Modified auditd ingest pipeline to handle node=hostname format #19659
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…(man 5 auditd.conf) is a value other than none.
|
Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually? |
1 similar comment
|
Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually? |
botelastic
bot
added
the
needs_team
💔 Tests Failed
Expand to view the summary
Build stats
Test stats 🧪
Test errorsExpand to view the tests failures
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
|
Pinging @elastic/siem (Team:SIEM) |
botelastic
bot
removed
the
needs_team
andrewkroh
requested changes
Jul 6, 2020
There was a problem hiding this comment.
Can you please add a sample log file to https://github.com/elastic/beats/tree/117a97e23de9ec3617a9c6a05eff975726776bea/filebeat/module/auditd/log/test so that the change can be tested.
We'll update the PR afterwards to add the generated file (it's a matter of running GENERATE=true NOSE_TESTMATCH=auditd mage -d filebeat -v pythonIntegTest).
…rameter on Cent 7
|
Andrew,
I have pushed a sample log file, please let me know how else to assist.
Thanks.
Kenny
…On Mon, Jul 6, 2020 at 7:05 AM Andrew Kroh ***@***.***> wrote:
***@***.**** requested changes on this pull request.
Can you please add a sample log file to
https://github.com/elastic/beats/tree/117a97e23de9ec3617a9c6a05eff975726776bea/filebeat/module/auditd/log/test
so that the change can be tested.
We'll update the PR afterwards to add the generated file (it's a matter of
running GENERATE=true NOSE_TESTMATCH=auditd mage -d filebeat -v
pythonIntegTest).
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#19659 (review)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABMVWZYSESB5IEDINQXVP3TR2HD2XANCNFSM4OQWYKPA>
.
|
|
Thanks for the test samples @ipnerds ! I generated the test files and waiting for CI now. |
|
jenkins run tests |
|
jenkins run tests |
andrewkroh
approved these changes
Aug 10, 2020
andrewkroh
changed the title
andrewkroh
added
the
needs_backport
andrewkroh
pushed a commit
to andrewkroh/beats
that referenced
this pull request
Aug 10, 2020
This change permits auditd logs to be ingested whether or not they begin with a node=. Previous to this change a type= was expected. It handles the case where name_format (man 5 auditd.conf) is a value other than none. Also adding 10 lines of resulting audit log with name_format = hostname parameter on CentOS 7. Co-authored-by: Marc Guasch <marc.guasch@elastic.co> (cherry picked from commit b48be52)
andrewkroh
added
v7.10.0
and removed
needs_backport
andrewkroh
added a commit
that referenced
this pull request
Aug 11, 2020
…node=hostname format (#20526) * Modified auditd ingest pipeline to handle node=hostname (#19659) This change permits auditd logs to be ingested whether or not they begin with a node=. Previous to this change a type= was expected. It handles the case where name_format (man 5 auditd.conf) is a value other than none. Also adding 10 lines of resulting audit log with name_format = hostname parameter on CentOS 7. Co-authored-by: Marc Guasch <marc.guasch@elastic.co> (cherry picked from commit b48be52) * Update CHANGELOG.next.asciidoc Co-authored-by: ipnerds <ipnerds@users.noreply.github.com>
v1v
added a commit
to v1v/beats
that referenced
this pull request
Aug 12, 2020
…ne-2.0 * upstream/master: (39 commits) [ITs] Revert healthcheck for elasticsearchssl service to the previous behaviour (elastic#20558) [Heartbeat] Fix packaging (elastic#20566) [Heartbeat] Add Magefile to X-Pack (elastic#20549) [Packetbeat] Add "network" to event.category (elastic#20392) fix typo in docs (elastic#20541) Add service resource in k8s cluster role (elastic#20546) Update Golang version to 1.14.7 (elastic#20508) Add missing inputs to filebeat spec (elastic#20388) add warning log in aws and googlecloud module for API cost (elastic#20523) Fix fortinet.firewall.mem value to be interpreted as integer (elastic#19335) [CI] add more resilience (elastic#20505) [JJBB] fix credentials with a service account for golang-crossbuild (elastic#20537) [ITs] change healthcheck for elasticsearch (elastic#20514) [JJBB] fix credentials with a service account (elastic#20535) chore(ci): use build step for checking if is PR (elastic#20536) [CI] runbld project name (elastic#20466) Add panw.panos.endreason field (elastic#18705) [Filebeat] Fix PANW field spelling "veredict" to "verdict" (elastic#18808) Fix typo in netflow module docs (elastic#18992) Modified auditd ingest pipeline to handle node=hostname (elastic#19659) ...
melchiormoulin
pushed a commit
to melchiormoulin/beats
that referenced
this pull request
Oct 14, 2020
This change permits auditd logs to be ingested whether or not they begin with a node=. Previous to this change a type= was expected. It handles the case where name_format (man 5 auditd.conf) is a value other than none. Also adding 10 lines of resulting audit log with name_format = hostname parameter on CentOS 7. Co-authored-by: Marc Guasch <marc.guasch@elastic.co>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This change permits auditd logs to be ingested whether or not they begin with a node=. Previous to this change a type= was expected.
It handles the case where name_format (man 5 auditd.conf) is a value other than none.
Also adding 10 lines of resulting audit log with name_format = hostname parameter on CentOS 7.
Why is it important?
When running auditd with name_format other than none, the log messages will begin with node= parameter rather than type=. This behavior caused such audit logs to fail ingestion. The use case for setting name_format would be with an audit server collecting audit logs from multiple hosts.
Checklist
[ ] I have commented my code, particularly in hard-to-understand areas-~~ [ ] I have made corresponding changes to the documentation~~
-~~ [ ] I have made corresponding change to the default configuration files~~
-~~ [ ] I have added tests that prove my fix is effective or that my feature works~~
-~~ [ ] I have added an entry in
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.~~