CharlotteN7/dsh-ocsf-forwarder ↗★ 0
dsh-ocsf-forwarder
DSH 的 SIEM 转发器插件，将安全会话活动规范化为 OCSF 格式并输出至 SOC 审计通道。
AI 分析
核心用途是收集并转发 Agent 运行时的安全审计日志。适合需要将 DSH 活动接入企业安全信息和事件管理（SIEM）系统的安全管理员。
安装
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:CharlotteN7/dsh-ocsf-forwarder说明文档
阅读完整 README ↗Configuration
| Key | Default | Meaning |
|---|---|---|
spoolPath | required | Absolute path of the SOC-lane spool. Created 0640, with its parent directories. One process at a time owns a path — see Delivery and failure modes. |
spoolMaxBytes | 268435456 | Rotate to a new generation at this size. |
spoolMaxGenerations | 16 | Rotated generations that may await the shipper. At this count rotation stops and the live file grows past spoolMaxBytes instead. |
spoolMaxTotalBytes | 4294967296 | Second stop condition on rotation: bytes across the live spool and every rotated generation. Not a delete policy — see Delivery and failure modes. |
spoolHighWaterBytes | 3221225472 | Total spool bytes at which the heartbeat is raised to severity_id: 4. Must not exceed spoolMaxTotalBytes, or load fails. |
statsIntervalMs | 300000 | How often the forwarder's counters reach the log and a heartbeat reaches the spool. 0 reports and heartbeats only at unload. |
restricted.path | — | Restricted lane: the same records plus the verbatim payload in raw_data. Created 0600. |
restricted.acknowledged | false | Must be true for the restricted lane to open; the plugin fails at load otherwise. |
otlp.endpoint | — | OTLP collector base URL. /v1/logs is appended when the URL has no path. Absent disables OTLP shipping. |
splunk.endpoint | — | Splunk HEC base URL, typically https://:8088 (Splunk Cloud defaults to 443). /services/collector/event is appended when the URL has no path. |
splunk.token.source / .variable / .value | env / — / — | Where the HEC token comes from. env names an environment variable; literal carries the token in configuration. Missing or empty fails at load. |
splunk.index / host / source / sourcetypePrefix | — / this host / dsh:session / ocsf | HEC event metadata. index is omitted so the token's default index applies. sourcetype is ` |
| :`. | ||
.headers / batchSize / flushIntervalMs / timeoutMs / cursorPath | {} / 256 / 5000 / 10000 / .cursor | Delivery settings, on either shipper block. |
.maxReadBytes / maxBackoffMs / quarantinePath | 8388608 / 300000 / .quarantine | Largest spool region read in one pass, the backoff ceiling, and where refused batches are set aside. |
fleet.tenantUid / labels / tags | — | metadata.tenant_uid, metadata.labels (string list) and metadata.tags (a map, rendered as OCSF key_value_object entries). Never inferred. |
fleet.installUid / installUidPath | generated / .install-uid | device.uid. Minted once and persisted, so a renamed host is still the same device. |
delegationTools | {} | Tool name → provider, for delegation tools registry discovery cannot see. An entry may add a name; it may not un-name a discovered one. |
privacy.argumentValues | digest | omit, digest, or full for tool-argument values. |
privacy.commandLine | digest | digest or full for command lines. |
privacy.url | host | host, sanitized (scheme + host + path), or full. A path carries a reset or invite token as readily as a query string does, so sanitized is a deliberate widening. |
privacy.hmacKey.source | ephemeral | ephemeral (random per process), env (+variable), or literal (+value). Configured keys must be ≥ 32 bytes or load fails. |
seedReplay | full | full, boundary (one marker record), or none. |
dropEventTypes / includeEventTypes | [] | Adjust the drop policy. Dropped by default: assistant/chunk, session/end-seed, session/title, session/title-llm-request, feedback/record, todo/write. |
toolClasses | {} | Classify tools the built-in table does not know. It cannot reclassify a known tool. |
extension.name / extension.placement | dsh / unmapped | Key the extension attributes are stored under, and whether they sit under unmapped or at the top level. Every OCSF class is additionalProperties: false, so attribute produces records that fail validation. |
extension.uid | — | OCSF extension uid, as assigned by the OCSF extension registry. metadata.extensions is omitted until one is configured: there is no free private range, and every unassigned value collides with somebody's. |
vendorName | dsh-security-plugins | metadata.product.vendor_name. |