Add support for logging using OCSF

[fzipi]

Summary

The new standard for logging looks way more enticing than the modsecurity logs. Supporting it could bring other players easily, and the attributes for logging could enhance detection.

In particular, the Application Activity Category (6001) looks like would be the one we implement.

References:

• https://schema.ocsf.io/1.1.0/classes/web_resources_activity?extensions=.
• https://github.com/ocsf/ocsf-schema

Basic example

• https://github.com/ocsf/examples/blob/main/mappings/markdown/AWS/WAF/Samples/waf.ocsf

Motivation

• Allows better integration with external tools like SIEMs
• Has a standard logging instead of relying on a solution like modsecurity logs or just JSON
• Allows to enrich logs even further

Solutions

Probably we can use https://pkg.go.dev/github.com/valllabh/ocsf-schema-golang for this.