Fox Unified Event Format

Abstract

Fox Unified Events were developed as a common denominator to represent the critical information contained in Linux Journals and Windows Event Logs.

Definition

A Fox Unified Event is defined by the following format:

type Event struct {
	Time     time.Time
	Host     string
	User     string
	Message  string
	Severity int
	Sequence string
	Source   string
	Category string
	Service  string
	Fields   map[string]string
}

Annex I: Example Linux Journal

{
  "time": "2022-10-24T00:00:01.009823Z",
  "host": "fedora",
  "message": "Booting Linux on physical CPU 0x0000000000 [0x410fd083]",
  "severity": 4,
  "sequence": "1",
  "source": "journal",
  "category": "kernel",
  "fields": {
    "BootId": "35e8501129134edd9df5267c49f744a4",
    "Hostname": "fedora",
    "MachineId": "46eff2c0526d485fa8103457ae6f7146",
    "Message": "Booting Linux on physical CPU 0x0000000000 [0x410fd083]",
    "Priority": "6",
    "Seq": "1",
    "SourceMonotonicTimestamp": "0",
    "SyslogFacility": "0",
    "SyslogIdentifier": "kernel",
    "Timestamp": "2022-10-24 02:00:01.009823 +0200 CEST",
    "Transport": "kernel"
  }
}

Annex II: Example Windows Event Log

{
  "time": "2014-01-25T04:19:10.5408581Z",
  "host": "37L4247F27-25",
  "message": "Windows is starting up",
  "severity": 10,
  "sequence": "1",
  "source": "eventlog",
  "category": "Security",
  "service": "Microsoft-Windows-Security-Auditing",
  "fields": {
    "Channel": "Security",
    "Computer": "37L4247F27-25",
    "EventID": "4608",
    "EventRecordID": "1",
    "Keywords": "0x8020000000000000",
    "Level": "0",
    "Opcode": "0",
    "ProcessID": "456",
    "Provider": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "SystemTime": "2014-01-25 05:19:10.5408581 +0100 CET",
    "Task": "12288",
    "ThreadID": "460",
    "Version": "0"
  }
}