[Auditbeat] Add user metricset

auditbeat/docs/fields.asciidoc

@@ -4965,3 +4965,4 @@ Kubernetes container image
 
 
 --
+

x-pack/auditbeat/include/list.go

@@ -10,4 +10,5 @@ import (
 	_ "github.com/elastic/beats/x-pack/auditbeat/module/system/host"
 	_ "github.com/elastic/beats/x-pack/auditbeat/module/system/packages"
 	_ "github.com/elastic/beats/x-pack/auditbeat/module/system/processes"
+	_ "github.com/elastic/beats/x-pack/auditbeat/module/system/user"
 )

x-pack/auditbeat/module/system/_meta/config.yml.tmpl

@@ -1,14 +1,19 @@
 {{ if .Reference -}}
 {{ end -}}
 - module: system
-  
+
   metricsets:
     - host
     - packages
     - processes
+    {{ if eq .GOOS "linux" -}}
+    - user
+    {{- end }}
+
+  state.period: 12h
 
   report_changes: true
-  
+
   {{ if eq .GOOS "darwin" -}}
   {{ else if eq .GOOS "windows" -}}
   {{ else -}}

x-pack/auditbeat/module/system/user/_meta/data.json

@@ -0,0 +1,38 @@
+{
+    "@timestamp": "2017-10-12T08:05:34.853Z",
+    "beat": {
+        "hostname": "host.example.com",
+        "name": "host.example.com"
+    },
+    "event": {
+        "module": "system",
+        "dataset": "user",
+        "type": "state",
+        "action": "existing_user",
+        "id": "57ee8bb6-a3da-4c43-b0d9-0688ccdc88d0"
+    },
+    "user": {
+        "id": 1001,
+        "name": "ubuntu"
+    },
+    "system": {
+        "user": {
+            "uid": 1001,
+            "gid": 1001,
+            "name": "ubuntu",
+            "dir": "/home/ubuntu",
+            "shell": "/bin/bash",
+            "user_information": "Ubuntu",
+            "group": [
+                {
+                    "name": "sudo",
+                    "gid": 27
+                }
+            ],
+            "password": {
+                "type": "shadow_password",
+                "last_changed": "2018-09-21T00:00:00.000Z"
+            }
+        }
+    }
+}

x-pack/auditbeat/module/system/user/_meta/docs.asciidoc

@@ -0,0 +1,8 @@
+The System `user` metricset provides ... TODO.
+
+The module is implemented for Linux.
+
+[float]
+=== Configuration options
+
+TODO

x-pack/auditbeat/module/system/user/_meta/fields.yml

@@ -0,0 +1,60 @@
+- name: user
+  type: group
+  description: >
+    `user` contains information about the users on a system.
+  release: experimental
+  fields:
+    - name: name
+      type: keyword
+      description: >
+          User name.
+    - name: uid
+      type: integer
+      description: >
+          User ID.
+    - name: gid
+      type: integer
+      description: >
+          Group ID.
+    - name: dir
+      type: keyword
+      description: >
+          User's home directory.
+    - name: shell
+      type: keyword
+      description: >
+          Program to run at login.
+    - name: user_information
+      type: text
+      description: >
+          General user information. On Linux, this is the gecos field.
+    - name: group
+      type: object
+      description: >
+        `group` contains information about any groups the user is part of (beyond the user's primary group).
+      fields:
+        - name: name
+          type: keyword
+          description: >
+              Group name.
+        - name: gid
+          type: integer
+          description: >
+              Group ID.
+    - name: password
+      type: group
+      description: >
+        `password` contains information about a user's password (not the password itself).
+      fields:
+        - name: type
+          type: keyword
+          description: >
+              A user's password type. Possible values are `shadow_password`
+              (the password hash is in the shadow file), `password_disabled`,
+              `no_password` (this is dangerous as anyone can log in), and
+              `crypt_password` (when the password field in /etc/passwd seems
+              to contain an encrypted password).
+        - name: last_changed
+          type: date
+          description: >
+              The day the user's password was last changed.

x-pack/auditbeat/module/system/user/config.go

@@ -0,0 +1,31 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package user
+
+import (
+	"time"
+)
+
+// Config defines the metricset's configuration options.
+type Config struct {
+	StatePeriod     time.Duration `config:"state.period"`
+	UserStatePeriod time.Duration `config:"user.state.period"`
+}
+
+// Validate validates the host metricset config.
+func (c *Config) Validate() error {
+	return nil
+}
+
+func (c *Config) effectiveStatePeriod() time.Duration {
+	if c.UserStatePeriod != 0 {
+		return c.UserStatePeriod
+	}
+	return c.StatePeriod
+}
+
+var defaultConfig = Config{
+	StatePeriod: 12 * time.Hour,
+}