Skip to content

Commit c6a6685

Browse files
author
Andrew Stucki
committed
[Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom
1 parent d38a5d0 commit c6a6685

23 files changed

Lines changed: 444 additions & 164 deletions

‎filebeat/module/auditd/log/ingest/pipeline.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,94 @@ processors:
176176
- set:
177177
field: event.kind
178178
value: event
179+
- set:
180+
if: "ctx.auditd.log?.record_type == 'CONFIG_CHANGE'"
181+
field: event.category
182+
value: configuration
183+
- set:
184+
if: "ctx.auditd.log?.record_type == 'CONFIG_CHANGE'"
185+
field: event.type
186+
value: change
187+
- set:
188+
if: "ctx.auditd.log?.record_type == 'DAEMON_CONFIG'"
189+
field: event.category
190+
value: configuration
191+
- set:
192+
if: "ctx.auditd.log?.record_type == 'DAEMON_CONFIG'"
193+
field: event.type
194+
value: change
195+
- set:
196+
if: "ctx.auditd.log?.record_type == 'DAEMON_RECONFIG'"
197+
field: event.category
198+
value: configuration
199+
- set:
200+
if: "ctx.auditd.log?.record_type == 'DAEMON_RECONFIG'"
201+
field: event.type
202+
value: info
203+
- set:
204+
if: "ctx.auditd.log?.record_type == 'USYS_CONFIG'"
205+
field: event.category
206+
value: configuration
207+
- set:
208+
if: "ctx.auditd.log?.record_type == 'USYS_CONFIG'"
209+
field: event.type
210+
value: info
211+
- set:
212+
if: "ctx.auditd.log?.record_type == 'NETFILTER_CFG'"
213+
field: event.category
214+
value: configuration
215+
- set:
216+
if: "ctx.auditd.log?.record_type == 'NETFILTER_CFG'"
217+
field: event.type
218+
value: info
219+
- set:
220+
if: "ctx.auditd.log?.record_type == 'FEATURE_CHANGE'"
221+
field: event.category
222+
value: configuration
223+
- set:
224+
if: "ctx.auditd.log?.record_type == 'FEATURE_CHANGE'"
225+
field: event.type
226+
value: info
227+
- set:
228+
if: "ctx.auditd.log?.record_type == 'MAC_CONFIG_CHANGE'"
229+
field: event.category
230+
value: configuration
231+
- set:
232+
if: "ctx.auditd.log?.record_type == 'MAC_CONFIG_CHANGE'"
233+
field: event.type
234+
value: info
235+
- set:
236+
if: "ctx.auditd.log?.record_type == 'MAC_POLICY_LOAD'"
237+
field: event.category
238+
value: configuration
239+
- set:
240+
if: "ctx.auditd.log?.record_type == 'MAC_POLICY_LOAD'"
241+
field: event.type
242+
value: access
243+
- set:
244+
if: "ctx.auditd.log?.record_type == 'MAC_STATUS'"
245+
field: event.category
246+
value: configuration
247+
- set:
248+
if: "ctx.auditd.log?.record_type == 'MAC_STATUS'"
249+
field: event.type
250+
value: change
251+
- set:
252+
if: "ctx.auditd.log?.record_type == 'USER_MAC_CONFIG_CHANGE'"
253+
field: event.category
254+
value: configuration
255+
- set:
256+
if: "ctx.auditd.log?.record_type == 'USER_MAC_CONFIG_CHANGE'"
257+
field: event.type
258+
value: change
259+
- set:
260+
if: "ctx.auditd.log?.record_type == 'USER_MAC_POLICY_LOAD'"
261+
field: event.category
262+
value: configuration
263+
- set:
264+
if: "ctx.auditd.log?.record_type == 'USER_MAC_POLICY_LOAD'"
265+
field: event.type
266+
value: access
179267
- set:
180268
if: "ctx.auditd.log?.record_type == 'USER_AUTH'"
181269
field: event.category

‎filebeat/module/auditd/log/test/audit-cent7-node.log-expected.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,12 @@
3131
"auditd.log.ses": "4294967295",
3232
"auditd.log.subj": "system_u:system_r:unconfined_service_t:s0",
3333
"event.action": "config_change",
34+
"event.category": "configuration",
3435
"event.dataset": "auditd.log",
3536
"event.kind": "event",
3637
"event.module": "auditd",
3738
"event.outcome": "1",
39+
"event.type": "change",
3840
"fileset.name": "log",
3941
"input.type": "log",
4042
"log.offset": 234,
@@ -50,10 +52,12 @@
5052
"auditd.log.ses": "4294967295",
5153
"auditd.log.subj": "system_u:system_r:unconfined_service_t:s0",
5254
"event.action": "config_change",
55+
"event.category": "configuration",
5356
"event.dataset": "auditd.log",
5457
"event.kind": "event",
5558
"event.module": "auditd",
5659
"event.outcome": "1",
60+
"event.type": "change",
5761
"fileset.name": "log",
5862
"input.type": "log",
5963
"log.offset": 425,

0 commit comments

Comments
 (0)