[Auditd Manager] Add docs to support add_session_metadata processor by karenzone · Pull Request #10544 · elastic/integrations

karenzone · 2024-07-19T21:35:40Z

Adds documentation for enabling and configuring the add_session_metadata processor for the Auditd Manager integration. The add_session_metadata processor powers the Session View utility in Elastic Security.

Related: elastic/beats#40186
Closes: #10499

elasticmachine · 2024-07-22T22:19:56Z

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

karenzone · 2024-07-22T22:24:34Z

Please review and comment so that we can get the content right before we generate the files.

nick-alayil

LGTM

andrewkroh · 2024-07-25T17:47:06Z

+## Session View powered by Auditd Manager [BETA]
+
+The `add_session_metadata` processor for Auditd Manager powers the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform.
+This feature is in Beta at Elastic Security version 8.15.0.


As is, this package is available on all versions of the stack since 8.7.1. Maybe we should not mention any specific stack version here? If there is a minimum Kibana version required for the session view to work with data from this processor then we should bump the Kibana version constraint of the package.

Instead we should indicate what minimum version of Elastic Agent is required to use the processor. We need to make it clear what version of the Agent is required to use this feature because there are no enforced minimum requirements in Fleet.

If there is a minimum Kibana version required for the session view to work with data from this processor then we should bump the Kibana version constraint of the package.

Good suggestion.

Where can we get that info?

Where do we bump the Kibana version contraint?

Good catch @andrewkroh. The Kibana session view plugin support reading data from auditbeat / auditd manager datastreams from 8.14 onwards.

So, if we specify the agent version dependency as 8.14+, it would be better since agents running 8.14 or higher are only compatible with the Elastic stack version 8.14 or above. Is that a correct understanding of your message?

I think 8.15 is the minimum kibana version that enabled auditbeat session view (or it might have gone in with 8.14). I'm not sure what to do for this, it seems strange if we were to change the minimum version here, when this PR is mainly a doc change. Nothing has really changed within this integration to warrant changing the minimum version

@karenzone, to answer your question, the kibana version is set in packages/auditd_manager/manifest.yml, in the conditions.kibana.version field

I removed the version statement, but left the BETA tag in the Session View heading.

andrewkroh · 2024-07-25T17:47:57Z

+To enable the `add_session_metadata` processor for Auditd Manager: 
+
+1. Navigate to the Auditd Manager integration configuration in Kibana.
+2. Add the `add_session_metadata` processor configuration under the advanced options section.


We should show a complete configuration example that can be pasted into the "Processors" section of the advanced options.

I totally agree

Good suggestion. Who can help with that info?

I assume @andrewkroh is referring to the missing backend configuration.

- add_session_metadata: backend: "auto"

I assume @andrewkroh is referring to the missing backend configuration.

- add_session_metadata: backend: "auto"

That's the correct full example, and I agree it should be added too

benironside

LGTM!

karenzone · 2024-08-15T22:41:05Z

+- version: "1.16.5"
+  changes:
+    - description: Doc: Add doc for configuring Auditd Manager for Session View
+      type: enhancement
+      link: https://github.com/elastic/integrations/issues/10499


While this work has been in progress, we've bumped to 1.17.0.
Does this work become 1.17.1?

karenzone · 2024-08-15T22:41:58Z

 name: auditd_manager
 title: "Auditd Manager"
-version: "1.16.4"
+version: "1.16.5"


ToDo: Resolve conflicts and bump version. Does this become 1.17.1?

karenzone · 2024-08-15T22:45:00Z

Next up

Review and signoff.
Please review and approve when appropriate.
Resolve conflicts in changelog and manifest.
Does this update become 1.17.1?
Generate and update package.
Pass buildkite checks and merge.

karenzone · 2024-08-20T20:58:08Z

The content should be correct. We need to decide how to handle versioning, resolve conflicts in the changelog and manifest, and get past buildkite. @mjwolf, will you or somebody on your team please help get one over the finish line?

mjwolf · 2024-08-20T22:22:16Z

The content should be correct. We need to decide how to handle versioning, resolve conflicts in the changelog and manifest, and get past buildkite. @mjwolf, will you or somebody on your team please help get one over the finish line?

I can work on getting this to build correctly, do you want me to merge it as soon as it's working?

elastic-sonarqube · 2024-08-20T23:23:49Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2024-08-20T23:23:51Z

💚 Build Succeeded

Buildkite Build
Commit: e2ba680

History

💔 Build #14811 failed f708753
💔 Build #14708 failed 5ed3a63
💔 Build #14021 failed 24dc04c
💔 Build #13948 failed 0536b4c
💔 Build #13882 failed c7105e4

cc @karenzone

karenzone · 2024-08-21T14:10:52Z

I can work on getting this to build correctly, do you want me to merge it as soon as it's working?

Yes, please @mjwolf! Let's get this info out to users as soon as possible.
Thank you so much for your help on this. ❤️

karenzone · 2024-08-21T15:42:14Z

@mjwolf, thank you SO MUCH for your work on the feature and the docs for this.
@nick-alayil, thank you for the nice explanation in the issue. That info was particularly helpful in framing up docs.
Thank you to @andrewkroh and other reviewers who contributed.

nick-alayil · 2024-08-21T15:56:26Z

Thank you @karenzone for your hard work in getting the documentation done, especially given the complexity of the system. I really appreciate the time and effort you put into it.

Thanks to @mjwolf for your great work on the feature and docs, and to @andrewkroh and all the reviewers who contributed. This was truly a team effort, and I’m grateful to everyone involved!

…lastic#10544) Adds documentation for enabling and configuring the add_session_metadata processor for the Auditd Manager integration. The add_session_metadata processor powers the Session View utility in Elastic Security. --------- Co-authored-by: Michael Wolf <michael.wolf@elastic.co>

[Auditd Manager] Add docs to support add_session_metadata processor

f20d807

karenzone added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request docs labels Jul 19, 2024

karenzone self-assigned this Jul 19, 2024

andrewkroh added Team:Security-Linux Platform Linux Platform Security team [elastic/sec-linux-platform] Integration:auditd_manager Auditd Manager labels Jul 19, 2024

mjwolf reviewed Jul 22, 2024

View reviewed changes

Comment thread packages/auditd_manager/_dev/build/docs/README.md Outdated

karenzone commented Jul 22, 2024

View reviewed changes

Comment thread packages/auditd_manager/_dev/build/docs/README.md Outdated

Add comment from code review

cd7fec6

karenzone force-pushed the 10499-auditd-manager branch from 4524a70 to ec5ae34 Compare July 22, 2024 22:11

Corrections to Session View doc

480c5cd

karenzone force-pushed the 10499-auditd-manager branch from ec5ae34 to 480c5cd Compare July 22, 2024 22:18

karenzone marked this pull request as ready for review July 22, 2024 22:19

karenzone requested a review from a team as a code owner July 22, 2024 22:19

karenzone requested review from alaudazzi, benironside, mjwolf and nick-alayil July 22, 2024 22:20

Update manifest

c7105e4

nick-alayil approved these changes Jul 23, 2024

View reviewed changes

karenzone mentioned this pull request Jul 24, 2024

[Docs] Update documentation for powering up Session View with Auditbeat/Auditd Manager events elastic/beats#40186

Closed

Add generated README

0536b4c

andrewkroh reviewed Jul 25, 2024

View reviewed changes

benironside approved these changes Jul 25, 2024

View reviewed changes

karenzone commented Jul 25, 2024

View reviewed changes

Comment thread packages/auditd_manager/_dev/build/docs/README.md Outdated

karenzone and others added 2 commits July 25, 2024 18:05

Remove versioning details

24dc04c

Incorporate review comments

5ed3a63

karenzone commented Aug 15, 2024

View reviewed changes

mjwolf added 2 commits August 20, 2024 15:27

Merge remote-tracking branch 'upstream/main' into 10499-auditd-manager

f708753

update changelog

e2ba680

mjwolf approved these changes Aug 20, 2024

View reviewed changes

mjwolf merged commit 05bcf86 into elastic:main Aug 21, 2024

karenzone deleted the 10499-auditd-manager branch August 21, 2024 15:39

Conversation

karenzone commented Jul 19, 2024

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Jul 22, 2024

Uh oh!

karenzone commented Jul 22, 2024

Uh oh!

nick-alayil left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

benironside left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karenzone commented Aug 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Next up

Uh oh!

karenzone commented Aug 20, 2024

Uh oh!

mjwolf commented Aug 20, 2024

Uh oh!

elastic-sonarqube Bot commented Aug 20, 2024

Quality Gate passed

Uh oh!

elasticmachine commented Aug 20, 2024

💚 Build Succeeded

History

Uh oh!

karenzone commented Aug 21, 2024

Uh oh!

karenzone commented Aug 21, 2024

Uh oh!

nick-alayil commented Aug 21, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

karenzone commented Aug 15, 2024 •

edited

Loading