Skip to content

Commit 47736eb

Browse files
nicholasberlinnicholasberlin
authored
Preserve auditd.log.record_type (elastic#10829)
* Preserve auditd.log.record_type Rather than renaming `auditd.log.record_type` to `event.action` and silently failing if `event.action` was pre-existing, set `event.action` with a copy of `auditd.log.record_type` if `event.type` is emtpy. This will preserve `auditd.log.record_type` if `event.type` is empty.
1 parent e4d0657 commit 47736eb

File tree

9 files changed

+175
-6
lines changed

9 files changed

+175
-6
lines changed

‎packages/auditd/changelog.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.20.1"
3+
changes:
4+
- description: "Preserve auditd.log.record_type and fallback to auditd.log.SYSCALL"
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/10829
27
- version: "3.20.0"
38
changes:
49
- description: "Allow @custom pipeline access to event.original without setting preserve_original_event."

‎packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-enriched.log

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
type=SOCKADDR msg=audit(1666825569.818:23260118): saddr=02000000000000000000000000000000SADDR={ saddr_fam=inet laddr=0.0.0.0 lport=0 }
22
type=SOCKADDR msg=audit(1666825569.435:23260106): saddr=0A00DE9900000000000000000000000000002a02cf40000000000000SADDR={ saddr_fam=inet6 laddr=2a02:cf40:: lport=56985 }
33
type=SOCKADDR msg=audit(1666825568.865:23260105): saddr=0100SADDR={ saddr_fam=local sockaddr len too short }
4+
node=praorem001 type=SYSCALL msg=audit(1723109482.048:4981103): arch=c000003e syscall=87 success=yes exit=0 a0=7f1118081d10 a1=7f1118081d10 a2=242 a3=180 items=2 ppid=560201 pid=560348 auid=1561577791 uid=2012 gid=2007 euid=2012 suid=2012 fsuid=2012 egid=2007 sgid=2007 fsgid=2007 tty=(none) ses=126 comm="httpd" exe="/app/ogc101/app/dllogc/product/13.5.0/mw_100/ohs/bin/httpd" key="delete"ARCH=x86_64 SYSCALL=unlink AUID="na-uoradbdba03" UID="dllogc" GID="oinstall" EUID="dllogc" SUID="dllogc" FSUID="dllogc" EGID="oinstall" SGID="oinstall" FSGID="oinstall"

‎packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-enriched.log-expected.json

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
"laddr": "0.0.0.0",
88
"lport": 0,
99
"original_field": "saddr",
10+
"record_type": "SOCKADDR",
1011
"saddr": "02000000000000000000000000000000",
1112
"saddr_fam": "inet",
1213
"sequence": 23260118
@@ -31,6 +32,7 @@
3132
"laddr": "2a02:cf40::",
3233
"lport": 56985,
3334
"original_field": "saddr",
35+
"record_type": "SOCKADDR",
3436
"saddr": "0A00DE9900000000000000000000000000002a02cf40000000000000",
3537
"saddr_fam": "inet6",
3638
"sequence": 23260106
@@ -53,6 +55,7 @@
5355
"auditd": {
5456
"log": {
5557
"original_field": "saddr",
58+
"record_type": "SOCKADDR",
5659
"saddr": "0100",
5760
"saddr_fam": "local sockaddr len too short",
5861
"sequence": 23260105
@@ -69,6 +72,92 @@
6972
"tags": [
7073
"preserve_original_event"
7174
]
75+
},
76+
{
77+
"@timestamp": "2024-08-08T09:31:22.048Z",
78+
"auditd": {
79+
"log": {
80+
"AUID": "na-uoradbdba03",
81+
"EGID": "oinstall",
82+
"EUID": "dllogc",
83+
"FSGID": "oinstall",
84+
"FSUID": "dllogc",
85+
"GID": "oinstall",
86+
"SGID": "oinstall",
87+
"SUID": "dllogc",
88+
"SYSCALL": "unlink",
89+
"UID": "dllogc",
90+
"a0": "7f1118081d10",
91+
"a1": "7f1118081d10",
92+
"a2": "242",
93+
"a3": "180",
94+
"items": "2",
95+
"key": "delete\"\u001dARCH=x86_64",
96+
"node": "praorem001",
97+
"record_type": "SYSCALL",
98+
"sequence": 4981103,
99+
"ses": "126",
100+
"success": true,
101+
"syscall": "87",
102+
"tty": "(none)"
103+
}
104+
},
105+
"ecs": {
106+
"version": "8.11.0"
107+
},
108+
"event": {
109+
"action": "syscall",
110+
"category": [
111+
"process"
112+
],
113+
"kind": "event",
114+
"original": "node=praorem001 type=SYSCALL msg=audit(1723109482.048:4981103): arch=c000003e syscall=87 success=yes exit=0 a0=7f1118081d10 a1=7f1118081d10 a2=242 a3=180 items=2 ppid=560201 pid=560348 auid=1561577791 uid=2012 gid=2007 euid=2012 suid=2012 fsuid=2012 egid=2007 sgid=2007 fsgid=2007 tty=(none) ses=126 comm=\"httpd\" exe=\"/app/ogc101/app/dllogc/product/13.5.0/mw_100/ohs/bin/httpd\" key=\"delete\"\u001dARCH=x86_64 SYSCALL=unlink AUID=\"na-uoradbdba03\" UID=\"dllogc\" GID=\"oinstall\" EUID=\"dllogc\" SUID=\"dllogc\" FSUID=\"dllogc\" EGID=\"oinstall\" SGID=\"oinstall\" FSGID=\"oinstall\"",
115+
"type": [
116+
"info"
117+
]
118+
},
119+
"host": {
120+
"architecture": "x86_64"
121+
},
122+
"process": {
123+
"executable": "/app/ogc101/app/dllogc/product/13.5.0/mw_100/ohs/bin/httpd",
124+
"exit_code": 0,
125+
"name": "httpd",
126+
"parent": {
127+
"pid": 560201
128+
},
129+
"pid": 560348
130+
},
131+
"tags": [
132+
"preserve_original_event"
133+
],
134+
"user": {
135+
"audit": {
136+
"id": "1561577791"
137+
},
138+
"effective": {
139+
"group": {
140+
"id": "2007"
141+
},
142+
"id": "2012"
143+
},
144+
"filesystem": {
145+
"group": {
146+
"id": "2007"
147+
},
148+
"id": "2012"
149+
},
150+
"group": {
151+
"id": "2007"
152+
},
153+
"id": "2012",
154+
"saved": {
155+
"group": {
156+
"id": "2007"
157+
},
158+
"id": "2012"
159+
}
160+
}
72161
}
73162
]
74163
}

‎packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"log": {
77
"dst_prefixlen": 16,
88
"op": "SPD-delete",
9+
"record_type": "MAC_IPSEC_EVENT",
910
"sequence": 18877201,
1011
"ses": "4294967295",
1112
"src_prefixlen": 24
@@ -42,6 +43,7 @@
4243
"log": {
4344
"a0": "9",
4445
"items": "0",
46+
"record_type": "SYSCALL",
4547
"sequence": 18877199,
4648
"ses": "4294967295",
4749
"success": true,
@@ -271,6 +273,7 @@
271273
"auditd": {
272274
"log": {
273275
"proctitle": "bash",
276+
"record_type": "PROCTITLE",
274277
"sequence": 194438
275278
}
276279
},
@@ -291,6 +294,7 @@
291294
"auditd": {
292295
"log": {
293296
"proctitle": "sshd: burn [priv]",
297+
"record_type": "PROCTITLE",
294298
"sequence": 194440
295299
}
296300
},
@@ -433,6 +437,7 @@
433437
"@timestamp": "2020-02-10T21:59:44.206Z",
434438
"auditd": {
435439
"log": {
440+
"record_type": "EXECVE",
436441
"sequence": 579393
437442
}
438443
},
@@ -1782,6 +1787,7 @@
17821787
"@timestamp": "2016-12-07T02:20:31.371Z",
17831788
"auditd": {
17841789
"log": {
1790+
"record_type": "CWD",
17851791
"sequence": 479
17861792
}
17871793
},
@@ -1812,6 +1818,7 @@
18121818
"obj": "system_u:object_r:auditctl_exec_t:s0",
18131819
"objtype": "NORMAL",
18141820
"rdev": "00:00",
1821+
"record_type": "PATH",
18151822
"sequence": 479
18161823
}
18171824
},
@@ -1837,7 +1844,9 @@
18371844
},
18381845
{
18391846
"auditd": {
1840-
"log": {}
1847+
"log": {
1848+
"record_type": "UNKNOWN[1329]"
1849+
}
18411850
},
18421851
"ecs": {
18431852
"version": "8.11.0"
@@ -1866,6 +1875,7 @@
18661875
"old_pe": "0000000000000000",
18671876
"old_pi": "0000000000000000",
18681877
"old_pp": "0000000000000000",
1878+
"record_type": "BPRM_FCAPS",
18691879
"sequence": 529
18701880
}
18711881
},
@@ -1885,6 +1895,7 @@
18851895
"@timestamp": "2016-12-07T02:40:24.953Z",
18861896
"auditd": {
18871897
"log": {
1898+
"record_type": "SOCKADDR",
18881899
"saddr": "02000050A9FEA9FE0000000000000000",
18891900
"sequence": 688
18901901
}
@@ -1905,6 +1916,7 @@
19051916
"@timestamp": "2016-12-07T02:42:33.346Z",
19061917
"auditd": {
19071918
"log": {
1919+
"record_type": "CKADDR",
19081920
"saddr": "02000050A9FEA9FE0000000000000000",
19091921
"sequence": 737
19101922
}
@@ -2054,6 +2066,7 @@
20542066
},
20552067
"capability": "3",
20562068
"permissive": "1",
2069+
"record_type": "AVC",
20572070
"scontext": "system_u:system_r:syslogd_t:s0",
20582071
"sequence": 105992,
20592072
"tclass": "capability",
@@ -2088,6 +2101,7 @@
20882101
"dev": "dm-0",
20892102
"ino": "188999",
20902103
"name": "c73a516004b572d8c845c74c49b2511d:runtime.tmp",
2104+
"record_type": "AVC",
20912105
"scontext": "test_u:staff_r:oddjob_mkhomedir_t:s0",
20922106
"sequence": 101,
20932107
"tclass": "lnk_file",
@@ -2168,6 +2182,7 @@
21682182
"dev": "dm-0",
21692183
"ino": "402139",
21702184
"path": "/usr/move_file/move_file_c",
2185+
"record_type": "AVC",
21712186
"scontext": "unconfined_u:unconfined_r:unconfined_t",
21722187
"sequence": 311,
21732188
"tclass": "process",

‎packages/auditd/data_stream/log/_dev/test/pipeline/test-truncated-execve.log-expected.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
"@timestamp": "2022-01-24T12:01:08.518Z",
55
"auditd": {
66
"log": {
7+
"record_type": "EXECVE",
78
"sequence": 5009988
89
}
910
},
@@ -32,6 +33,7 @@
3233
"@timestamp": "2022-01-24T12:01:08.518Z",
3334
"auditd": {
3435
"log": {
36+
"record_type": "EXECVE",
3537
"sequence": 5009988
3638
}
3739
},
@@ -127,6 +129,7 @@
127129
"@timestamp": "2022-01-24T12:01:08.518Z",
128130
"auditd": {
129131
"log": {
132+
"record_type": "EXECVE",
130133
"sequence": 5009988
131134
}
132135
},
@@ -222,6 +225,7 @@
222225
"@timestamp": "2022-02-08T12:31:02.830Z",
223226
"auditd": {
224227
"log": {
228+
"record_type": "EXECVE",
225229
"sequence": 9381969
226230
}
227231
},

‎packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2265,10 +2265,10 @@ processors:
22652265
- append:
22662266
field: error.message
22672267
value: "failed extracting process arguments: {{{ _ingest.on_failure_message }}}"
2268-
- rename:
2269-
ignore_failure: true
2270-
field: auditd.log.record_type
2271-
target_field: event.action
2268+
- set:
2269+
field: event.action
2270+
copy_from: auditd.log.record_type
2271+
override: false
22722272
- lowercase:
22732273
ignore_failure: true
22742274
field: event.action

‎packages/auditd/data_stream/log/fields/fields.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,18 @@
3636
type: keyword
3737
description: |
3838
The first argument to the system call.
39+
- name: a1
40+
type: keyword
41+
description: |
42+
The second argument to the system call.
43+
- name: a2
44+
type: keyword
45+
description: |
46+
The third argument to the system call.
47+
- name: a3
48+
type: keyword
49+
description: |
50+
The fourth argument to the system call.
3951
- name: addr
4052
type: ip
4153
- name: avc.action
@@ -90,6 +102,9 @@
90102
type: keyword
91103
- name: kernel
92104
type: keyword
105+
- name: key
106+
type: keyword
107+
description: Records the user defined string associated with a rule that generated a particular event in the Audit log.
93108
- name: key_enforce
94109
type: boolean
95110
- name: img-ctx
@@ -213,3 +228,28 @@
213228
type: keyword
214229
- name: xdevice
215230
type: keyword
231+
232+
# log_format = ENRICHED fields
233+
- name: ARCH
234+
type: keyword
235+
- name: AUID
236+
type: keyword
237+
- name: EGID
238+
type: keyword
239+
- name: EUID
240+
type: keyword
241+
- name: FSGID
242+
type: keyword
243+
- name: FSUID
244+
type: keyword
245+
- name: GID
246+
type: keyword
247+
- name: SGID
248+
type: keyword
249+
- name: SUID
250+
type: keyword
251+
- name: SYSCALL
252+
type: keyword
253+
- name: UID
254+
type: keyword
255+

‎packages/auditd/docs/README.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,21 @@ An example event for `log` looks as following:
9191
| Field | Description | Type |
9292
|---|---|---|
9393
| @timestamp | Event timestamp. | date |
94+
| auditd.log.ARCH | | keyword |
95+
| auditd.log.AUID | | keyword |
96+
| auditd.log.EGID | | keyword |
97+
| auditd.log.EUID | | keyword |
98+
| auditd.log.FSGID | | keyword |
99+
| auditd.log.FSUID | | keyword |
100+
| auditd.log.GID | | keyword |
101+
| auditd.log.SGID | | keyword |
102+
| auditd.log.SUID | | keyword |
103+
| auditd.log.SYSCALL | | keyword |
104+
| auditd.log.UID | | keyword |
94105
| auditd.log.a0 | The first argument to the system call. | keyword |
106+
| auditd.log.a1 | The second argument to the system call. | keyword |
107+
| auditd.log.a2 | The third argument to the system call. | keyword |
108+
| auditd.log.a3 | The fourth argument to the system call. | keyword |
95109
| auditd.log.addr | | ip |
96110
| auditd.log.audit_failure | | keyword |
97111
| auditd.log.avc.action | | keyword |
@@ -120,6 +134,7 @@ An example event for `log` looks as following:
120134
| auditd.log.item | The item field indicates which item out of the total number of items. This number is zero-based; a value of 0 means it is the first item. | keyword |
121135
| auditd.log.items | The number of items in an event. | keyword |
122136
| auditd.log.kernel | | keyword |
137+
| auditd.log.key | Records the user defined string associated with a rule that generated a particular event in the Audit log. | keyword |
123138
| auditd.log.key_enforce | | boolean |
124139
| auditd.log.kind | | keyword |
125140
| auditd.log.ksize | | long |

‎packages/auditd/manifest.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: auditd
22
title: Auditd Logs
3-
version: "3.20.0"
3+
version: "3.20.1"
44
description: Collect logs from Linux audit daemon with Elastic Agent.
55
type: integration
66
icons:

0 commit comments

Comments
 (0)