Use the format your security team already receives
Wildo projects the same security event into structured JSON, CEF, LEEF or OCSF. Customers select the format their collector accepts while retaining a common source for the event’s meaning.
Example — Speak the receiving security tool’s format
Two customers receive the same kind of permission-change event in different encodings. Both can identify its actor, action and severity using their chosen tooling.
For engineers
Set eventFormat on the organization’s SIEM configuration. Its shared vocabulary contains JSON_STRUCTURED, CEF, LEEF and OCSF; the stored values are json_structured, cef, leef and ocsf.
The delivery service selects the formatter from that configuration:
Selected source from siem-webhook-delivery.backend.service.ts:
private _formatBody(envelope: SecurityAuditEventEnvelope, eventFormat: string): string {
switch (eventFormat) {
case SIEMEventFormat.CEF:
return this._formatAsCEF(envelope);
case SIEMEventFormat.LEEF:
return this._formatAsLEEF(envelope);
case SIEMEventFormat.OCSF:
// OCSF is JSON, so there is no escaping/bounding layer here — the projection returns a
// document and the only transport concern is serialisation.
return JSON.stringify(buildOcsfEvent(envelope));
case SIEMEventFormat.JSON_STRUCTURED:
default:
return JSON.stringify(envelope);
}
}
The excerpt is the actual formatting method. Text formats receive their text content type; JSON-native formats receive JSON. Transport authentication and retries operate around the formatted payload.
Map meaning, not just field names
CEF and LEEF projections account for every envelope field, with declared emitted keys and explicit omissions. Dictionaries supply recognized names and value constraints; the formatter handles escaping and bounded text. OCSF uses declared nested targets and derives class/activity identity from the event.
| Format | Integration consideration |
|---|---|
| Structured JSON | Direct envelope fields |
| CEF / LEEF | Flat text fields, escaping and dictionary limits |
| OCSF | Security-event classes and nested structured fields |
A format’s representation can differ even when the source fact is the same. Configure a receiver parser for the selected format and verify the resulting fields with an actual event. Adding a new envelope field requires a projection decision; it should not silently disappear into an unmaintained formatter.