Skip to content

[Auditd Manager] Add docs to support add_session_metadata processor #10544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjwolf merged 9 commits into from
Aug 21, 2024
Merged

[Auditd Manager] Add docs to support add_session_metadata processor #10544

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
f20d807
[Auditd Manager] Add docs to support add_session_metadata processor
karenzone Jul 19, 2024
cd7fec6
Add comment from code review
karenzone Jul 22, 2024
480c5cd
Corrections to Session View doc
karenzone Jul 22, 2024
c7105e4
Update manifest
karenzone Jul 23, 2024
0536b4c
Add generated README
mjwolf Jul 24, 2024
24dc04c
Remove versioning details
karenzone Jul 25, 2024
5ed3a63
Incorporate review comments
karenzone Aug 15, 2024
f708753
Merge remote-tracking branch 'upstream/main' into 10499-auditd-manager
mjwolf Aug 20, 2024
e2ba680
update changelog
mjwolf Aug 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions packages/auditd_manager/_dev/build/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,25 @@ is a part of the Linux kernel.

This integration is available only for Linux.

## Session View powered by Auditd Manager [BETA]

The `add_session_metadata` processor for Auditd Manager powers the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform.
This feature is in Beta at Elastic Security version 8.15.0.
Comment thread
karenzone marked this conversation as resolved.
Resolved

To enable the `add_session_metadata` processor for Auditd Manager:

1. Navigate to the Auditd Manager integration configuration in Kibana.
2. Add the `add_session_metadata` processor configuration under the advanced options section.
3. Add these rules to the **Audit Rules** section of the configuration:

```
-a always,exit -F arch=b64 -S execve,execveat -k exec
-a always,exit -F arch=b64 -S exit_group
-a always,exit -F arch=b64 -S setsid
```

Changes are applied automatically, and you do not have to restart the service.

## How it works

This integration establishes a subscription to the kernel to receive the events
Expand Down
5 changes: 5 additions & 0 deletions packages/auditd_manager/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.16.5"
changes:
- description: Doc: Add doc for configuring Auditd Manager for Session View
type: enhancement
link: https://github.com/elastic/integrations/issues/10499

@karenzone karenzone Aug 15, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While this work has been in progress, we've bumped to 1.17.0.
Does this work become 1.17.1?

- version: "1.16.4"
changes:
- description: Fix `audit_rule_files`
Expand Down
19 changes: 19 additions & 0 deletions packages/auditd_manager/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,25 @@ is a part of the Linux kernel.

This integration is available only for Linux.

## Session View powered by Auditd Manager [BETA]

The `add_session_metadata` processor for Auditd Manager powers the [Session View](https://www.elastic.co/guide/en/security/current/session-view.html) utility for the Elastic Security Platform.
This feature is in Beta at Elastic Security version 8.15.0.

@andrewkroh andrewkroh Jul 25, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As is, this package is available on all versions of the stack since 8.7.1. Maybe we should not mention any specific stack version here? If there is a minimum Kibana version required for the session view to work with data from this processor then we should bump the Kibana version constraint of the package.

Instead we should indicate what minimum version of Elastic Agent is required to use the processor. We need to make it clear what version of the Agent is required to use this feature because there are no enforced minimum requirements in Fleet.

@karenzone karenzone Jul 25, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If there is a minimum Kibana version required for the session view to work with data from this processor then we should bump the Kibana version constraint of the package.

Good suggestion.

  • Where can we get that info?
  • Where do we bump the Kibana version contraint?

@nick-alayil nick-alayil Jul 25, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch @andrewkroh. The Kibana session view plugin support reading data from auditbeat / auditd manager datastreams from 8.14 onwards.

So, if we specify the agent version dependency as 8.14+, it would be better since agents running 8.14 or higher are only compatible with the Elastic stack version 8.14 or above. Is that a correct understanding of your message?

@mjwolf mjwolf Jul 27, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think 8.15 is the minimum kibana version that enabled auditbeat session view (or it might have gone in with 8.14). I'm not sure what to do for this, it seems strange if we were to change the minimum version here, when this PR is mainly a doc change. Nothing has really changed within this integration to warrant changing the minimum version

@karenzone, to answer your question, the kibana version is set in packages/auditd_manager/manifest.yml, in the conditions.kibana.version field

@karenzone karenzone Aug 15, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed the version statement, but left the BETA tag in the Session View heading.


To enable the `add_session_metadata` processor for Auditd Manager:

1. Navigate to the Auditd Manager integration configuration in Kibana.
2. Add the `add_session_metadata` processor configuration under the advanced options section.

@andrewkroh andrewkroh Jul 25, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should show a complete configuration example that can be pasted into the "Processors" section of the advanced options.

@nick-alayil nick-alayil Jul 25, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I totally agree

@karenzone karenzone Jul 25, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good suggestion. Who can help with that info?

@nick-alayil nick-alayil Jul 25, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume @andrewkroh is referring to the missing backend configuration.

  - add_session_metadata:
      backend: "auto"

@mjwolf mjwolf Jul 27, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume @andrewkroh is referring to the missing backend configuration.

  - add_session_metadata:
      backend: "auto"

That's the correct full example, and I agree it should be added too

@karenzone karenzone Aug 15, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added

3. Add these rules to the **Audit Rules** section of the configuration:

```
-a always,exit -F arch=b64 -S execve,execveat -k exec
-a always,exit -F arch=b64 -S exit_group
-a always,exit -F arch=b64 -S setsid
```

Changes are applied automatically, and you do not have to restart the service.

## How it works

This integration establishes a subscription to the kernel to receive the events
Expand Down
2 changes: 1 addition & 1 deletion packages/auditd_manager/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: "3.0.0"
name: auditd_manager
title: "Auditd Manager"
version: "1.16.4"
version: "1.16.5"

@karenzone karenzone Aug 15, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ToDo: Resolve conflicts and bump version. Does this become 1.17.1?

description: "The Auditd Manager Integration receives audit events from the Linux Audit Framework that is a part of the Linux kernel."
type: integration
categories:
Expand Down