feat: ocsf audit logging

.golangci.yml

@@ -19,4 +19,4 @@ issues:
   exclude-rules:
     - path: magefile\.go
       linters:
-        - deadcode
+        - deadcode

coraza.conf-recommended

@@ -161,8 +161,11 @@ SecAuditLogParts ABIJDEFHZ
 #
 SecAuditLogType Serial
 
-# The following settings are not supported by Coraza
+# The format used to write the audit log.
+# Can be one of JSON|JsonLegacy|Native|OCSF
+SecAuditLogFormat Native
 
+# The following settings are not supported by Coraza
 # SecCookieFormat 0
 # SecArgumentSeparator &
 # SecRule MULTIPART_UNMATCHED_BOUNDARY "@eq 1" \

experimental/plugins/plugintypes/auditlog.go

@@ -6,6 +6,7 @@ package plugintypes
 import (
 	"io/fs"
 
+	"github.com/corazawaf/coraza/v3/internal/collections"
 	"github.com/corazawaf/coraza/v3/types"
 )
 
@@ -31,6 +32,7 @@ type AuditLogTransaction interface {
 	Response() AuditLogTransactionResponse
 	HasResponse() bool
 	Producer() AuditLogTransactionProducer
+	HighestSeverity() string // The highest severity of the matched rules for the transaction
 }
 
 // AuditLogTransactionResponse contains response specific information
@@ -61,6 +63,9 @@ type AuditLogTransactionRequest interface {
 	Headers() map[string][]string
 	Body() string
 	Files() []AuditLogTransactionRequestFiles
+	Args() *collections.ConcatKeyed // A string representation of all request agruments in the format 'k=v,'
+	Length() int32
+	UID() string
 }
 
 // AuditLogTransactionRequestFiles contains information for the

go.mod

@@ -14,6 +14,7 @@ go 1.22
 // - aho-corasick
 // - gjson
 // - binaryregexp
+// - ocsf-schema-golang
 
 require (
 	github.com/anuraaga/go-modsecurity v0.0.0-20220824035035-b9a4099778df
@@ -23,6 +24,7 @@ require (
 	github.com/mccutchen/go-httpbin/v2 v2.14.0
 	github.com/petar-dambovaliev/aho-corasick v0.0.0-20240411101913-e07a1f0e8eb4
 	github.com/tidwall/gjson v1.17.3
+	github.com/valllabh/ocsf-schema-golang v1.0.3
 	golang.org/x/net v0.28.0
 	golang.org/x/sync v0.8.0
 	rsc.io/binaryregexp v0.2.0
@@ -35,4 +37,5 @@ require (
 	golang.org/x/mod v0.17.0 // indirect
 	golang.org/x/sys v0.23.0 // indirect
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+	google.golang.org/protobuf v1.34.1 // indirect
 )

go.sum

@@ -4,6 +4,8 @@ github.com/corazawaf/libinjection-go v0.2.1 h1:vNJ7L6c4xkhRgYU6sIO0Tl54TmeCQv/yf
 github.com/corazawaf/libinjection-go v0.2.1/go.mod h1:OP4TM7xdJ2skyXqNX1AN1wN5nNZEmJNuWbNPOItn7aw=
 github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
 github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
 github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/mccutchen/go-httpbin/v2 v2.14.0 h1:9N7GUf8+JunYMFd+yHPIVYApC6KYgqtF0pHIcTGYcVQ=
@@ -21,6 +23,8 @@ github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JT
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
 github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/valllabh/ocsf-schema-golang v1.0.3 h1:eR8k/3jP/OOqB8LRCtdJ4U+vlgd/gk5y3KMXoodrsrw=
+github.com/valllabh/ocsf-schema-golang v1.0.3/go.mod h1:sZ3as9xqm1SSK5feFWIR2CuGeGRhsM7TR1MbpBctzPk=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
@@ -86,5 +90,7 @@ golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
+google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=

internal/auditlog/auditlog.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 
 	"github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes"
+	"github.com/corazawaf/coraza/v3/internal/collections"
 	"github.com/corazawaf/coraza/v3/types"
 )
 
@@ -77,13 +78,14 @@ type Transaction struct {
 	// Client IP Address string representation
 	ClientIP_ string `json:"client_ip"`
 
-	ClientPort_ int                  `json:"client_port"`
-	HostIP_     string               `json:"host_ip"`
-	HostPort_   int                  `json:"host_port"`
-	ServerID_   string               `json:"server_id"`
-	Request_    *TransactionRequest  `json:"request,omitempty"`
-	Response_   *TransactionResponse `json:"response,omitempty"`
-	Producer_   *TransactionProducer `json:"producer,omitempty"`
+	ClientPort_      int                  `json:"client_port"`
+	HostIP_          string               `json:"host_ip"`
+	HostPort_        int                  `json:"host_port"`
+	ServerID_        string               `json:"server_id"`
+	Request_         *TransactionRequest  `json:"request,omitempty"`
+	Response_        *TransactionResponse `json:"response,omitempty"`
+	Producer_        *TransactionProducer `json:"producer,omitempty"`
+	HighestSeverity_ string               `json:"highest_severity"`
 }
 
 var _ plugintypes.AuditLogTransaction = Transaction{}
@@ -140,6 +142,10 @@ func (t Transaction) Producer() plugintypes.AuditLogTransactionProducer {
 	return t.Producer_
 }
 
+func (t Transaction) HighestSeverity() string {
+	return t.HighestSeverity_
+}
+
 // TransactionResponse contains response specific
 // information
 type TransactionResponse struct {
@@ -197,26 +203,50 @@ type TransactionProducer struct {
 var _ plugintypes.AuditLogTransactionProducer = (*TransactionProducer)(nil)
 
 func (tp *TransactionProducer) Connector() string {
+	if tp == nil {
+		return ""
+	}
+
 	return tp.Connector_
 }
 
 func (tp *TransactionProducer) Version() string {
+	if tp == nil {
+		return ""
+	}
+
 	return tp.Version_
 }
 
 func (tp *TransactionProducer) Server() string {
+	if tp == nil {
+		return ""
+	}
+
 	return tp.Server_
 }
 
 func (tp *TransactionProducer) RuleEngine() string {
+	if tp == nil {
+		return ""
+	}
+
 	return tp.RuleEngine_
 }
 
 func (tp *TransactionProducer) Stopwatch() string {
+	if tp == nil {
+		return ""
+	}
+
 	return tp.Stopwatch_
 }
 
 func (tp *TransactionProducer) Rulesets() []string {
+	if tp == nil {
+		return nil
+	}
+
 	return tp.Rulesets_
 }
 
@@ -230,6 +260,9 @@ type TransactionRequest struct {
 	Headers_     map[string][]string                           `json:"headers"`
 	Body_        string                                        `json:"body"`
 	Files_       []plugintypes.AuditLogTransactionRequestFiles `json:"files"`
+	Args_        *collections.ConcatKeyed                      `json:"args"`
+	Length_      int32                                         `json:"length"`
+	Uid_         string                                        `json:"uid"`
 }
 
 var _ plugintypes.AuditLogTransactionRequest = (*TransactionRequest)(nil)
@@ -286,6 +319,28 @@ func (tr *TransactionRequest) Files() []plugintypes.AuditLogTransactionRequestFi
 	return tr.Files_
 }
 
+func (tr *TransactionRequest) Args() *collections.ConcatKeyed {
+	if tr == nil {
+		return &collections.ConcatKeyed{}
+	}
+
+	return tr.Args_
+}
+
+func (tr *TransactionRequest) Length() int32 {
+	if tr == nil {
+		return 0
+	}
+	return tr.Length_
+}
+
+func (tr *TransactionRequest) UID() string {
+	if tr == nil {
+		return ""
+	}
+	return tr.Uid_
+}
+
 // TransactionRequestFiles contains information
 // for the uploaded files using multipart forms
 type TransactionRequestFiles struct {