  - gomod: github.com/henrikrexed/SecurityEventExporter v0.1.2

Docker Image

docker pull ghcr.io/henrikrexed/securityeventexporter:v0.1.2

📝 Changelog

v0.1.2

  • ✅ Updated OpenTelemetry Collector packages to v1.47.0
  • ✅ Updated OpenTelemetry SDK/API to v1.38.0 (latest)
  • ✅ Updated zap logger to v1.27.1
  • ✅ All tests passing with updated dependencies
  • ✅ Improved compatibility with latest OpenTelemetry Collector versions

🔗 Links

Loading

v0.1.1

v0.1.1

Choose a tag to compare

View all tags
@henrikrexed henrikrexed released this 13 Dec 11:10
v0.1.1
63fa674

OpenTelemetry Security Event Exporter v0.1.1

🎉 Patch Release

This patch release includes important improvements to the JSON output format and conflict detection.

✨ Changes

JSON Output Format

  • Flattened Properties: All properties are now at the root level of the JSON object
    • Removed attributes. prefix from log attributes
    • Removed resource. prefix from resource attributes
    • All properties are now directly accessible at the root level

Conflict Detection

  • Attribute Conflict Detection: Added detection and warning for conflicts between resource and log attributes
    • Warning logs when a log attribute key conflicts with a resource attribute key
    • Log attribute values will overwrite resource attribute values (with warning)
    • New metric: attribute_conflicts counter tracks the number of conflicts detected

Metrics Enhancement

  • Added attribute_conflicts counter to track attribute key conflicts
  • Included in telemetry metrics reporting

🔧 Example Output

Before (v0.1.0)

{
  "attributes.compliance.control": "check-sysctls",
  "resource.k8s.cluster.name": "obs-security-event",
  "message": "validation rule passed",
  "timestamp": "2025-12-12T14:01:24Z"
}

After (v0.1.1)

{
  "compliance.control": "check-sysctls",
  "k8s.cluster.name": "obs-security-event",
  "message": "validation rule passed",
  "timestamp": "2025-12-12T14:01:24Z"
}

📋 Breaking Changes

⚠️ Breaking Change: The JSON output format has changed. Properties that were previously prefixed with attributes. or resource. are now at the root level without prefixes.

If you have downstream systems that depend on the prefixed format, you will need to update them.

🐛 Bug Fixes

  • Fixed JSON structure to have all properties at root level as expected by security event consumers

📦 Installation

As a Go Module Dependency

go get github.com/henrikrexed/SecurityEventExporter@v0.1.1

Or add directly to your go.mod:

require github.com/henrikrexed/SecurityEventExporter v0.1.1

Using in OCB Manifest

exporters:
  - gomod: github.com/henrikrexed/SecurityEventExporter v0.1.1

Docker Image

docker pull ghcr.io/henrikrexed/securityeventexporter:v0.1.1

📝 Changelog

v0.1.1

  • ✅ Flattened JSON output - all properties at root level
  • ✅ Added attribute conflict detection and warnings
  • ✅ Added attribute_conflicts counter metric
  • ✅ Improved logging for conflict scenarios

🔗 Links

Loading

v0.1

v0.1

Choose a tag to compare

View all tags
@henrikrexed henrikrexed released this 19 Nov 15:45
v0.1
c30d51c

Core Functionality

  • Security Event Exporter: Transforms OpenTelemetry logs into structured security events as JSON payloads
  • Event Batching: Efficiently batches multiple events in a single HTTP POST request for optimal performance
  • Telemetry Metrics: Built-in metrics for monitoring:
    • Logs received count
    • Events exported count
    • Events failed count
    • Conversion errors count
    • HTTP requests count and durations
    • HTTP errors count
  • Comprehensive Logging: Debug and error logging enabled via OpenTelemetry telemetry with configurable log levels
  • Production Ready: Includes retry logic, error handling, timeout management, and comprehensive testing

Configuration Options

  • HTTP Endpoint Configuration: Configurable endpoint for security event delivery
  • Custom Headers: Support for API tokens and custom HTTP headers (e.g., Authorization, X-API-Key)
  • Default Attributes: Add default attributes to all security events
  • Timeout Management: Configurable HTTP request timeout (default: 30 seconds)
  • Retry Settings: Configurable retry behavior for failed requests
  • Queue Settings: Configurable queue behavior for batching

Data Transformation

  • Converts OpenTelemetry log records to security event format
  • Preserves resource attributes (prefixed with resource.)
  • Preserves log attributes (prefixed with attributes.)
  • Includes trace and span context when available
  • Includes severity information and timestamps
  • Supports both string and byte message bodies

📚 Documentation

Loading