Skip to content

Commit 1844ddc

Browse files
mrodmflexitrev
mrodm
authored and
flexitrev
committed
[auditd_manager] Update fields and sample_event.json (#12541)
Update field definitions to be valid found when elastic-package uses the validation based on mappings. Added the missing field definitions for the SELinux subject properties, used a dynamic template for the arguments to the syscall (previously defined as auditd.data.a0-N) and removed the auditd.data (flattened type).
1 parent c4d4b3f commit 1844ddc

5 files changed

Lines changed: 148 additions & 64 deletions

File tree

‎packages/auditd_manager/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.18.3"
3+
changes:
4+
- description: "Updated field definitions for `auditd.data.*` fields"
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/12541
27
- version: "1.18.2"
38
changes:
49
- description: "Added Session data option"

‎packages/auditd_manager/data_stream/auditd/fields/fields.yml‎

Lines changed: 37 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -623,9 +623,6 @@
623623
- name: auditd.data.perm_mask
624624
description: file permission mask that triggered a watch event
625625
type: keyword
626-
- name: auditd.data.a0-N
627-
description: the arguments to a syscall
628-
type: keyword
629626
- name: auditd.data.ses
630627
description: login session ID
631628
type: keyword
@@ -737,6 +734,40 @@
737734
type: keyword
738735
- name: auditd.data.result
739736
type: keyword
740-
- name: auditd.data
741-
description: Auditd related data
742-
type: flattened
737+
- name: auditd.data.subj_user
738+
type: keyword
739+
description: >
740+
The SELinux user identity. This represents the SELinux user role that is
741+
assigned to the subject (user or process) performing an action. It's part
742+
of the SELinux security context and is used to enforce policies that
743+
restrict what actions a subject can perform.
744+
- name: auditd.data.subj_role
745+
type: keyword
746+
description: >
747+
The SELinux role associated with the subject. The role determines the
748+
capabilities a subject has within a given SELinux policy. Roles are used
749+
to define higher-level security attributes in the context of the system's
750+
security policies.
751+
- name: auditd.data.subj_domain
752+
type: keyword
753+
description: >
754+
The SELinux domain or type assigned to the subject. The domain specifies
755+
the type of resource or process the subject is interacting with, helping
756+
enforce domain-based access controls, which are crucial in limiting resource
757+
access.
758+
- name: auditd.data.subj_level
759+
type: keyword
760+
description: >
761+
The SELinux sensitivity level for the subject. It indicates the security
762+
classification level, like `s0` or `s2`, that defines how data or processes
763+
are handled based on confidentiality and integrity levels within the system.
764+
- name: auditd.data.subj_category
765+
type: keyword
766+
description: >
767+
The SELinux category associated with the subject. It helps further refine
768+
the level of access by classifying subjects into categories for
769+
multi-level security (MLS). Categories are often used to label data
770+
with additional attributes, like "high" or "low," enhancing granularity.
771+
- name: auditd.data.a*
772+
description: the arguments to a syscall
773+
type: keyword

‎packages/auditd_manager/data_stream/auditd/sample_event.json‎

Lines changed: 50 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
{
2-
"@timestamp": "2022-05-12T13:10:13.230Z",
2+
"@timestamp": "2025-01-14T18:00:56.117Z",
33
"agent": {
4-
"ephemeral_id": "cfe4170e-f9b4-435f-b19c-a0e75b573b3a",
5-
"id": "753ce520-4f32-45b1-9212-c4dcc9d575a1",
6-
"name": "custom-agent",
4+
"ephemeral_id": "df24f825-df17-4f54-b3c4-3048edbdf123",
5+
"id": "da084743-3b4d-43eb-a6c9-f26c44204375",
6+
"name": "elastic-agent-90019",
77
"type": "auditbeat",
8-
"version": "8.2.0"
8+
"version": "8.16.0"
99
},
1010
"auditd": {
1111
"data": {
12-
"a0": "a",
13-
"a1": "c00024e8c0",
14-
"a2": "38",
12+
"a0": "10",
13+
"a1": "c001144140",
14+
"a2": "3c",
1515
"a3": "0",
1616
"arch": "x86_64",
17-
"audit_pid": "22501",
17+
"audit_pid": 2532842,
1818
"auid": "unset",
19-
"exit": "56",
19+
"exit": "60",
2020
"old": "0",
2121
"op": "set",
2222
"result": "success",
@@ -25,23 +25,24 @@
2525
"family": "netlink",
2626
"saddr": "100000000000000000000000"
2727
},
28+
"subj_user": "docker-default",
2829
"syscall": "sendto",
2930
"tty": "(none)"
3031
},
3132
"message_type": "config_change",
3233
"messages": [
33-
"type=CONFIG_CHANGE msg=audit(1652361013.230:94471): op=set audit_pid=22501 old=0 auid=4294967295 ses=4294967295 res=1",
34-
"type=SYSCALL msg=audit(1652361013.230:94471): arch=c000003e syscall=44 success=yes exit=56 a0=a a1=c00024e8c0 a2=38 a3=0 items=0 ppid=9509 pid=22501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"auditbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat\" key=(null)",
35-
"type=SOCKADDR msg=audit(1652361013.230:94471): saddr=100000000000000000000000",
36-
"type=PROCTITLE msg=audit(1652361013.230:94471): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D6239613238612F696E7374616C6C2F6175646974626561742D382E322E302D6C696E75782D7838365F36342F617564697462656174002D63006175646974626561742E656C61737469632D6167656E742E796D6C"
34+
"type=CONFIG_CHANGE msg=audit(1736877656.117:1197107): op=set audit_pid=2532842 old=0 auid=4294967295 ses=4294967295 subj=docker-default res=1",
35+
"type=SYSCALL msg=audit(1736877656.117:1197107): arch=c000003e syscall=44 success=yes exit=60 a0=10 a1=c001144140 a2=3c a3=0 items=0 ppid=2531521 pid=2532842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"agentbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-3f07f2/components/agentbeat\" subj=docker-default key=(null)",
36+
"type=SOCKADDR msg=audit(1736877656.117:1197107): saddr=100000000000000000000000",
37+
"type=PROCTITLE msg=audit(1736877656.117:1197107): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D3366303766322F636F6D706F6E656E74732F6167656E746265617400617564697462656174002D450073657475702E696C6D2E656E61626C65643D66616C7365002D450073657475702E74656D706C6174652E65"
3738
],
3839
"result": "success",
3940
"summary": {
4041
"actor": {
4142
"primary": "unset",
4243
"secondary": "root"
4344
},
44-
"how": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat",
45+
"how": "/usr/share/elastic-agent/data/elastic-agent-3f07f2/components/agentbeat",
4546
"object": {
4647
"primary": "set",
4748
"type": "audit-config"
@@ -63,21 +64,24 @@
6364
},
6465
"id": "0",
6566
"name": "root"
67+
},
68+
"selinux": {
69+
"user": "docker-default"
6670
}
6771
}
6872
},
6973
"data_stream": {
7074
"dataset": "auditd_manager.auditd",
71-
"namespace": "ep",
75+
"namespace": "73800",
7276
"type": "logs"
7377
},
7478
"ecs": {
7579
"version": "8.11.0"
7680
},
7781
"elastic_agent": {
78-
"id": "753ce520-4f32-45b1-9212-c4dcc9d575a1",
82+
"id": "da084743-3b4d-43eb-a6c9-f26c44204375",
7983
"snapshot": false,
80-
"version": "8.2.0"
84+
"version": "8.16.0"
8185
},
8286
"event": {
8387
"action": "changed-audit-configuration",
@@ -88,32 +92,50 @@
8892
"network"
8993
],
9094
"dataset": "auditd_manager.auditd",
91-
"ingested": "2022-05-12T13:10:16Z",
95+
"ingested": "2025-01-14T18:00:59Z",
9296
"kind": "event",
9397
"module": "auditd",
94-
"original": "type=CONFIG_CHANGE msg=audit(1652361013.230:94471): op=set audit_pid=22501 old=0 auid=4294967295 ses=4294967295 res=1\ntype=SYSCALL msg=audit(1652361013.230:94471): arch=c000003e syscall=44 success=yes exit=56 a0=a a1=c00024e8c0 a2=38 a3=0 items=0 ppid=9509 pid=22501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"auditbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat\" key=(null)\ntype=SOCKADDR msg=audit(1652361013.230:94471): saddr=100000000000000000000000\ntype=PROCTITLE msg=audit(1652361013.230:94471): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D6239613238612F696E7374616C6C2F6175646974626561742D382E322E302D6C696E75782D7838365F36342F617564697462656174002D63006175646974626561742E656C61737469632D6167656E742E796D6C",
98+
"original": "type=CONFIG_CHANGE msg=audit(1736877656.117:1197107): op=set audit_pid=2532842 old=0 auid=4294967295 ses=4294967295 subj=docker-default res=1\ntype=SYSCALL msg=audit(1736877656.117:1197107): arch=c000003e syscall=44 success=yes exit=60 a0=10 a1=c001144140 a2=3c a3=0 items=0 ppid=2531521 pid=2532842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"agentbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-3f07f2/components/agentbeat\" subj=docker-default key=(null)\ntype=SOCKADDR msg=audit(1736877656.117:1197107): saddr=100000000000000000000000\ntype=PROCTITLE msg=audit(1736877656.117:1197107): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D3366303766322F636F6D706F6E656E74732F6167656E746265617400617564697462656174002D450073657475702E696C6D2E656E61626C65643D66616C7365002D450073657475702E74656D706C6174652E65",
9599
"outcome": "success",
96-
"sequence": 94471,
100+
"sequence": 1197107,
97101
"type": [
98102
"change",
99103
"connection",
100104
"info"
101105
]
102106
},
103107
"host": {
104-
"name": "custom-agent"
108+
"architecture": "x86_64",
109+
"containerized": false,
110+
"hostname": "elastic-agent-90019",
111+
"ip": [
112+
"192.168.176.2",
113+
"192.168.144.5"
114+
],
115+
"mac": [
116+
"02-42-C0-A8-90-05",
117+
"02-42-C0-A8-B0-02"
118+
],
119+
"name": "elastic-agent-90019",
120+
"os": {
121+
"kernel": "6.8.0-51-generic",
122+
"name": "Wolfi",
123+
"platform": "wolfi",
124+
"type": "linux",
125+
"version": "20230201"
126+
}
105127
},
106128
"network": {
107129
"direction": "egress"
108130
},
109131
"process": {
110-
"executable": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat",
111-
"name": "auditbeat",
132+
"executable": "/usr/share/elastic-agent/data/elastic-agent-3f07f2/components/agentbeat",
133+
"name": "agentbeat",
112134
"parent": {
113-
"pid": 9509
135+
"pid": 2531521
114136
},
115-
"pid": 22501,
116-
"title": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat -c auditbeat.elastic-agent.yml"
137+
"pid": 2532842,
138+
"title": "/usr/share/elastic-agent/data/elastic-agent-3f07f2/components/agentbeat auditbeat -E setup.ilm.enabled=false -E setup.template.e"
117139
},
118140
"service": {
119141
"type": "auditd"
@@ -130,4 +152,4 @@
130152
"id": "0",
131153
"name": "root"
132154
}
133-
}
155+
}

0 commit comments

Comments
 (0)