Thoughts on alignment with the InfoSec App

[00willo]

First, thanks for what you've done. I've been thinking about this myself. I found your repo on an unrelated google search and I'm glad I did.

What are your thoughts of including an objective along the lines of:

• Ships the data from security onion sensors and hosts in a manner that enables the reuse of the InfoSec App.

This will enable a path of bringing taking a POC security onion using it's default stack and then onboarding it into splunk in a CIM compliant way that aligns with the InfoSec app. This not only provides an immediate set of security related dashboard, but also provides a futher path in maturing toward Splunk Enterprise Security.