auditd

Things are looking pretty good, still a few small findings.

Full event

Sorry for the big paste, but this is a bit more complete than what's in auditbeat/module/auditd/_meta/data.json :-)

  {
    "@timestamp": "2019-01-16T16:24:35.439Z",
    "process": {
      "name": "adduser",
      "executable": "/usr/bin/perl",
      "cwd": "/home/vagrant",
      "args": [
        "/usr/bin/perl",
        "/usr/sbin/adduser",
        "--system",
        "--shell",
        "/bin/sh",
        "--gecos",
        "git version control",
        "--group",
        "--disabled-password",
        "--home",
        "/home/git",
        "git"
      ],
      "pid": "2172",
      "ppid": "2171",
      "title": "/usr/bin/perl /usr/sbin/adduser --system --shell /bin/sh --gecos git version control --group --disabled-password --home /home/gi"
    },
    "file": {
      "device": "00:00",
      "inode": "23928",
      "mode": "0755",
      "uid": "0",
      "gid": "0",
      "owner": "root",
      "group": "root",
      "path": "/usr/sbin/adduser"
    },
    "ecs": {
      "version": "1.0.0-beta2"
    },
    "auditd": {
      "paths": [
        {
          "name": "/usr/sbin/adduser",
          "rdev": "00:00",
          "dev": "08:01",
          "inode": "23928",
          "item": "0",
          "mode": "0100755",
          "nametype": "NORMAL",
          "ogid": "0",
          "ouid": "0"
        },
        {
          "ogid": "0",
          "rdev": "00:00",
          "dev": "08:01",
          "inode": "6519",
          "item": "1",
          "mode": "0100755",
          "name": "/usr/bin/perl",
          "nametype": "NORMAL",
          "ouid": "0"
        },
        {
          "rdev": "00:00",
          "inode": "1992",
          "item": "2",
          "mode": "0100755",
          "name": "/lib64/ld-linux-x86-64.so.2",
          "dev": "08:01",
          "nametype": "NORMAL",
          "ogid": "0",
          "ouid": "0"
        }
      ],
      "sequence": 328,
      "result": "success",
      "session": "4",
      "data": {
        "a0": "561e808d7bf8",
        "tty": "pts2",
        "argc": "12",
        "syscall": "execve",
        "arch": "x86_64",
        "a2": "561e808d3340",
        "a1": "561e808d7fc8",
        "exit": "0",
        "a3": "561e808e5000"
      },
      "summary": {
        "actor": {
          "primary": "vagrant",
          "secondary": "root"
        },
        "object": {
          "primary": "/usr/sbin/adduser",
          "type": "file"
        },
        "how": "adduser"
      }
    },
    "event": {
      "action": "executed",
      "module": "auditd",
      "category": "audit-rule",
      "type": "syscall"
    },
    "user": {
      "gid": "0",
      "egid": "0",
      "fsuid": "0",
      "name_map": {
        "auid": "vagrant",
        "egid": "root",
        "suid": "root",
        "euid": "root",
        "fsgid": "root",
        "fsuid": "root",
        "gid": "root",
        "sgid": "root",
        "uid": "root"
      },
      "uid": "0",
      "fsgid": "0",
      "suid": "0",
      "euid": "0",
      "auid": "1000",
      "sgid": "0"
    },
    "tags": [
      "exec"
    ],
    "host": {
      "os": {
        "family": "debian",
        "name": "Ubuntu",
        "kernel": "4.4.0-141-generic",
        "codename": "xenial",
        "platform": "ubuntu",
        "version": "16.04.5 LTS (Xenial Xerus)"
      },
      "id": "0fbf7167b91d4a638fa27721c4979897",
      "containerized": false,
      "hostname": "ubuntu-xenial",
      "architecture": "x86_64",
      "name": "ubuntu-xenial"
    },
    "agent": {
      "id": "854f70dc-41b1-48d4-8af1-e73ebd3686e7",
      "version": "7.0.0",
      "type": "auditbeat",
      "ephemeral_id": "73be6278-848a-44da-88cc-f379ecf4a38e",
      "hostname": "ubuntu-xenial"
    },
    "service": {
      "type": "auditd"
    }
  }

user

The Auditd module can nest a lot of information under user, especially when there's privilege escalation going on. In the event above, vagrant is sudoing as root.

ECS uses the user field set to describe one user (It's id, name, full_name, etc.), where the Auditd module here uses the namespace to report all of the possible user IDs that will lead to the effective user ID for the event (e.g. suid and auid).

When ECS tackles this, I think the fields for this will either be elsewhere in the event structure, or be exactly this, because this is the exact nomenclature in Posix environments. So I'm not too worried about leaving this as is for now.

Two notable things, however, is that user.id and user.name are not populated yet.

I think the final privilege level should be used to populate user.id and user.name by copying the data over, not by renaming the existing fields. In the above case, user.id:0, user.name:root; in the case of a normal service suid (e.g. Apache), user.name:apache.

WDYT @ruflin and @MikePaquette?

Rest of the event

Out of scope for this review: agent, host, ecs and the base fields.
auditd section is custom, that's perfectly fine
process is fine with one exception
- process.cwd should be migrated to process.working_directory
file and service are fine
Type coercions: ideally the PIDs should be coerced to longs. The index mapping has them as long already, so we're mostly fine. But coercing would also ensure the _source also always looks the same across event sources.
- Note that I'm specifically leaving the extra user IDs out of this comment, since they're not in ECS, and they're currently keyword indexed.

Conclusion

process.cwd should be migrated to process.working_directory
Coerce process.pid and process.ppid to long
Populate user.id and user.name with the effective user
Populate group.id and group.name with the effective group

[Auditbeat] Review Auditbeat's auditd and FIM modules with regards to conforming to ECS #10111

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions