Package: cef_logger
CEF LoggerSimple ArcSight logger with full supportCommon Event Format.FeaturesRuntime fields validation of Mandatory and Extensions fields.No need to configure template.Compared with logging handlersA Dynamic fields support.Changing field's values on fly.Custom Extensions fields support.UsageUsage ofcef_loggeris a pretty simple.First of all creating our events."""events.py"""fromdatetimeimportdatetimefromcef_loggerimportEvent# Create a dynamic fieldclassGetCurrentUnixTimestamp:# Generating timestamp on render log messagedef__repr__(self):returnf'{int(datetime.utcnow().timestamp())}'# Creating Base event with mandatory fieldsclassBaseEvent(Event):SYSLOG_HEADER=True# if you need syslog header in messages turn it onVersion=1DeviceProduct="MyProduct"DeviceVersion='1.0'DeviceVendor='MyCompany'DeviceEventClassID='base'Name='base'Severity=1classLoginEvent(BaseEvent):DeviceEventClassID='Login'Name='System Login'severity=9msg='Signed in system'end=GetCurrentUnixTimestamp()classLogouEvent(BaseEvent):DeviceEventClassID='Logout'Name='System Logout'severity=9msg='Signed out system'end=GetCurrentUnixTimestamp()Then attaching them to your arbitrary container."""logger.py"""from.eventsimportLoginEvent,LogoutEventclassArcSightLogger:# attaching eventslogin_event=LoginEvent()logout_event=LogoutEvent()Now we can easy to logging our eventsfrom.loggerimportMyArcSightLoggerMyArcSightLogger.login_event()# 2021-01-26T11:46:26.620649+00:00|Login|9|Выполнен вход в систему|end=1618908511MyArcSightLogger.logout_event()# 2021-01-26T11:46:26.620649+00:00|Logout|9|Выполнен выход из системы|end=1618908525# Change fields on flyMyArcSightLogger.login_event(severity='Medium',msg='Повторный вход в систему')# 2021-01-26T11:46:26.620649+00:00|Login|Medium|Повторный вход в систему|end=1618908543Other casesAdd additional handlersimportlogging.handlersfromcef_loggerimportArcEventclassBaseEvent(ArcEvent):EMITTERS=(*ArcEvent.EMITTERS,logging.handlers.SysLogHandler(address='/dev/log'),)Version=1DeviceProduct="MyProduct"DeviceVersion='1.0'DeviceVendor='MyCompany'DeviceEventClassID='base'Name='base'Severity=1If you want syslog header but use console handlerfromcef_loggerimportArcEventclassBaseEvent(ArcEvent):SYSLOG_HEADER=TrueVersion=1DeviceProduct="MyProduct"DeviceVersion='1.0'DeviceVendor='MyCompany'DeviceEventClassID='base'Name='base'Severity=1base_event=BaseEvent()base_event()# output will be:# 2021-07-22T12:40:36.733389+00:00 127.0.1.1 CEF:1|MyCompany|MyProduct|1.0|base|base|1|Ordering extensionsNotes:Extension and Custom Extension fields can accept None as a value. It's useful when you need order on fly fields.Note that the Custom Extensions will be ordering after Specification Extensionsfromcef_loggerimportEvent# Set mandatory fieldsclassBaseEvent(Event):Version=1DeviceProduct="MyProduct"DeviceVersion='1.0'DeviceVendor='MyCompany'DeviceEventClassID='base'Name='base'Severity=1classNewEvent(BaseEvent):# Specification Extensionssrc='127.0.0.1'# set on fly field (value will be set on call)msg=None# Custom Extensionsmy_field='field'my_new_event=NewEvent()my_new_event(msg='I love python')# output will be:# CEF:1|MyCompany|MyProduct|1.0|base|base|1|src=127.0.0.1 msg=I love python my_field=field