Skip to content

Commit 9c89eff

Browse files
author
Andrew Stucki
authored
[Filebeat] Use ingress/egress for crowdstrike and auditd modules (#23041)
* [Filebeat] Use ingress/egress for crowdstrike and auditd modules * Add changelog entry
1 parent cc2dd9f commit 9c89eff

8 files changed

Lines changed: 160 additions & 4 deletions

File tree

‎CHANGELOG.next.asciidoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
9797
- Remove `suricata.eve.timestamp` alias field. {issue}10535[10535] {pull}22095[22095]
9898
- Rename bad ECS field name tracing.trace.id to trace.id in aws elb fileset. {pull}22571[22571]
9999
- Fix parsing issues with nested JSON payloads in Elasticsearch audit log fileset. {pull}22975[22975]
100+
- Rename `network.direction` values in crowdstrike/falcon to `ingress`/`egress`. {pull}23041[23041]
100101

101102
*Heartbeat*
102103

@@ -568,7 +569,6 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
568569
- Set event.outcome field based on googlecloud audit log output. {pull}15731[15731]
569570
- Add dashboard for AWS ELB fileset. {pull}15804[15804]
570571
- Add dashboard for AWS vpcflow fileset. {pull}16007[16007]
571-
572572
- `container` and `docker` inputs now support reading of labels and env vars written by docker JSON file logging driver. {issue}8358[8358]
573573
- Add `index` option to all inputs to directly set a per-input index value. {pull}14010[14010]
574574
- Add ECS tls fields to zeek:smtp,rdp,ssl and aws:s3access,elb {issue}15757[15757] {pull}15935[15936]
@@ -749,6 +749,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
749749
- Add `event.category` "configuration" to gsuite module events. {pull}23010[23010]
750750
- Add `event.category` "configuration" to o365 module events. {pull}23010[23010]
751751
- Add `event.category` "configuration" to zoom module events. {pull}23010[23010]
752+
- Add `network.direction` to auditd/log fileset. {pull}23041[23041]
752753

753754
*Heartbeat*
754755

‎filebeat/module/auditd/log/ingest/pipeline.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,23 @@ processors:
306306
field: container.runtime
307307
value: "{{ auditd.log.virt }}"
308308
ignore_empty_value: true
309+
- set:
310+
if: >
311+
ctx.auditd.log?.record_type == 'SYSCALL' && (
312+
ctx.auditd.log?.syscall == 'accept' || ctx.auditd.log?.syscall == '43' ||
313+
ctx.auditd.log?.syscall == 'recvfrom' || ctx.auditd.log?.syscall == '45' ||
314+
ctx.auditd.log?.syscall == 'recvmsg' || ctx.auditd.log?.syscall == '47' ||
315+
ctx.auditd.log?.syscall == 'accept4' || ctx.auditd.log?.syscall == '288' )
316+
field: network.direction
317+
value: ingress
318+
- set:
319+
if: >
320+
ctx.auditd.log?.record_type == 'SYSCALL' && (
321+
ctx.auditd.log?.syscall == 'connect' || ctx.auditd.log?.syscall == '42' ||
322+
ctx.auditd.log?.syscall == 'sendto' || ctx.auditd.log?.syscall == '44' ||
323+
ctx.auditd.log?.syscall == 'sendmsg' || ctx.auditd.log?.syscall == '46')
324+
field: network.direction
325+
value: egress
309326
- rename:
310327
ignore_failure: true
311328
field: auditd.log.arch

‎filebeat/module/auditd/log/test/audit-rhel6.log-expected.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@
144144
"host.architecture": "x86_64",
145145
"input.type": "log",
146146
"log.offset": 1162,
147+
"network.direction": "egress",
147148
"process.executable": "/usr/libexec/strongswan/charon (deleted)",
148149
"process.exit_code": 184,
149150
"process.name": "charon",

‎filebeat/module/auditd/log/test/audit-ubuntu1604.log‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
type=SYSCALL msg=audit(1492752520.441:8832): arch=c000003e syscall=43 success=yes exit=5 a0=3 a1=7ffd0dc80040 a2=7ffd0dc7ffd0 a3=0 items=0 ppid=1 pid=1663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" key="key=net"
2+
type=SOCKADDR msg=audit(1492752520.441:8832): saddr=0200E31C4853E6640000000000000000
3+
type=PROCTITLE msg=audit(1492752520.441:8832): proctitle="(sshd)"
4+
type=SYSCALL msg=audit(1492753107.096:9004): arch=c000003e syscall=42 success=no exit=-115 a0=5 a1=7ffc12ac3ab0 a2=10 a3=4 items=0 ppid=1 pid=1648 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python3.5" key="key=net"
5+
type=SOCKADDR msg=audit(1492753107.096:9004): saddr=02000050A9FEA9FE0000000000000000
6+
type=PROCTITLE msg=audit(1492753107.096:9004): proctitle="(g_daemon)"

‎filebeat/module/auditd/log/test/audit-ubuntu1604.log-expected.json‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
[
2+
{
3+
"@timestamp": "2017-04-21T05:28:40.441Z",
4+
"auditd.log.a0": "3",
5+
"auditd.log.a1": "7ffd0dc80040",
6+
"auditd.log.a2": "7ffd0dc7ffd0",
7+
"auditd.log.a3": "0",
8+
"auditd.log.items": "0",
9+
"auditd.log.key": "key=net",
10+
"auditd.log.sequence": 8832,
11+
"auditd.log.ses": "4294967295",
12+
"auditd.log.success": "yes",
13+
"auditd.log.syscall": "43",
14+
"auditd.log.tty": "(none)",
15+
"event.action": "syscall",
16+
"event.dataset": "auditd.log",
17+
"event.kind": "event",
18+
"event.module": "auditd",
19+
"fileset.name": "log",
20+
"host.architecture": "x86_64",
21+
"input.type": "log",
22+
"log.offset": 0,
23+
"network.direction": "ingress",
24+
"process.executable": "/usr/sbin/sshd",
25+
"process.exit_code": 5,
26+
"process.name": "sshd",
27+
"process.pid": 1663,
28+
"process.ppid": 1,
29+
"service.type": "auditd",
30+
"user.audit.id": "4294967295",
31+
"user.effective.group.id": "0",
32+
"user.effective.id": "0",
33+
"user.filesystem.group.id": "0",
34+
"user.filesystem.id": "0",
35+
"user.group.id": "0",
36+
"user.id": "0",
37+
"user.saved.group.id": "0",
38+
"user.saved.id": "0"
39+
},
40+
{
41+
"@timestamp": "2017-04-21T05:28:40.441Z",
42+
"auditd.log.saddr": "0200E31C4853E6640000000000000000",
43+
"auditd.log.sequence": 8832,
44+
"event.action": "sockaddr",
45+
"event.dataset": "auditd.log",
46+
"event.kind": "event",
47+
"event.module": "auditd",
48+
"fileset.name": "log",
49+
"input.type": "log",
50+
"log.offset": 300,
51+
"service.type": "auditd"
52+
},
53+
{
54+
"@timestamp": "2017-04-21T05:28:40.441Z",
55+
"auditd.log.proctitle": "(sshd)",
56+
"auditd.log.sequence": 8832,
57+
"event.action": "proctitle",
58+
"event.dataset": "auditd.log",
59+
"event.kind": "event",
60+
"event.module": "auditd",
61+
"fileset.name": "log",
62+
"input.type": "log",
63+
"log.offset": 385,
64+
"service.type": "auditd"
65+
},
66+
{
67+
"@timestamp": "2017-04-21T05:38:27.096Z",
68+
"auditd.log.a0": "5",
69+
"auditd.log.a1": "7ffc12ac3ab0",
70+
"auditd.log.a2": "10",
71+
"auditd.log.a3": "4",
72+
"auditd.log.items": "0",
73+
"auditd.log.key": "key=net",
74+
"auditd.log.sequence": 9004,
75+
"auditd.log.ses": "4294967295",
76+
"auditd.log.success": "no",
77+
"auditd.log.syscall": "42",
78+
"auditd.log.tty": "(none)",
79+
"event.action": "syscall",
80+
"event.dataset": "auditd.log",
81+
"event.kind": "event",
82+
"event.module": "auditd",
83+
"fileset.name": "log",
84+
"host.architecture": "x86_64",
85+
"input.type": "log",
86+
"log.offset": 451,
87+
"network.direction": "egress",
88+
"process.executable": "/usr/bin/python3.5",
89+
"process.exit_code": -115,
90+
"process.name": "google_ip_forwa",
91+
"process.pid": 1648,
92+
"process.ppid": 1,
93+
"service.type": "auditd",
94+
"user.audit.id": "4294967295",
95+
"user.effective.group.id": "0",
96+
"user.effective.id": "0",
97+
"user.filesystem.group.id": "0",
98+
"user.filesystem.id": "0",
99+
"user.group.id": "0",
100+
"user.id": "0",
101+
"user.saved.group.id": "0",
102+
"user.saved.id": "0"
103+
},
104+
{
105+
"@timestamp": "2017-04-21T05:38:27.096Z",
106+
"auditd.log.saddr": "02000050A9FEA9FE0000000000000000",
107+
"auditd.log.sequence": 9004,
108+
"event.action": "sockaddr",
109+
"event.dataset": "auditd.log",
110+
"event.kind": "event",
111+
"event.module": "auditd",
112+
"fileset.name": "log",
113+
"input.type": "log",
114+
"log.offset": 758,
115+
"service.type": "auditd"
116+
},
117+
{
118+
"@timestamp": "2017-04-21T05:38:27.096Z",
119+
"auditd.log.proctitle": "(g_daemon)",
120+
"auditd.log.sequence": 9004,
121+
"event.action": "proctitle",
122+
"event.dataset": "auditd.log",
123+
"event.kind": "event",
124+
"event.module": "auditd",
125+
"fileset.name": "log",
126+
"input.type": "log",
127+
"log.offset": 843,
128+
"service.type": "auditd"
129+
}
130+
]

‎filebeat/module/auditd/log/test/test.log-expected.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
"host.architecture": "x86_64",
4141
"input.type": "log",
4242
"log.offset": 174,
43+
"network.direction": "egress",
4344
"process.executable": "/usr/libexec/strongswan/charon (deleted)",
4445
"process.exit_code": 184,
4546
"process.name": "charon",

‎x-pack/filebeat/module/crowdstrike/falcon/config/pipeline.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,13 @@ var crowdstrikeFalconProcessor = (function () {
4545
var remoteAddress = evt.Get("crowdstrike.event.RemoteAddress");
4646
var remotePort = evt.Get("crowdstrike.event.RemotePort");
4747
if (evt.Get("crowdstrike.event.ConnectionDirection") === "1") {
48-
evt.Put("network.direction", "inbound")
48+
evt.Put("network.direction", "ingress")
4949
evt.Put("source.ip", remoteAddress)
5050
evt.Put("source.port", remotePort)
5151
evt.Put("destination.ip", localAddress)
5252
evt.Put("destination.port", localPort)
5353
} else {
54-
evt.Put("network.direction", "outbound")
54+
evt.Put("network.direction", "egress")
5555
evt.Put("destination.ip", remoteAddress)
5656
evt.Put("destination.port", remotePort)
5757
evt.Put("source.ip", localAddress)

‎x-pack/filebeat/module/crowdstrike/falcon/test/falcon-sample.log-expected.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
],
5757
"log.offset": 0,
5858
"message": "Firewall Rule 'Inbound SMB Block & Log Private' triggered",
59-
"network.direction": "inbound",
59+
"network.direction": "ingress",
6060
"network.type": "ipv4",
6161
"process.pid": "206158879910",
6262
"related.ip": [

0 commit comments

Comments
 (0)