958346 - CEF log when an action occurs

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: Integration, defect, P3)

Description

[Andy McKay]

There should be seperate CEF events sent to ArcSight for when:
- a key is generated
- a key is requested

Anything naughty happens e.g.:
- some tries to generate a key for an app that already exists

Comment 1

[Kumar McMillan [:kumar]]

there's an endpoint to test the signer here http://apk-signer.readthedocs.org/en/latest/api.html#get--system-cef

Comment 2

[Wesley Dawson [:whd]]

:jeff now that mozdef is up we can begin shipping these events to it. :jason prepared a PR here https://github.com/mozilla-services/puppet-config/pull/389 and once I have AMQP credentials for APK I can set it up.

Comment 3

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

Can't see the pull request for some reason, but sure no reason we can't send this to Mozdef. If the log format itself is CEF instead of json I'll need to re-organize the CEF parsing in Mozdef a bit (usually it happens pre-amqp) but that's no big deal. I'd just have you send to a CEF-specific queue and have my CEF parser work on that, then send it to the json queue.

Unfortunately for timing, I'm on PTO, back on 5/15. If this can't wait I'd have you work with Anthony (averez) who I think you know from firefox accounts work. I've copied him on this, and I'll be checking email/bugmail occasionally anyways.