logger container ready

2025-11-17 16:32:41 +01:00
parent 2fe9fa8254
commit a3986b7497
9 changed files with 1109 additions and 1 deletions
@@ -32,6 +32,7 @@
 - [Token Support](#-token-support)
 - [Context Tracking](#-context-tracking)
 - [OPSEC Checking](#️-opsec-checking)
+- [Logging & Syslog](#-logging--syslog)
 - [Development](#development)
 - [Troubleshooting](#troubleshooting)
 - [Credits](#credits)
@@ -1915,6 +1916,63 @@ For more information, see the [Mythic OPSEC Checking documentation](https://docs

 ---

+## 📊 Logging & Syslog
+
+Cazalla includes a complete logging system that records all Mythic events and sends them to a central syslog server.
+
+### Features
+
+- ✅ **Logs ALL events** automatically (callbacks, tasks, responses, credentials, keylogs, files, artifacts, payloads)
+- ✅ **Does not modify the agent** (avoids detections)
+- ✅ **Runs on the server**, not on the target
+- ✅ **Structured JSON format** for easy parsing
+- ✅ **One file per day** (no rotation, all files are kept)
+- ✅ **Simple configuration** via configuration file
+
+### Quick Configuration
+
+1. **Edit the configuration file:**
+   ```bash
+   nano Payload_Type/cazalla/logger/syslog.conf
+   ```
+
+2. **Configure the syslog server IP:**
+   ```bash
+   SYSLOG_SERVER=10.8.20.50  # Host IP or syslog server IP
+   SYSLOG_PORT=514
+   SYSLOG_FACILITY=16
+   ```
+
+3. **Rebuild and restart:**
+   ```bash
+   cd /opt/mythic
+   sudo ./mythic-cli build cazalla
+   sudo ./mythic-cli restart cazalla
+   ```
+
+### Verification
+
+```bash
+# Verify logger is active
+sudo docker logs cazalla | grep -i "syslog\|Logger initialized"
+
+# View logs in real-time
+sudo tail -f /var/log/cazalla.log
+```
+
+### Log Locations
+
+- **Syslog (host)**: `/var/log/cazalla.log`
+- **Local logs (container)**: `/tmp/cazalla_mythic_YYYY-MM-DD.log`
+
+### Complete Documentation
+
+For more details on configuration, troubleshooting, and advanced usage, see:
+- [Logger Documentation](Payload_Type/cazalla/logger/README.md) - Complete technical documentation
+- [Agent Wiki - Logging](documentation-payload/Cazalla/logging.md) - User guide
+
+---
+
 ## 🔧 Development

 ### Project Structure