Insufficient Logging from tool

[marinhms]

There is insufficient output from the siem.py script; No timestamps; No warning levels;

In addition, output by default contains sensitive authentication and jwt tokens - if sent to a syslog - thats a possible penetration..

Have workaround; can share

[marinhms]

Have working branch @ https://github.com/marinhms/Sophos-Central-SIEM-Integration/tree/logging_fixes
NO WARRANTY!

Primary changes:

• Removed inconsistent default sys.std** loggers with the python logging…
• If target syslog is TCP and unavailable - FAIL and LOG Criticality
• Log level can be configured in config.ini
• Logs are nicely formatted
• Display/Log of number of events captured
• If DEBUG - display filename and function, otherwise - just display message
• removal of log entries with sensitive infromation (auth, jwt)…
• added (via docker) - push to multiple syslog servers

Example of DEBUG Output:

2022-10-21T02:10:00.675+00:00	INFO	Logging Level is set as: DEBUG
2022-10-21T02:10:00.873+00:00	INFO	api_client.py::get_alerts_or_events()	Config endpoint=/siem/v1/events, filename='sy
2022-10-21T02:10:00.874+00:00	DEBUG	api_client.py::get_tenants_from_sophos()	Fetching the tenants/customers list by ca
2022-10-21T02:10:00.874+00:00	DEBUG	api_client.py::get_sophos_jwt()	fetching access_token from sophos
2022-10-21T02:10:00.874+00:00	DEBUG	api_client.py::get_sophos_jwt()	Found existing jwt token; Reusing
2022-10-21T02:10:00.874+00:00	DEBUG	api_client.py::get_whoami_data()	fetching whoami data
2022-10-21T02:10:00.988+00:00	DEBUG	api_client.py::get_whoami_data()	Whoami response: b'{"id":"xxxx
2022-10-21T02:10:06.995+00:00	DEBUG	api_client.py::call_endpoint()	URL: https://api-us03.central.sophos.com/siem/v1/even
2022-10-21T02:10:07.263+00:00	INFO	api_client.py::make_credentials_request()	No new events data retrieved from the API

Example of INFO Output:

2022-10-21T04:10:06.166+00:00	INFO	Logging Level is set as: INFO
2022-10-21T04:10:06.166+00:00	INFO	Sophos state file not found; Reinitialize Communication; state file=/opt/sophos-siem/state/siem_sophos.json 
2022-10-21T04:10:06.356+00:00	INFO	Config endpoint=/siem/v1/events, filename='syslog', format='cef', address='someip:514', socktype='tcp'
2022-10-21T04:10:06.834+00:00	INFO	No datetime found for events, defaulting to last 12 hours for results
2022-10-21T04:10:07.305+00:00	INFO	Retrieved 46 new events