Skip to content

GSH v1.3.0 — Real Splunk and Elastic SIEM Output

Choose a tag to compare

View all tags
@sunilgentyala sunilgentyala released this 15 Jul 22:24
· 17 commits to main since this release
v1.3.0
55781ff

What's in this release

  • Real Splunk HTTP Event Collector adapter (adapters/splunk_hec.py) — sends findings to a configured Splunk HEC endpoint over actual HTTP, with the correct {"event", "sourcetype", "source"} payload shape and Authorization: Splunk <token> header.
  • Real Elasticsearch/OpenSearch bulk adapter (adapters/elastic_bulk.py) — sends findings via the _bulk API using correctly-formed NDJSON, with configurable batching (elastic_flush_size / elastic_flush_interval_seconds, defaulting to immediate send).
  • One shared dispatcher (adapters/siem_dispatch.py) wires both adapters into gsh-sentinel-deploy.py (Hunt-001–004) and gsh-mcp-proxy.py (Hunt-005), so both delivery paths share one implementation.
  • A finding is never silently dropped: a failed or unconfigured Splunk/Elastic send now always falls back to local file output. This closes a real gap found while building this — the MCP proxy CLI previously never read siem_output from policy at all, so it silently ignored any SIEM configuration.
  • Secrets support ${ENV_VAR} in policy YAML so HEC tokens / API keys never need to be committed; neither adapter ever logs a secret value, even on failure.
  • New config keys documented in configs/sentinel-policy-default.yaml, with a comment clarifying that the pre-existing nested alerting.siem_output block is still descriptive-only and not read by any script.
  • Closes repo issues #5 and #7.

Verified, not just written

Both adapters are covered by 17 tests (tests/test_siem_adapters.py) against mocked requests.post — payload/header shape, network-failure handling, non-2xx responses, secret redaction. Beyond that, all three delivery paths were run end-to-end against a real local HTTP server before release, not just mocked: gsh-sentinel-deploy.py → Splunk, gsh-sentinel-deploy.py → Elastic, and gsh-mcp-proxy.py → Splunk.

Known limitations

  • Syslog and generic webhook destinations (present in the descriptive alerting.siem_output YAML block) are still not implemented — only stdout, file, splunk, and elastic are real.
  • No Windows Event Log or QRadar output yet.
  • Elastic batching is disabled by default (elastic_flush_size: 1); raising it trades a small window of at-risk findings (lost if the process crashes before a flush) for fewer HTTP requests in high-volume deployments.

Full Changelog

v1.2.0...v1.3.0

Assets 2
Loading