Skip to content

Commit ae75181

Browse files
opaulohopauloh
committed
reverting session_data toggle
1 parent efe898c commit ae75181

6 files changed

Lines changed: 12 additions & 82 deletions

File tree

‎packages/auditd_manager/_dev/build/docs/README.md‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,11 @@ is a part of the Linux kernel.
55

66
This integration is available only for Linux.
77

8-
## Session View powered by Auditd Manager
8+
## Session View powered by Auditd Manager [BETA]
99

10-
The Auditd Manager is one of the integrations that can power the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform. This feature provides a visual representation of session and process execution data, organized according to the Linux process model to help you investigate process, user, and service activity on your Linux infrastructure.
10+
The `add_session_metadata` processor for Auditd Manager powers the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform.
1111

12-
### Enabling Session Data Capture
13-
14-
There are two ways to enable session data capture for the Session View feature:
15-
16-
#### Method 1: Using the Toggle Switch (Recommended)
17-
18-
1. Navigate to the Auditd Manager integration configuration in Kibana.
19-
2. Locate the "Session data" toggle switch.
20-
3. Turn the switch on to enable session data capture.
21-
22-
#### Method 2: Manual Configuration
12+
To enable the `add_session_metadata` processor for Auditd Manager:
2313

2414
1. Navigate to the Auditd Manager integration configuration in Kibana.
2515
2. Add the `add_session_metadata` processor configuration under the **Processors** section of Advanced options.
@@ -39,13 +29,6 @@ There are two ways to enable session data capture for the Session View feature:
3929

4030
Changes are applied automatically, and you do not have to restart the service.
4131

42-
### Important Notes
43-
44-
- Using the toggle switch (Method 1) automatically applies these configurations, making it the simpler option for most users.
45-
- When enabling session data capture, be aware that it will collect extended process data, which may have privacy and storage implications.
46-
- You can disable session data capture at any time by turning off the toggle switch or removing the manual configurations.
47-
- If you switch between methods or disable the feature, ensure that any conflicting configurations are removed to avoid unexpected behaviour.
48-
4932
## How it works
5033

5134
This integration establishes a subscription to the kernel to receive the events

‎packages/auditd_manager/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.18.1"
3+
changes:
4+
- description: "Reverting Session data option"
5+
type: fix
6+
link: https://github.com/elastic/integrations/issues/11336
27
- version: "1.18.0"
38
changes:
49
- description: "Added Session data option"

‎packages/auditd_manager/data_stream/auditd/agent/stream/auditd.yml.hbs‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,9 @@ socket_type: '{{socket_type}}'
77
immutable: {{immutable}}
88
resolve_ids: {{resolve_ids}}
99
failure_mode: {{failure_mode}}
10-
{{#if session_data}}
11-
audit_rules: "{{escape_multiline_string audit_rules}}
12-
{{escape_multiline_string "
13-
# Session data audit rules
14-
-a always,exit -F arch=b64 -S execve,execveat -k exec
15-
-a always,exit -F arch=b64 -S exit_group
16-
-a always,exit -F arch=b64 -S setsid"}}"
17-
{{else}}
1810
{{#if audit_rules}}
1911
audit_rules: {{escape_string audit_rules}}
2012
{{/if}}
21-
{{/if}}
2213
{{#if audit_rule_files.length}}
2314
audit_rule_files:
2415
{{#each audit_rule_files as |file|}}
@@ -42,12 +33,4 @@ publisher_pipeline.disable_host: true
4233
{{#if processors}}
4334
processors:
4435
{{processors}}
45-
{{#if session_data}}
46-
{{session_data_processors}}
47-
{{/if}}
48-
{{else}}
49-
{{#if session_data}}
50-
processors:
51-
{{session_data_processors}}
52-
{{/if}}
5336
{{/if}}

‎packages/auditd_manager/data_stream/auditd/manifest.yml‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -33,19 +33,6 @@ streams:
3333
3434
If `auto` is selected, `elastic-agent` will attempt to use multicast sockets, falling
3535
back to unicast if multicast is not available.
36-
- name: session_data
37-
type: bool
38-
title: Session data
39-
show_user: true
40-
multi: false
41-
default: false
42-
description: |
43-
Turn this on to capture the extended process data required for Session View.
44-
Session View provides you a visual representation of session and process execution data.
45-
46-
Session View data is organized according to the Linux process model to help you
47-
investigate process, user, and service activity on your Linux infrastructure.
48-
[Learn more](https://www.elastic.co/guide/en/security/current/session-view.html)
4936
- name: immutable
5037
type: bool
5138
title: Immutable
@@ -190,14 +177,3 @@ streams:
190177
description: |
191178
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.
192179
This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
193-
- name: session_data_processors
194-
type: yaml
195-
title: Session data processors
196-
required: false
197-
show_user: false
198-
multi: false
199-
description: |
200-
These processors will be appended to the processors configuration if Session Data is enabled.
201-
default: >2-
202-
- add_session_metadata:
203-
backend: "auto"

‎packages/auditd_manager/docs/README.md‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,11 @@ is a part of the Linux kernel.
55

66
This integration is available only for Linux.
77

8-
## Session View powered by Auditd Manager
8+
## Session View powered by Auditd Manager [BETA]
99

10-
The Auditd Manager is one of the integrations that can power the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform. This feature provides a visual representation of session and process execution data, organized according to the Linux process model to help you investigate process, user, and service activity on your Linux infrastructure.
10+
The `add_session_metadata` processor for Auditd Manager powers the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform.
1111

12-
### Enabling Session Data Capture
13-
14-
There are two ways to enable session data capture for the Session View feature:
15-
16-
#### Method 1: Using the Toggle Switch (Recommended)
17-
18-
1. Navigate to the Auditd Manager integration configuration in Kibana.
19-
2. Locate the "Session data" toggle switch.
20-
3. Turn the switch on to enable session data capture.
21-
22-
#### Method 2: Manual Configuration
12+
To enable the `add_session_metadata` processor for Auditd Manager:
2313

2414
1. Navigate to the Auditd Manager integration configuration in Kibana.
2515
2. Add the `add_session_metadata` processor configuration under the **Processors** section of Advanced options.
@@ -39,13 +29,6 @@ There are two ways to enable session data capture for the Session View feature:
3929

4030
Changes are applied automatically, and you do not have to restart the service.
4131

42-
### Important Notes
43-
44-
- Using the toggle switch (Method 1) automatically applies these configurations, making it the simpler option for most users.
45-
- When enabling session data capture, be aware that it will collect extended process data, which may have privacy and storage implications.
46-
- You can disable session data capture at any time by turning off the toggle switch or removing the manual configurations.
47-
- If you switch between methods or disable the feature, ensure that any conflicting configurations are removed to avoid unexpected behaviour.
48-
4932
## How it works
5033

5134
This integration establishes a subscription to the kernel to receive the events

‎packages/auditd_manager/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.0"
22
name: auditd_manager
33
title: "Auditd Manager"
4-
version: "1.18.0"
4+
version: "1.18.1"
55
description: "The Auditd Manager Integration receives audit events from the Linux Audit Framework that is a part of the Linux kernel."
66
type: integration
77
categories:

0 commit comments

Comments
 (0)