Add json output #120
Add json output #120
Conversation
|
Currently this feature would only work for S1. Before rolling this out we would want this feature parity across all supported EDR products. |
|
changes were added for all product files, however I do not have the capability to test each edr due to access limitations. |
There was a problem hiding this comment.
A couple design questions only added to the S1 product since they are the same across products.
@TreWilkinsRC - just a heads up it looks like this PR is closely related to your work on having Surveyor return raw results
| if self._json: | ||
| self._results[merged_tag] = dict() | ||
| self._results[merged_tag] = events |
There was a problem hiding this comment.
Can the code be configured to use the existing Result class? The type defined for self._results[merged_tag] is a list of Result objects rather than a dictionary
There was a problem hiding this comment.
this is going to be tricky. since the Result class uses specific data fields that won't be filled in when just dumping the raw json response. the response is not parsed when using the --json option and is meant to output the raw data object within the json response. With this method an analyst, could import the raw json into a SIEM or other tool to perform additional analysis.
Add the global option to output results as a json file instead of csv.
Changes applied to surveyor.py and each of the product files.
SentinelOne has been tested and validated to work, I do not have access to test other EDRs. I am also a bit unsure as to how to still categorize outputs with the appropriate tags.
Resolves #90