[auditd_manager] Update fields and sample_event.json #12541
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -623,9 +623,11 @@ | |||||||||||||||||
| - name: auditd.data.perm_mask | ||||||||||||||||||
| description: file permission mask that triggered a watch event | ||||||||||||||||||
| type: keyword | ||||||||||||||||||
| # this mapping does not generate a dynamic template, and the expected fields do not match | ||||||||||||||||||
| # should it be kept for documentation purposes? | ||||||||||||||||||
| # - name: auditd.data.a0-N | ||||||||||||||||||
| # description: the arguments to a syscall | ||||||||||||||||||
| # type: keyword | ||||||||||||||||||
|
Collaborator
Author
There was a problem hiding this comment. What should it be done for this field definition ? Just remove it?
Contributor
There was a problem hiding this comment. Would it work with a
Suggested change
Though this would match also things that are not arguments. So maybe this can be removed, yes. |
||||||||||||||||||
| - name: auditd.data.ses | ||||||||||||||||||
| description: login session ID | ||||||||||||||||||
| type: keyword | ||||||||||||||||||
|
|
@@ -737,6 +739,6 @@ | |||||||||||||||||
| type: keyword | ||||||||||||||||||
| - name: auditd.data.result | ||||||||||||||||||
| type: keyword | ||||||||||||||||||
| - name: auditd.data.* | ||||||||||||||||||
|
Member
There was a problem hiding this comment. My interpretation of the original intent with There should be specific mappings for the other audit.data fields already. 🤞
Collaborator
Author
There was a problem hiding this comment. In that case, it would be needed to keep these two field definitions @andrewkroh : - name: auditd.data.a*
description: the arguments to a syscall
type: keyword
- name: auditd.data.*
description: Auditd related data
type: keywordUpdated in 1aa7413 Currently, the second one For the
Member
There was a problem hiding this comment.
It does look like we are missing mappings for the SELinux subject properties like seen in this data. Here are some additions that should cover these missing fields. Then - name: auditd.data.subj_user
type: keyword
description: >
The SELinux user identity. This represents the SELinux user role that is
assigned to the subject (user or process) performing an action. It's part
of the SELinux security context and is used to enforce policies that
restrict what actions a subject can perform.
- name: auditd.data.subj_role
type: keyword
description: >
The SELinux role associated with the subject. The role determines the
capabilities a subject has within a given SELinux policy. Roles are used
to define higher-level security attributes in the context of the system's
security policies.
- name: auditd.data.subj_domain
type: keyword
description: >
The SELinux domain or type assigned to the subject. The domain specifies
the type of resource or process the subject is interacting with, helping
enforce domain-based access controls, which are crucial in limiting resource
access.
- name: auditd.data.subj_level
type: keyword
description: >
The SELinux sensitivity level for the subject. It indicates the security
classification level, like `s0` or `s2`, that defines how data or processes
are handled based on confidentiality and integrity levels within the system.
- name: auditd.data.subj_category
type: keyword
description: >
The SELinux category associated with the subject. It helps further refine
the level of access by classifying subjects into categories for
multi-level security (MLS). Categories are often used to label data
with additional attributes, like "high" or "low," enhancing granularity.
Collaborator
Author
There was a problem hiding this comment. Added those new fields for SELinux subject properties, thanks! Just a couple of doubts:
Member
There was a problem hiding this comment. The auditd This is a better example of the data sent by auditbeat because it has some ECS mapping applied (whereas the
Member
There was a problem hiding this comment.
I think |
||||||||||||||||||
| description: Auditd related data | ||||||||||||||||||
| type: keyword | ||||||||||||||||||
|
Collaborator
Author
There was a problem hiding this comment. If this field is declared as Probably, because there are other fields If it set as a dynamic template, it keeps all the fields above plus the ones not able to match (
Contributor
There was a problem hiding this comment. If flattened is expected maybe this should be defined without the wildcard:
Collaborator
Author
There was a problem hiding this comment. If that definition is changed as: - name: auditd.data
description: Auditd related data
type: flattenedThis mapping is not created. I think this is caused because there are other definitions present for If it is required to be flattened, I'm afraid it should be needed to remove all the
Contributor
There was a problem hiding this comment.
On what version of the stack? This looks like a case of elastic/kibana#204104
Collaborator
Author
There was a problem hiding this comment. I did run the tests with 8.16.2 (Kibana version set in the manifest). Just tested with Complete mapping for `auditd.data` (8.18.0-SNAPSHOT) "auditd": {
"properties": {
"data": {
"properties": {
"acct": {
"type": "keyword",
"ignore_above": 1024
},
"acl": {
"type": "keyword",
"ignore_above": 1024
},
"action": {
"type": "keyword",
"ignore_above": 1024
},
"added": {
"type": "long"
},
"addr": {
"type": "keyword",
"ignore_above": 1024
},
"apparmor": {
"type": "keyword",
"ignore_above": 1024
},
"arch": {
"type": "keyword",
"ignore_above": 1024
},
"argc": {
"type": "long"
},
"audit_backlog_limit": {
"type": "keyword",
"ignore_above": 1024
},
"audit_backlog_wait_time": {
"type": "keyword",
"ignore_above": 1024
},
"audit_enabled": {
"type": "keyword",
"ignore_above": 1024
},
"audit_failure": {
"type": "keyword",
"ignore_above": 1024
},
"audit_pid": {
"type": "long"
},
"auid": {
"type": "keyword",
"ignore_above": 1024
},
"banners": {
"type": "keyword",
"ignore_above": 1024
},
"bool": {
"type": "keyword",
"ignore_above": 1024
},
"bus": {
"type": "keyword",
"ignore_above": 1024
},
"cap_fe": {
"type": "keyword",
"ignore_above": 1024
},
"cap_fi": {
"type": "keyword",
"ignore_above": 1024
},
"cap_fp": {
"type": "keyword",
"ignore_above": 1024
},
"cap_fver": {
"type": "keyword",
"ignore_above": 1024
},
"cap_pe": {
"type": "keyword",
"ignore_above": 1024
},
"cap_pi": {
"type": "keyword",
"ignore_above": 1024
},
"cap_pp": {
"type": "keyword",
"ignore_above": 1024
},
"capability": {
"type": "keyword",
"ignore_above": 1024
},
"cgroup": {
"type": "keyword",
"ignore_above": 1024
},
"changed": {
"type": "long"
},
"cipher": {
"type": "keyword",
"ignore_above": 1024
},
"class": {
"type": "keyword",
"ignore_above": 1024
},
"cmd": {
"type": "keyword",
"ignore_above": 1024
},
"code": {
"type": "keyword",
"ignore_above": 1024
},
"compat": {
"type": "keyword",
"ignore_above": 1024
},
"daddr": {
"type": "ip"
},
"data": {
"type": "keyword",
"ignore_above": 1024
},
"default_context": {
"type": "keyword",
"ignore_above": 1024
},
"device": {
"type": "keyword",
"ignore_above": 1024
},
"dir": {
"type": "keyword",
"ignore_above": 1024
},
"direction": {
"type": "keyword",
"ignore_above": 1024
},
"dmac": {
"type": "keyword",
"ignore_above": 1024
},
"dport": {
"type": "long"
},
"enforcing": {
"type": "keyword",
"ignore_above": 1024
},
"entries": {
"type": "long"
},
"exit": {
"type": "keyword",
"ignore_above": 1024
},
"fam": {
"type": "keyword",
"ignore_above": 1024
},
"family": {
"type": "keyword",
"ignore_above": 1024
},
"fd": {
"type": "keyword",
"ignore_above": 1024
},
"fe": {
"type": "keyword",
"ignore_above": 1024
},
"feature": {
"type": "keyword",
"ignore_above": 1024
},
"fi": {
"type": "keyword",
"ignore_above": 1024
},
"file": {
"type": "keyword",
"ignore_above": 1024
},
"flags": {
"type": "keyword",
"ignore_above": 1024
},
"format": {
"type": "keyword",
"ignore_above": 1024
},
"fp": {
"type": "keyword",
"ignore_above": 1024
},
"frootid": {
"type": "keyword",
"ignore_above": 1024
},
"fver": {
"type": "keyword",
"ignore_above": 1024
},
"grantors": {
"type": "keyword",
"ignore_above": 1024
},
"grp": {
"type": "keyword",
"ignore_above": 1024
},
"hook": {
"type": "keyword",
"ignore_above": 1024
},
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"icmp_type": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"igid": {
"type": "keyword",
"ignore_above": 1024
},
"img_ctx": {
"type": "keyword",
"ignore_above": 1024
},
"inif": {
"type": "keyword",
"ignore_above": 1024
},
"ino": {
"type": "keyword",
"ignore_above": 1024
},
"inode_gid": {
"type": "keyword",
"ignore_above": 1024
},
"inode_uid": {
"type": "keyword",
"ignore_above": 1024
},
"invalid_context": {
"type": "keyword",
"ignore_above": 1024
},
"ioctlcmd": {
"type": "keyword",
"ignore_above": 1024
},
"ip": {
"type": "ip"
},
"ipid": {
"type": "keyword",
"ignore_above": 1024
},
"ipx_net": {
"type": "keyword",
"ignore_above": 1024
},
"items": {
"type": "long"
},
"iuid": {
"type": "keyword",
"ignore_above": 1024
},
"kernel": {
"type": "keyword",
"ignore_above": 1024
},
"kind": {
"type": "keyword",
"ignore_above": 1024
},
"ksize": {
"type": "keyword",
"ignore_above": 1024
},
"laddr": {
"type": "keyword",
"ignore_above": 1024
},
"len": {
"type": "keyword",
"ignore_above": 1024
},
"list": {
"type": "keyword",
"ignore_above": 1024
},
"lport": {
"type": "long"
},
"mac": {
"type": "keyword",
"ignore_above": 1024
},
"macproto": {
"type": "keyword",
"ignore_above": 1024
},
"maj": {
"type": "keyword",
"ignore_above": 1024
},
"major": {
"type": "keyword",
"ignore_above": 1024
},
"minor": {
"type": "keyword",
"ignore_above": 1024
},
"model": {
"type": "keyword",
"ignore_above": 1024
},
"msg": {
"type": "keyword",
"ignore_above": 1024
},
"nargs": {
"type": "long"
},
"net": {
"type": "keyword",
"ignore_above": 1024
},
"new": {
"type": "keyword",
"ignore_above": 1024
},
"new_chardev": {
"type": "keyword",
"ignore_above": 1024
},
"new_disk": {
"type": "keyword",
"ignore_above": 1024
},
"new_enabled": {
"type": "keyword",
"ignore_above": 1024
},
"new_fs": {
"type": "keyword",
"ignore_above": 1024
},
"new_gid": {
"type": "keyword",
"ignore_above": 1024
},
"new_level": {
"type": "keyword",
"ignore_above": 1024
},
"new_lock": {
"type": "keyword",
"ignore_above": 1024
},
"new_log_passwd": {
"type": "keyword",
"ignore_above": 1024
},
"new_mem": {
"type": "keyword",
"ignore_above": 1024
},
"new_net": {
"type": "keyword",
"ignore_above": 1024
},
"new_pe": {
"type": "keyword",
"ignore_above": 1024
},
"new_pi": {
"type": "keyword",
"ignore_above": 1024
},
"new_pp": {
"type": "keyword",
"ignore_above": 1024
},
"new_range": {
"type": "keyword",
"ignore_above": 1024
},
"new_rng": {
"type": "keyword",
"ignore_above": 1024
},
"new_role": {
"type": "keyword",
"ignore_above": 1024
},
"new_ses": {
"type": "keyword",
"ignore_above": 1024
},
"new_seuser": {
"type": "keyword",
"ignore_above": 1024
},
"new_vcpu": {
"type": "long"
},
"nlnk_fam": {
"type": "keyword",
"ignore_above": 1024
},
"nlnk_grp": {
"type": "keyword",
"ignore_above": 1024
},
"nlnk_pid": {
"type": "long"
},
"oauid": {
"type": "keyword",
"ignore_above": 1024
},
"obj": {
"type": "keyword",
"ignore_above": 1024
},
"obj_gid": {
"type": "keyword",
"ignore_above": 1024
},
"obj_uid": {
"type": "keyword",
"ignore_above": 1024
},
"ocomm": {
"type": "keyword",
"ignore_above": 1024
},
"oflag": {
"type": "keyword",
"ignore_above": 1024
},
"old": {
"type": "keyword",
"ignore_above": 1024
},
"old_auid": {
"type": "keyword",
"ignore_above": 1024
},
"old_chardev": {
"type": "keyword",
"ignore_above": 1024
},
"old_disk": {
"type": "keyword",
"ignore_above": 1024
},
"old_enabled": {
"type": "keyword",
"ignore_above": 1024
},
"old_enforcing": {
"type": "keyword",
"ignore_above": 1024
},
"old_fs": {
"type": "keyword",
"ignore_above": 1024
},
"old_level": {
"type": "keyword",
"ignore_above": 1024
},
"old_lock": {
"type": "keyword",
"ignore_above": 1024
},
"old_log_passwd": {
"type": "keyword",
"ignore_above": 1024
},
"old_mem": {
"type": "keyword",
"ignore_above": 1024
},
"old_net": {
"type": "keyword",
"ignore_above": 1024
},
"old_pa": {
"type": "keyword",
"ignore_above": 1024
},
"old_pe": {
"type": "keyword",
"ignore_above": 1024
},
"old_pi": {
"type": "keyword",
"ignore_above": 1024
},
"old_pp": {
"type": "keyword",
"ignore_above": 1024
},
"old_prom": {
"type": "keyword",
"ignore_above": 1024
},
"old_range": {
"type": "keyword",
"ignore_above": 1024
},
"old_rng": {
"type": "keyword",
"ignore_above": 1024
},
"old_role": {
"type": "keyword",
"ignore_above": 1024
},
"old_ses": {
"type": "keyword",
"ignore_above": 1024
},
"old_seuser": {
"type": "keyword",
"ignore_above": 1024
},
"old_val": {
"type": "keyword",
"ignore_above": 1024
},
"old_vcpu": {
"type": "long"
},
"op": {
"type": "keyword",
"ignore_above": 1024
},
"opid": {
"type": "long"
},
"oses": {
"type": "keyword",
"ignore_above": 1024
},
"outif": {
"type": "keyword",
"ignore_above": 1024
},
"pa": {
"type": "keyword",
"ignore_above": 1024
},
"parent": {
"type": "keyword",
"ignore_above": 1024
},
"pe": {
"type": "keyword",
"ignore_above": 1024
},
"per": {
"type": "keyword",
"ignore_above": 1024
},
"perm": {
"type": "keyword",
"ignore_above": 1024
},
"perm_mask": {
"type": "keyword",
"ignore_above": 1024
},
"permissive": {
"type": "keyword",
"ignore_above": 1024
},
"pfs": {
"type": "keyword",
"ignore_above": 1024
},
"pi": {
"type": "keyword",
"ignore_above": 1024
},
"pp": {
"type": "keyword",
"ignore_above": 1024
},
"printer": {
"type": "keyword",
"ignore_above": 1024
},
"prom": {
"type": "keyword",
"ignore_above": 1024
},
"proto": {
"type": "keyword",
"ignore_above": 1024
},
"qbytes": {
"type": "keyword",
"ignore_above": 1024
},
"range": {
"type": "keyword",
"ignore_above": 1024
},
"reason": {
"type": "keyword",
"ignore_above": 1024
},
"removed": {
"type": "long"
},
"res": {
"type": "keyword",
"ignore_above": 1024
},
"reset": {
"type": "keyword",
"ignore_above": 1024
},
"resrc": {
"type": "keyword",
"ignore_above": 1024
},
"result": {
"type": "keyword",
"ignore_above": 1024
},
"rport": {
"type": "long"
},
"sauid": {
"type": "keyword",
"ignore_above": 1024
},
"scontext": {
"type": "keyword",
"ignore_above": 1024
},
"selected_context": {
"type": "keyword",
"ignore_above": 1024
},
"seperm": {
"type": "keyword",
"ignore_above": 1024
},
"seperms": {
"type": "keyword",
"ignore_above": 1024
},
"seqno": {
"type": "long"
},
"seresult": {
"type": "keyword",
"ignore_above": 1024
},
"ses": {
"type": "keyword",
"ignore_above": 1024
},
"seuser": {
"type": "keyword",
"ignore_above": 1024
},
"sig": {
"type": "keyword",
"ignore_above": 1024
},
"sigev_signo": {
"type": "keyword",
"ignore_above": 1024
},
"smac": {
"type": "keyword",
"ignore_above": 1024
},
"socket": {
"properties": {
"addr": {
"type": "keyword",
"ignore_above": 1024
},
"family": {
"type": "keyword",
"ignore_above": 1024
},
"path": {
"type": "keyword",
"ignore_above": 1024
},
"port": {
"type": "long"
},
"saddr": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"spid": {
"type": "long"
},
"sport": {
"type": "long"
},
"state": {
"type": "keyword",
"ignore_above": 1024
},
"subj": {
"type": "keyword",
"ignore_above": 1024
},
"success": {
"type": "keyword",
"ignore_above": 1024
},
"syscall": {
"type": "keyword",
"ignore_above": 1024
},
"table": {
"type": "keyword",
"ignore_above": 1024
},
"tclass": {
"type": "keyword",
"ignore_above": 1024
},
"tcontext": {
"type": "keyword",
"ignore_above": 1024
},
"terminal": {
"type": "keyword",
"ignore_above": 1024
},
"tty": {
"type": "keyword",
"ignore_above": 1024
},
"unit": {
"type": "keyword",
"ignore_above": 1024
},
"uri": {
"type": "keyword",
"ignore_above": 1024
},
"uuid": {
"type": "keyword",
"ignore_above": 1024
},
"val": {
"type": "keyword",
"ignore_above": 1024
},
"ver": {
"type": "keyword",
"ignore_above": 1024
},
"virt": {
"type": "keyword",
"ignore_above": 1024
},
"vm": {
"type": "keyword",
"ignore_above": 1024
},
"vm_ctx": {
"type": "keyword",
"ignore_above": 1024
},
"vm_pid": {
"type": "long"
},
"watch": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
}Just realized that there are at least another group - name: auditd.data.socket.port
description: The port number.
type: long
- name: auditd.data.socket.saddr
description: The raw socket address structure.
type: keyword
- name: auditd.data.socket.addr
description: The remote address.
type: keyword
- name: auditd.data.socket.family
description: The socket family (unix, ipv4, ipv6, netlink).
type: keyword
- name: auditd.data.socket.path
description: This is the path associated with a unix socket.
type: keywordCould this
Contributor
There was a problem hiding this comment. Yeah, it is probably not possible to merge a flattened with a group. The fleet code definitely does not support it, it only merges groups, objects and maybe nested. It would probably not make sense to merge a flattened with other types. So we should probably avoid flattened in this case, using a wildcard and considering
Collaborator
Author
There was a problem hiding this comment. Keeping all the definitions present in the file (except
- name: auditd.data.*
description: Auditd related data
type: keyword
- name: auditd.data.*
description: Auditd related data
type: object
object_type: keyword
object_type_mapping_type: "*"Maybe better use the first option, and if it is required, add new corresponding definitions in the future, as it happens for |
||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
To be removed changes in
.buildkite/folder.