Netstat changes not showing previous output on JSON logs #1180
Description
I'm using OSSEC with JSON logs, and whenever I google OSSEC's netstat changes, I always see log examples followed by the previous netstat output, which makes total sense so we can know exactly what ports were opened/closed.
I'm not seeing that previous output on the JSON logs, is this intended?
{"rule":{"level":7,"comment":"Listened ports status (netstat) changed (new port opened or closed).","sidid":533,"group":"ossec,"},"id":"1499219780.484842","TimeStamp":1499219780000,"decoder":"ossec","location":"(xxx.xxx.xxx.xxx) 10.66.0.12->netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort","full_log":"ossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort':\ntcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN \ntcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN \ntcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN \ntcp 0 0 0.0.0.0:2049 0.0.0.0:* LISTEN \ntcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN \ntcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN \ntcp 0 0 :::111 :::* LISTEN \ntcp 0 0 :::2049 :::* LISTEN \ntcp 0 0 :::22 :::* LISTEN \ntcp 0 0 :::45720 :::* LISTEN \ntcp 0 0 :::54242 :::* LISTEN \ntcp 0 0 :::5666 :::* LISTEN ","hostname":"(xxx.xxx.xxx.xxx) 10.66.0.12->netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort"}