Date: Sun, 30 Apr 2023 21:34:24 GMT From: Jose Alonso Cardenas Marquez <acm@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 85d2fe169300 - main - textproc/py-evtx2splunk: New port: Evtx to Splunk ingestor Message-ID: <202304302134.33ULYOEr023986@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by acm: URL: https://cgit.FreeBSD.org/ports/commit/?id=85d2fe1693005be69b0b1eea9e7d18134c5bbfa3 commit 85d2fe1693005be69b0b1eea9e7d18134c5bbfa3 Author: Jose Alonso Cardenas Marquez <acm@FreeBSD.org> AuthorDate: 2023-04-30 21:33:08 +0000 Commit: Jose Alonso Cardenas Marquez <acm@FreeBSD.org> CommitDate: 2023-04-30 21:33:08 +0000 textproc/py-evtx2splunk: New port: Evtx to Splunk ingestor Ingest EVTX files into a Splunk instance. This tool is based on the work of : Omer BenAmram Blardy Thanks to Ekto for its contribution. Key features: - Splunk HEC support with token auto-creation - Splunk index auto-creation - Multiprocessing support - Caching for evtx reuse without reconverting - Windows and Linux compatibility - Rely on the great and fast evtx_dump Rust tool of Omer - Evtx message resolutions from database Note: evtx2splunk converts the EVTX to JSON and stores them in a temporary place. Hence, up to the size of source EVTX can be created during the process. These files are removed at the end of the process, except if keep_cache is enabled. --- textproc/Makefile | 1 + textproc/py-evtx2splunk/Makefile | 34 ++++++++++++++++++++++++++++++++++ textproc/py-evtx2splunk/distinfo | 3 +++ textproc/py-evtx2splunk/pkg-descr | 22 ++++++++++++++++++++++ 4 files changed, 60 insertions(+) diff --git a/textproc/Makefile b/textproc/Makefile index 9893cd0fb420..4c302336717a 100644 --- a/textproc/Makefile +++ b/textproc/Makefile @@ -1340,6 +1340,7 @@ SUBDIR += py-enchant SUBDIR += py-enrich SUBDIR += py-et_xmlfile + SUBDIR += py-evtx2splunk SUBDIR += py-extract-msg SUBDIR += py-fastavro SUBDIR += py-feedparser diff --git a/textproc/py-evtx2splunk/Makefile b/textproc/py-evtx2splunk/Makefile new file mode 100644 index 000000000000..fd916b2a396a --- /dev/null +++ b/textproc/py-evtx2splunk/Makefile @@ -0,0 +1,34 @@ +PORTNAME= evtx2splunk +PORTVERSION= 2.0.1 +CATEGORIES= textproc python +PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX} + +MAINTAINER= acm@FreeBSD.org +COMMENT= Evtx to Splunk ingestor +WWW= https://github.com/whikernel/evtx2splunk + +LICENSE= MIT + +RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}certifi>0:security/py-certifi@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}chardet>0:textproc/py-chardet@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}idna>0:dns/py-idna@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}python-dotenv>0:www/py-python-dotenv@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}requests>0:www/py-requests@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}semantic-version>0:devel/py-semantic-version@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}urllib3>0:net/py-urllib3@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}toml>0:textproc/py-toml@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}tqdm>0:misc/py-tqdm@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}splunk-hec>0:textproc/py-splunk-hec@${PY_FLAVOR} \ + fd-find>0:sysutils/fd \ + evtx>0:textproc/evtx + +USE_GITHUB= yes +GH_ACCOUNT= whikernel +GH_TAGNAME= 12bfda6cdd83ae392df9303d0140a2eaa936a62f + +USES= python:3.8+ +USE_PYTHON= autoplist distutils + +NO_ARCH= yes + +.include <bsd.port.mk> diff --git a/textproc/py-evtx2splunk/distinfo b/textproc/py-evtx2splunk/distinfo new file mode 100644 index 000000000000..3ad4744a248e --- /dev/null +++ b/textproc/py-evtx2splunk/distinfo @@ -0,0 +1,3 @@ +TIMESTAMP = 1682884324 +SHA256 (whikernel-evtx2splunk-2.0.1-12bfda6cdd83ae392df9303d0140a2eaa936a62f_GH0.tar.gz) = a203a63d063d004975ac5d928030188501e119bc63dc6f995644f9aa1577a36c +SIZE (whikernel-evtx2splunk-2.0.1-12bfda6cdd83ae392df9303d0140a2eaa936a62f_GH0.tar.gz) = 7116809 diff --git a/textproc/py-evtx2splunk/pkg-descr b/textproc/py-evtx2splunk/pkg-descr new file mode 100644 index 000000000000..805459be1170 --- /dev/null +++ b/textproc/py-evtx2splunk/pkg-descr @@ -0,0 +1,22 @@ +Ingest EVTX files into a Splunk instance. + +This tool is based on the work of : + +Omer BenAmram +Blardy +Thanks to Ekto for its contribution. + +Key features: + +- Splunk HEC support with token auto-creation +- Splunk index auto-creation +- Multiprocessing support +- Caching for evtx reuse without reconverting +- Windows and Linux compatibility +- Rely on the great and fast evtx_dump Rust tool of Omer +- Evtx message resolutions from database + +Note: evtx2splunk converts the EVTX to JSON and stores them in a temporary +place. Hence, up to the size of source EVTX can be created during the process. +These files are removed at the end of the process, except if keep_cache is +enabled.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202304302134.33ULYOEr023986>