gurucleff / logstash-auditd

logstash 5.4 auditd filter

logstash-auditd

Logstash/grok filter for parsing auditd event logs and display it on the official module dashboard. Elasticsearch docs seems to have example filters for all the other filebeat modules except this one.

Made with Logstash 5.4, tested on CentOS 6. Might not work properly, feel free to contribute.

In order to get exec events logged we need to ensure that the following exists in /etc/audit/audit.rules.

-a exit,always -F arch=b64 -S execve
-a exit,always -F arch=b32 -S execve

The filters are in the following order of record_type processing groups

DAEMON_START
LOGIN
USER_LOGIN
EXECVE
SYSCALL
CRED_ACQ USER_CMD USER_START USER_ACCT USER_END
CWD PATH BPRM_FCAPS (pretty generic, probably will match everything else)

Enjoy!

logstash-auditd's Issues

GeoIP Mapping Fix

Still learning the ins and outs of Github and not sure how to pull/fix your repo. Thanks for the snippit as I've spent most the day trying to figure out this and yours almost worked out of the box. The only thing broke in yours was the geolocation and that was just missing a small piece.

Yours:

	geoip {
		source => "[auditd][log][addr]"
		target => "[auditd][geoip]"
	}

Should be:

	geoip {
		source => "[auditd][log][addr]"
		target => "[auditd][log][geoip]"
	}

As soon as I added [log] it worked! Thanks again.