PHP code example of cboxdk / siem

1. Go to this page and download the library: Download cboxdk/siem library. Choose the download type require.

2. Extract the ZIP file and open the index.php.

3. Add this code to the index.php.

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

cboxdk / siem example snippets


use Cbox\Siem\Enums\EventCategory;
use Cbox\Siem\Enums\Outcome;
use Cbox\Siem\Enums\Severity;
use Cbox\Siem\Formatters\CefFormatter;
use Cbox\Siem\ValueObjects\Party;
use Cbox\Siem\ValueObjects\SiemEvent;

$event = new SiemEvent(
    id: 'evt_01HZX',
    occurredAt: new DateTimeImmutable(),
    action: 'user-login',
    category: EventCategory::Authentication,
    outcome: Outcome::Success,
    severity: Severity::Medium,
    actor: new Party('user', '42'),
    sourceIp: '203.0.113.7',
    message: 'User 42 signed in',
    context: ['method' => 'password', 'mfa' => true],
);

echo (new CefFormatter)->format($event);
// CEF:0|Cbox|SIEM|0.1.0|user-login|User 42 signed in|5|rt=... cat=authentication act=user-login ...


use Cbox\Siem\Formatters\EcsFormatter;
use Cbox\Siem\Formatters\SplunkHecFormatter;
use Cbox\Siem\Formatters\GelfFormatter;
use Cbox\Siem\Formatters\JsonFormatter;

(new EcsFormatter)->format($event);        // Elastic Common Schema JSON
(new SplunkHecFormatter)->format($event);  // Splunk HEC envelope
(new GelfFormatter('edge-1'))->format($event); // Graylog GELF 1.1
(new JsonFormatter)->format($event);       // generic single-line NDJSON