Decode SSH into easier to parse chunks

[alin-strongdm]

Is your feature request related to a problem? Please describe.
When client is importing logs into Splunk for example via LEC with SSH decoding enabled, multiple data chunks come into Splunk gathered into a decodedEvents[].data[] object. It makes it very hard to parse this information and have to click through and expand multiple data fields to find the needed information, like the ssh commands. There's also a lot of unneeded/garbage information that could be removed from this decoded ssh stream to make it cleaner.

Describe the solution you'd like
When exporting the decoded SSH data, format/package it into an easier to ingest format that log aggregators can display better. If possible export the data into individual properties/fields that can be parsed easier. Client is used to ingesting auditd logs which are really easy to read/parse within Splunk in individual fields for each property for example.

Describe alternatives you've considered
N/A

Additional context
Example screenshot:

For more details and a zoom recording of issue explanation, please reach out to Nir.

[camposer]

Thanks for filing an issue for this, we'll review it next week and come back to you.

[camposer]

Hi @alin-strongdm

The current schema for decoded chunk events serves customers that want to identify when a user entered a specific command and when it received certain line. There might be a lot of customers already relying on this schema.

Here's our proposal, please let us know if it would work for you

We'll implement a new feature for allowing customers to get summarized SSH logs.

Here's an example:

Config:
DECODE_CHUNK_EVENTS=true
SUMMARIZE_DECODED_CHUNK_EVENTS=true

Log entry:
{
  decodedEvents: [
    {
      data: "...",
      startTimestamp: "...",
      endTimestamp: "...",
     },
    {
      data: "...",
      startTimestamp: "...",
      endTimestamp: "...",
     },
    {
      data: "...",
      startTimestamp: "...",
      endTimestamp: "...",
     },
    {
      data: "...",
      startTimestamp: "...",
      endTimestamp: "...",
     },
  ],
  summarizedDecodedEvents: {
    data: "...",
    startTimestamp: "...",
    endTimestamp: "...",
   }
}

As you can see above, now you'd have a new flag that can enable to get the summarized decoded chunk events. The flag can be used independently of the DECODE_CHUNK_EVENTS flag.

After the implementation we'd explore a possible implementation using the Splunk plugin.

[alin-strongdm]

Thanks @camposer!
Let me check in with Nir and see if this would resolve the client's issue. I'll get back to you shortly.