Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Auditbeat auditd module to ECS 1.8 #23594

Merged
merged 11 commits into from
Feb 8, 2021
Merged

Update Auditbeat auditd module to ECS 1.8 #23594

merged 11 commits into from
Feb 8, 2021

Conversation

adriansr
Copy link
Contributor

@adriansr adriansr commented Jan 20, 2021 •
edited
Loading

Updates Auditbeat to new ECS 1.8

  • Support new user/group fields provided by go-libaudit.
  • Support AUDIT_LOGIN.
  • Adds golden file tests to auditd.

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jan 20, 2021
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jan 20, 2021
@adriansr adriansr added the in progress Pull request is currently in progress. label Jan 20, 2021
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jan 20, 2021 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #23594 updated

    • Start Time: 2021-02-06T10:11:03.670+0000

  • Duration: 88 min 32 sec

  • Commit: 785670a

Test stats 🧪

Test Results
Failed 0
Passed 45495
Skipped 4738
Total 50233

Steps errors 1

Expand to view the steps failures

x-pack/elastic-agent-Lint - Install Go/Mage/Python/Docker/Terraform 1.15.7
  • Took 0 min 1 sec . View more details on here
  • Description: .ci/scripts/install-tools.sh

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 45495
Skipped 4738
Total 50233

This was referenced Jan 25, 2021
Closed
Merged
@adriansr adriansr force-pushed the feature-ecs-1.8 branch 2 times, most recently from 8979980 to 376b26f Compare February 1, 2021 14:57
adriansr added 11 commits February 6, 2021 11:06
@adriansr
Populate new user.* and group.* ECS 1.8 fields
8caead2 
Update auditd module to populate user.* and group.* information that is
now provided by libaudit.
@adriansr
Setuid sample logs
dac7611 
These correspond to the syscalls generated by running:
    seteuid(1000)
    setegid(1000)
    setuid(0)
    setgid(0)

From a setuid root:root program.
@adriansr
Support AUDIT_LOGIN message
72a1045
@adriansr
AUDIT_LOGIN sample from kernel < 3.14
e20ac44
@adriansr
Update with session categories
5666253
@adriansr
Sort record_type mapping script params
a266ef6 
For easier to read diffs in following commits.
@adriansr
Update dependency elastic/go-libaudit to v2.2.0
8eb2c95
@adriansr
Adapt to go-libaudit v2.2.0
5d69cc9
@adriansr
Make notice
3c25b77
@adriansr
Fix system module access to uid caches
7d24139
@adriansr
Update supported ECS version to 1.8.0
785670a
@adriansr adriansr changed the title [WIP] Update Auditbeat auditd module to ECS 1.8 Update Auditbeat auditd module to ECS 1.8 Feb 6, 2021
@adriansr adriansr marked this pull request as ready for review February 6, 2021 18:36
@adriansr adriansr requested a review from a team as a code owner February 6, 2021 18:36
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@adriansr adriansr added review and removed in progress Pull request is currently in progress. labels Feb 6, 2021
@adriansr adriansr requested review from marc-gr and removed request for a team February 6, 2021 18:37
@adriansr adriansr merged commit c51272d into elastic:feature-ecs-1.8 Feb 8, 2021
@adriansr adriansr mentioned this pull request Feb 12, 2021
Merged
28 tasks
adriansr added a commit that referenced this pull request Feb 16, 2021
@adriansr @marc-gr
Update Beats to ECS 1.8.0 (#23465)
048c3cc 
Incorporates ECS 1.8 changes from the following PRs:

Support host.type field in add_host_metadata processor and Auditbeat's system/host #23513

Winlogbeat #23563

Auditbeat auditd #23594

Journalbeat #23737

Packetbeat #23783

Filebeat:
    auditd #23723
    cisco #23819
    cef #23832
    crowdstrike falcon #23875
    fortinet firewall #23902
    microsoft #23897
    elasticsearch/audit #24000
    Gsuite/Workspace #23709
    o365 #23896
    zoom #23904
    okta #23929
    aws/cloudtrail #23911
    aws/s3access #23920
    azure #23927
    juniper/srx #23936
    panw #23931
    sophos/xg #23967
    system/auth #23961
    mysqlenterprise #23978
    zeek #23847

Make all Beats and modules report ECS 1.8.0 #23992

Closes #23118

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>
@adriansr adriansr mentioned this pull request Feb 16, 2021
Merged
28 tasks
adriansr added a commit to adriansr/beats that referenced this pull request Feb 17, 2021
@adriansr
Update Beats to ECS 1.8.0 (elastic#23465)
5ca7510 
Incorporates ECS 1.8 changes from the following PRs:

Support host.type field in add_host_metadata processor and Auditbeat's system/host elastic#23513

Winlogbeat elastic#23563

Auditbeat auditd elastic#23594

Journalbeat elastic#23737

Packetbeat elastic#23783

Filebeat:
    auditd elastic#23723
    cisco elastic#23819
    cef elastic#23832
    crowdstrike falcon elastic#23875
    fortinet firewall elastic#23902
    microsoft elastic#23897
    elasticsearch/audit elastic#24000
    Gsuite/Workspace elastic#23709
    o365 elastic#23896
    zoom elastic#23904
    okta elastic#23929
    aws/cloudtrail elastic#23911
    aws/s3access elastic#23920
    azure elastic#23927
    juniper/srx elastic#23936
    panw elastic#23931
    sophos/xg elastic#23967
    system/auth elastic#23961
    mysqlenterprise elastic#23978
    zeek elastic#23847

Make all Beats and modules report ECS 1.8.0 elastic#23992

Closes elastic#23118

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>
(cherry picked from commit 048c3cc)
adriansr added a commit that referenced this pull request Feb 17, 2021
@adriansr
Cherry-pick #23465 to 7.x: Update Beats to ECS 1.8.0 (#24072)
9d1db61 
Incorporates ECS 1.8 changes from the following PRs:

Support host.type field in add_host_metadata processor and Auditbeat's system/host #23513

Winlogbeat #23563

Auditbeat auditd #23594

Journalbeat #23737

Packetbeat #23783

Filebeat:
    auditd #23723
    cisco #23819
    cef #23832
    crowdstrike falcon #23875
    fortinet firewall #23902
    microsoft #23897
    elasticsearch/audit #24000
    Gsuite/Workspace #23709
    o365 #23896
    zoom #23904
    okta #23929
    aws/cloudtrail #23911
    aws/s3access #23920
    azure #23927
    juniper/srx #23936
    panw #23931
    sophos/xg #23967
    system/auth #23961
    mysqlenterprise #23978
    zeek #23847

Make all Beats and modules report ECS 1.8.0 #23992

Closes #23118

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

(cherry picked from commit 048c3cc)
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@adriansr
Update Auditbeat auditd module to ECS 1.8 (elastic#23594)
dc26fbc 
Updates Auditbeat to new ECS 1.8.
- Support new user/group fields provided by go-libaudit.
- Support AUDIT_LOGIN.
- Adds golden file tests to auditd.
- Updates elastic/go-libaudit dependency to v2.2.0.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marc-gr marc-gr marc-gr approved these changes

@andrewstucki andrewstucki Awaiting requested review from andrewstucki

@andrewkroh andrewkroh Awaiting requested review from andrewkroh

@leehinman leehinman Awaiting requested review from leehinman

Assignees
No one assigned
Labels
Auditbeat ecs enhancement review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@adriansr @elasticmachine @marc-gr