You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
% This file is generated! See scripts/generate_fields_docs.py
7
+
6
8
# Auditd fields [exported-fields-auditd]
7
9
8
10
These are the fields generated by the auditd module.
@@ -49,10 +51,9 @@ alias to: user.saved.group.id
49
51
alias to: user.filesystem.group.id
50
52
51
53
52
-
53
54
## name_map [_name_map]
54
55
55
-
If `resolve_ids` is set to true in the configuration then `name_map` will contain a mapping of uid field names to the resolved name (e.g. auid → root).
56
+
If `resolve_ids` is set to true in the configuration then `name_map` will contain a mapping of uid field names to the resolved name (e.g. auid -> root).
56
57
57
58
**`user.name_map.auid`**
58
59
: type: alias
@@ -96,7 +97,6 @@ alias to: user.saved.group.name
96
97
alias to: user.filesystem.group.name
97
98
98
99
99
-
100
100
## selinux [_selinux]
101
101
102
102
The SELinux identity of the actor.
@@ -108,32 +108,31 @@ type: keyword
108
108
109
109
110
110
**`user.selinux.role`**
111
-
: user’s SELinux role
111
+
: user's SELinux role
112
112
113
113
type: keyword
114
114
115
115
116
116
**`user.selinux.domain`**
117
-
: The actor’s SELinux domain or type.
117
+
: The actor's SELinux domain or type.
118
118
119
119
type: keyword
120
120
121
121
122
122
**`user.selinux.level`**
123
-
: The actor’s SELinux level.
123
+
: The actor's SELinux level.
124
124
125
125
type: keyword
126
126
127
127
example: s0
128
128
129
129
130
130
**`user.selinux.category`**
131
-
: The actor’s SELinux category or compartments.
131
+
: The actor's SELinux category or compartments.
132
132
133
133
type: keyword
134
134
135
135
136
-
137
136
## process [_process]
138
137
139
138
Process attributes.
@@ -146,7 +145,6 @@ type: alias
146
145
alias to: process.working_directory
147
146
148
147
149
-
150
148
## source [_source]
151
149
152
150
Source that triggered the event.
@@ -157,7 +155,6 @@ Source that triggered the event.
157
155
type: keyword
158
156
159
157
160
-
161
158
## destination [_destination]
162
159
163
160
Destination address that triggered the event.
@@ -196,13 +193,12 @@ type: keyword
196
193
example: success or fail
197
194
198
195
199
-
200
196
## actor [_actor]
201
197
202
198
The actor is the user that triggered the audit event.
203
199
204
200
**`auditd.summary.actor.primary`**
205
-
: The primary identity of the actor. This is the actor’s original login ID. It will not change even if the user changes to another account.
201
+
: The primary identity of the actor. This is the actor's original login ID. It will not change even if the user changes to another account.
206
202
207
203
type: keyword
208
204
@@ -213,7 +209,6 @@ type: keyword
213
209
type: keyword
214
210
215
211
216
-
217
212
## object [_object]
218
213
219
214
This is the thing or object being acted upon in the event.
@@ -238,7 +233,6 @@ type: keyword
238
233
type: keyword
239
234
240
235
241
-
242
236
## paths [_paths]
243
237
244
238
List of paths associated with the event.
@@ -317,8 +311,7 @@ type: keyword
317
311
type: keyword
318
312
319
313
320
-
321
-
## data [_data_2]
314
+
## data [_data]
322
315
323
316
The data from the audit messages.
324
317
@@ -335,7 +328,7 @@ type: keyword
335
328
336
329
337
330
**`auditd.data.acct`**
338
-
: a user’s account name
331
+
: a user's account name
339
332
340
333
type: keyword
341
334
@@ -555,7 +548,7 @@ type: keyword
555
548
556
549
557
550
**`auditd.data.audit_backlog_limit`**
558
-
: audit system’s backlog queue size
551
+
: audit system's backlog queue size
559
552
560
553
type: keyword
561
554
@@ -591,7 +584,7 @@ type: keyword
591
584
592
585
593
586
**`auditd.data.oauid`**
594
-
: object’s login user ID
587
+
: object's login user ID
595
588
596
589
type: keyword
597
590
@@ -615,13 +608,13 @@ type: keyword
615
608
616
609
617
610
**`auditd.data.vm-ctx`**
618
-
: the vm’s context string
611
+
: the vm's context string
619
612
620
613
type: keyword
621
614
622
615
623
616
**`auditd.data.opid`**
624
-
: object’s process ID
617
+
: object's process ID
625
618
626
619
type: keyword
627
620
@@ -675,7 +668,7 @@ type: keyword
675
668
676
669
677
670
**`auditd.data.range`**
678
-
: user’s SE Linux range
671
+
: user's SE Linux range
679
672
680
673
type: keyword
681
674
@@ -705,7 +698,7 @@ type: keyword
705
698
706
699
707
700
**`auditd.data.subj`**
708
-
: lspp subject’s context string
701
+
: lspp subject's context string
709
702
710
703
type: keyword
711
704
@@ -723,13 +716,13 @@ type: keyword
723
716
724
717
725
718
**`auditd.data.kernel`**
726
-
: kernel’s version number
719
+
: kernel's version number
727
720
728
721
type: keyword
729
722
730
723
731
724
**`auditd.data.ocomm`**
732
-
: object’s command line name
725
+
: object's command line name
733
726
734
727
type: keyword
735
728
@@ -807,7 +800,7 @@ type: keyword
807
800
808
801
809
802
**`auditd.data.iuid`**
810
-
: ipc object’s user ID
803
+
: ipc object's user ID
811
804
812
805
type: keyword
813
806
@@ -837,7 +830,7 @@ type: keyword
837
830
838
831
839
832
**`auditd.data.vm-pid`**
840
-
: vm’s process ID
833
+
: vm's process ID
841
834
842
835
type: keyword
843
836
@@ -855,7 +848,7 @@ type: keyword
855
848
856
849
857
850
**`auditd.data.oses`**
858
-
: object’s session ID
851
+
: object's session ID
859
852
860
853
type: keyword
861
854
@@ -867,7 +860,7 @@ type: keyword
867
860
868
861
869
862
**`auditd.data.igid`**
870
-
: ipc object’s group ID
863
+
: ipc object's group ID
871
864
872
865
type: keyword
873
866
@@ -987,7 +980,7 @@ type: keyword
987
980
988
981
989
982
**`auditd.data.audit_backlog_wait_time`**
990
-
: audit system’s backlog wait time
983
+
: audit system's backlog wait time
991
984
992
985
type: keyword
993
986
@@ -1023,7 +1016,7 @@ type: keyword
1023
1016
1024
1017
1025
1018
**`auditd.data.format`**
1026
-
: audit log’s format
1019
+
: audit log's format
1027
1020
1028
1021
type: keyword
1029
1022
@@ -1035,7 +1028,7 @@ type: keyword
1035
1028
1036
1029
1037
1030
**`auditd.data.tcontext`**
1038
-
: the target’s or object’s context string
1031
+
: the target's or object's context string
1039
1032
1040
1033
type: keyword
1041
1034
@@ -1113,7 +1106,7 @@ type: keyword
1113
1106
1114
1107
1115
1108
**`auditd.data.inode_gid`**
1116
-
: group ID of the inode’s owner
1109
+
: group ID of the inode's owner
1117
1110
1118
1111
type: keyword
1119
1112
@@ -1203,7 +1196,7 @@ type: keyword
1203
1196
1204
1197
1205
1198
**`auditd.data.audit_failure`**
1206
-
: audit system’s failure mode
1199
+
: audit system's failure mode
1207
1200
1208
1201
type: keyword
1209
1202
@@ -1263,7 +1256,7 @@ type: keyword
1263
1256
1264
1257
1265
1258
**`auditd.data.seuser`**
1266
-
: user’s SE Linux user acct
1259
+
: user's SE Linux user acct
1267
1260
1268
1261
type: keyword
1269
1262
@@ -1359,7 +1352,7 @@ type: keyword
1359
1352
1360
1353
1361
1354
**`auditd.data.list`**
1362
-
: the audit system’s filter list number
1355
+
: the audit system's filter list number
1363
1356
1364
1357
type: keyword
1365
1358
@@ -1401,7 +1394,7 @@ type: keyword
1401
1394
1402
1395
1403
1396
**`auditd.data.audit_enabled`**
1404
-
: audit systems’s enable/disable status
1397
+
: audit systems's enable/disable status
1405
1398
1406
1399
type: keyword
1407
1400
@@ -1425,19 +1418,19 @@ type: keyword
1425
1418
1426
1419
1427
1420
**`auditd.data.scontext`**
1428
-
: the subject’s context string
1421
+
: the subject's context string
1429
1422
1430
1423
type: keyword
1431
1424
1432
1425
1433
1426
**`auditd.data.tclass`**
1434
-
: target’s object classification
1427
+
: target's object classification
1435
1428
1436
1429
type: keyword
1437
1430
1438
1431
1439
1432
**`auditd.data.ver`**
1440
-
: audit daemon’s version number
1433
+
: audit daemon's version number
1441
1434
1442
1435
type: keyword
1443
1436
@@ -1455,7 +1448,7 @@ type: keyword
1455
1448
1456
1449
1457
1450
**`auditd.data.img-ctx`**
1458
-
: the vm’s disk image context string
1451
+
: the vm's disk image context string
1459
1452
1460
1453
type: keyword
1461
1454
@@ -1479,7 +1472,7 @@ type: keyword
1479
1472
1480
1473
1481
1474
**`auditd.data.inode_uid`**
1482
-
: user ID of the inode’s owner
1475
+
: user ID of the inode's owner
1483
1476
1484
1477
type: keyword
1485
1478
@@ -1538,7 +1531,6 @@ type: alias
1538
1531
alias to: error.message
1539
1532
1540
1533
1541
-
1542
1534
## geoip [_geoip]
1543
1535
1544
1536
The geoip fields are defined as a convenience in case you decide to enrich the data using a geoip filter in Logstash or an Elasticsearch geoip ingest processor.
0 commit comments