diff --git a/rfcs/text/0004-session.md b/rfcs/text/0004-session.md index 2617ea441c..c55982e30a 100644 --- a/rfcs/text/0004-session.md +++ b/rfcs/text/0004-session.md @@ -1,79 +1,29 @@ # 0004: Session -- Stage: **0 (strawperson)** -- Date: 7/30/2020 +- Stage: **2 (candidate)** +- Date: TBD - +This RFC calls for the addition of session fields to describe events related to +various types of "sessions" reported by appliances, security devices, systems, +management portals, applications, etc. + +In addition to these fields, a new `event.category` value of "session" should be added. +Any event that captures information about a session should include "session" in +the array field `event.category`. ## Fields -This RFC calls for the addition of session fields to describe events related to various types of "sessions" reported by appliances, security devices, systems, management portals, applications, etc. | Field | Description | | ----- | ----------- | -|session.kind: | local, remote, network -|session.authorization: | user, admin, service -|session.type: | system, virtual, application, wired, wireless, vpn +|session.kind: | system, application, network +|session.type: | [ local, remote, virtual, wired, wireless, vpn ] +|session.authorization: | user, admin, service, access |session.name | locally relevant name if available (e.g. HQ Client VPN, Win19-VDI, FIN-EXCEL-vApp) -|session.id | session id provided by server or custom fingerprint - - - -## Fields (yaml) -```yaml ---- -- name: session - title: Session - group: 2 - short: User, admin, application, network, or service sessions - description: |- - These fields are used to track an entity's interaction with various assets, services, and applications in an enterprise. Sessions will typically include a start event, often a login / authorization event performed locally or via network based mechanisms, and an end event indicating a logoff or session termination. Related events during the scope of the session will typically be associated via tuples of user, source and or destination ip/port, or cookies. - - When available, event start/end or duration fields should be populated, as well as iam, user, network, host, observer, process, source, destination, client, and server fields as appropriate to describe the specifics of the interaction. - - type: group - - fields: +|session.id | session id provided by server or custom fingerprint of discrete identifiers - - name: kind - level: extended - type: keyword - short: Kind of session - description: > Session kind can be local (console, on the keyboard), remote (ssh, vdi, web, ftp), or network (802.1x, wpa, NAC) - Additional fields will be dependent on the specifics of the session reported. +See detailed field descriptions in [rfcs/text/0004/session.yml](0004/session.yml). - example: network - - - name: authorization - level: extended - type: keyword - description: Authorization scope of the session. Initial values will include general user level access (e.g. user vdi/vda, vpn, or web sessions, network access, etc), administrative sessions (root, VMWare Host access, router cli, etc.) or service (network to network VPN, non-user verified services sessions e.g. micro-service backend architectures). - - example: user - - - name: type - level: extended - type: Logical session type - description: Session type describes the interaction/access provided. Initial values include system (shell or desktop), virtual (VDI), application (web, ftp, etc.), wired (nac, 802.1x), wireless (wpa/.1x), or vpn (ipsec, ssl, etc). Note that actual aaa mechanism (system, domain, wpa, 802.1x) does not indicate a specific session type. - - example: wireless - - - name: name - level: extended - type: Session Name - description: The name field is meant to contain a locally significant identifier for the session as configured. This could represent a VPN group name, a wireless network name (ssid), a wired network segment, VDI service name, or application identifier. - - example: HQ-Wireless - - - name: id - level: extended - type: Session id - description: The id field is meant to contain a locally significant identifier for the session as provided by the observer or host reporting the session. If no id is provided this field can remain blank, or a hash function similar to network.community_id can be used to discretely identify sessions from unique values. - - example: 7635344 -``` @@ -88,62 +38,85 @@ Stage 3: Add or update all remaining field definitions. The list should now be e ## Usage -Session fields are used to describe the sesison attributes of: - - Client VPN Sessions - - Network to Network VPN Sessions - - Network Access Sessions (NAC, WPA, EAP, etc.) - - Local or remote device login sessions (RDP, ICA, xWindows) +Session fields are used to describe and track a discrete grouping of interactions, typically bounded by +authentication or authorization events and tied to a specific user, application, or system component. + +For example: + - Network Access Sessions (NAC or Wireless LAN) + - Local or remote device login sessions (tty, console, ssh, RDP, ICA, xWindows, etc.) + - VPN Sessions (network to network, or client to network) + - Local or remote device login sessions (console, tty, RDP, ICA, xWindows, ssh, etc.) - Administrative sessions on infrastructure devices - Administrative sessions on cloud or application management portals - - Applications sessions (e.g. sql server odbc session, application access session) + - Applications sessions (e.g. sql server odbc session, web cookie based session, application access session) + - Cloud API access sessions ## Source data Source data expectations include: - Wireless Lan Controllers - - Security appliances + - Security appliances (e.g. fw, waf) - Network admission control devices - - Radius / tacacs servers - - Application server logs + - Radius / tacacs servers (802.1x EAP/PEAP aaa) + - Application server logs (FTP, MySQL) + - Web Server, WAF, or ADC logs (USer or cookie based web ession control) + - APM telemetry -Example 1: Meraki 802.1x Logs (WLC) -* EAP session start) - * `<134>1 1580551704.928047208 my_AP events type=8021x_eap_success radio='1' vap='2' client_mac='12:34:56:78:9A:BC' client_ip='192.168.1.100' identity='JohnDoe' aid='1687088497’ +### Example 1: Meraki 802.1x Logs (WLC) + +EAP session start + +`<134>1 1580551704.928047208 my_AP events type=8021x_eap_success radio='1' vap='2' client_mac='12:34:56:78:9A:BC' client_ip='192.168.1.100' identity='JohnDoe' aid='1687088497'` 802.1x EAP De-association Message -* EAP session end - * `<134>1 1580551705.928047208 my_AP events type=8021x_deauth radio='1' vap='2' identity='JohnDoe' aid='1687088497’' -* Note, while there is an association id (session.id) created prior to wpa/802.1x authentication, building the session event from the eap success message allows for easier integration of fields like username, client.ip, etc. in an 802.1x or WPA environment +EAP session end + +`<134>1 1580551705.928047208 my_AP events type=8021x_deauth radio='1' vap='2' identity='JohnDoe' aid='1687088497'` + +Note, while there is an association id (session.id) created prior to wpa/802.1x authentication, building the session event from the eap success message allows for easier integration of fields like username, client.ip, etc. in an 802.1x or WPA environment. + +Base 802.11 Association: (802.11 session start) + +`<134>1 1380653443.857790533 MR18 events type=association radio='1' vap='1' channel='2' rssi='23' aid='1687088497'` + +Base 802.11 Deassociation Message (802.11 session end) + +`1380653443.857790533 my_AP events type=disassociation radio='1' vap='2' channel='6' reason='8' instigator='2' duration='11979.728000' auth_neg_dur='1380653443.85779053324000' last_auth_ago='5.074000' is_wpa='1' full_conn='1.597000' ip_resp='1.597000' ip_src='192.168.111.251' arp_resp='1.265000' arp_src='192.168.111.251' dns_server='192.168.111.1' dns_req_rtt='1380653443.85779053335000' dns_resp='1.316000' aid='1813578850'` + - * Base 802.11 Association: (802.11 session start) - * `<134>1 1380653443.857790533 MR18 events type=association radio='1' vap='1' channel='2' rssi='23' aid='1687088497’ +### Example 2: ASA Admin Login - * Base 802.11 Deassociation Message (802.11 session end) - * `1380653443.857790533 my_AP events type=disassociation radio='1' vap='2' channel='6' reason='8' instigator='2' duration='11979.728000' auth_neg_dur='1380653443.85779053324000' last_auth_ago='5.074000' is_wpa='1' full_conn='1.597000' ip_resp='1.597000' ip_src='192.168.111.251' arp_resp='1.265000' arp_src='192.168.111.251' dns_server='192.168.111.1' dns_req_rtt='1380653443.85779053335000' dns_resp='1.316000' aid='1813578850' +Session start +`<166>Feb 03 2020 11:27:05 5508x-1_9.12(3): %ASA-6-605005: Login permitted from 192.168.1.250/59277 to management:192.168.1.10/ssh for user "JohnDoe"` -Example 2: ASA Admin Login -* Session start - * `<166>Feb 03 2020 11:27:05 5508x-1_9.12(3): %ASA-6-605005: Login permitted from 192.168.1.250/59277 to management:192.168.1.10/ssh for user "JohnDoe" -* Session End - * `<166>Feb 03 2020 11:27:05 5508x-1_9.12(3): %ASA-6-315011: SSH session from 192.168.1.250 on interface management for user JohnDoe disconnected by SSH server, reason: timeout +Session End -Example 3: ASA Web VPN -* Session Start - * `<166>Feb 03 2020 11:27:05 5508x-1_9.12(3): %ASA-6-721016: WebVPN session for client user JohnDoe , 192.168.1.100 has been created. +`<166>Feb 03 2020 11:27:05 5508x-1_9.12(3): %ASA-6-315011: SSH session from 192.168.1.250 on interface management for user JohnDoe disconnected by SSH server, reason: timeout` -* Session End: - * `<166>Feb 03 2020 11:27:05 5508x-1_9.12(3):%ASA-6-721018: WebVPN session for client user JohnDoe , IP 192.168.1.100 has been deleted. +### Example 3: ASA Web VPN + +Session Start + +`<166>Feb 03 2020 11:27:05 5508x-1_9.12(3): %ASA-6-721016: WebVPN session for client user JohnDoe , 192.168.1.100 has been created.` + +Session End + +`<166>Feb 03 2020 11:27:05 5508x-1_9.12(3):%ASA-6-721018: WebVPN session for client user JohnDoe , IP 192.168.1.100 has been deleted.` + +### Example 4: (DB Connection?) -Example 4: (DB Connection?) * TBD -Example 5: (Web Session?) +### Example 5: (Web Session?) + * TBD -Example 6: (Cloud Admin Session?) +# Example 6: (Cloud Admin Session?) + * TBD + @@ -200,6 +173,10 @@ Stage 4: Identify at least one real-world, production-ready implementation that The following are the people that consulted on the contents of this RFC. * @DainPerkins | Author +* @rw-access | Subject matter expert +* @jonathan-buttner | Sponsor (Security) +* @cyrille-leclerc | Stakeholder (Observability) +* @webmat | Editor * Stage 0: https://github.com/elastic/ecs/pull/879 +* Stage 2: https://github.com/elastic/ecs/pull/935