Skip to content

Commit 15b4f62

Browse files
karenzonemjwolf
karenzone
and
mjwolf
authored
[Auditd Manager] Add docs to support add_session_metadata processor (elastic#10544)
Adds documentation for enabling and configuring the add_session_metadata processor for the Auditd Manager integration. The add_session_metadata processor powers the Session View utility in Elastic Security. --------- Co-authored-by: Michael Wolf <michael.wolf@elastic.co>
1 parent 3ef4bd3 commit 15b4f62

4 files changed

Lines changed: 80 additions & 29 deletions

File tree

‎packages/auditd_manager/_dev/build/docs/README.md‎

Lines changed: 37 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,30 @@ is a part of the Linux kernel.
55

66
This integration is available only for Linux.
77

8+
## Session View powered by Auditd Manager [BETA]
9+
10+
The `add_session_metadata` processor for Auditd Manager powers the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform.
11+
12+
To enable the `add_session_metadata` processor for Auditd Manager:
13+
14+
1. Navigate to the Auditd Manager integration configuration in Kibana.
15+
2. Add the `add_session_metadata` processor configuration under the **Processors** section of Advanced options.
16+
17+
```
18+
- add_session_metadata:
19+
backend: "auto"
20+
```
21+
22+
3. Add these rules to the **Audit Rules** section of the configuration:
23+
24+
```
25+
-a always,exit -F arch=b64 -S execve,execveat -k exec
26+
-a always,exit -F arch=b64 -S exit_group
27+
-a always,exit -F arch=b64 -S setsid
28+
```
29+
30+
Changes are applied automatically, and you do not have to restart the service.
31+
832
## How it works
933

1034
This integration establishes a subscription to the kernel to receive the events
@@ -31,28 +55,27 @@ commands to see if the `auditd` service is running and stop it:
3155

3256
* See if `auditd` is running:
3357

34-
```shell
35-
service auditd status
36-
```
58+
```shell
59+
service auditd status
60+
```
3761

3862
* Stop the `auditd` service:
3963

40-
```shell
41-
service auditd stop
42-
```
64+
```shell
65+
service auditd stop
66+
```
4367

4468
* Disable `auditd` from starting on boot:
4569

46-
```shell
47-
chkconfig auditd off
48-
```
70+
```shell
71+
`chkconfig auditd off`
72+
```
4973

50-
To save CPU usage and disk space, you can use this command to stop `journald`
51-
from listening to audit messages:
74+
* Stop `journald` from listening to audit messages (to save CPU usage and disk space):
5275

53-
```shell
54-
systemctl mask systemd-journald-audit.socket
55-
```
76+
```shell
77+
systemctl mask systemd-journald-audit.socket
78+
```
5679

5780
## Audit rules
5881

‎packages/auditd_manager/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.17.1"
3+
changes:
4+
- description: "Doc: Add doc for configuring Auditd Manager for Session View"
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/issues/10499
27
- version: "1.17.0"
38
changes:
49
- description: "Allow @custom pipeline access to event.original without setting preserve_original_event."

‎packages/auditd_manager/docs/README.md‎

Lines changed: 37 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,30 @@ is a part of the Linux kernel.
55

66
This integration is available only for Linux.
77

8+
## Session View powered by Auditd Manager [BETA]
9+
10+
The `add_session_metadata` processor for Auditd Manager powers the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform.
11+
12+
To enable the `add_session_metadata` processor for Auditd Manager:
13+
14+
1. Navigate to the Auditd Manager integration configuration in Kibana.
15+
2. Add the `add_session_metadata` processor configuration under the **Processors** section of Advanced options.
16+
17+
```
18+
- add_session_metadata:
19+
backend: "auto"
20+
```
21+
22+
3. Add these rules to the **Audit Rules** section of the configuration:
23+
24+
```
25+
-a always,exit -F arch=b64 -S execve,execveat -k exec
26+
-a always,exit -F arch=b64 -S exit_group
27+
-a always,exit -F arch=b64 -S setsid
28+
```
29+
30+
Changes are applied automatically, and you do not have to restart the service.
31+
832
## How it works
933

1034
This integration establishes a subscription to the kernel to receive the events
@@ -31,28 +55,27 @@ commands to see if the `auditd` service is running and stop it:
3155

3256
* See if `auditd` is running:
3357

34-
```shell
35-
service auditd status
36-
```
58+
```shell
59+
service auditd status
60+
```
3761

3862
* Stop the `auditd` service:
3963

40-
```shell
41-
service auditd stop
42-
```
64+
```shell
65+
service auditd stop
66+
```
4367

4468
* Disable `auditd` from starting on boot:
4569

46-
```shell
47-
chkconfig auditd off
48-
```
70+
```shell
71+
`chkconfig auditd off`
72+
```
4973

50-
To save CPU usage and disk space, you can use this command to stop `journald`
51-
from listening to audit messages:
74+
* Stop `journald` from listening to audit messages (to save CPU usage and disk space):
5275

53-
```shell
54-
systemctl mask systemd-journald-audit.socket
55-
```
76+
```shell
77+
systemctl mask systemd-journald-audit.socket
78+
```
5679

5780
## Audit rules
5881

‎packages/auditd_manager/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.0"
22
name: auditd_manager
33
title: "Auditd Manager"
4-
version: "1.17.0"
4+
version: "1.17.1"
55
description: "The Auditd Manager Integration receives audit events from the Linux Audit Framework that is a part of the Linux kernel."
66
type: integration
77
categories:

0 commit comments

Comments
 (0)