Comments (2)
The reason we built go-audit
was to coalesce all the individual messages that make up an entire event as quick as possible. We use streamstash
at Slack to make these events more meaningful to humans. You could certainly port the parsing code from streamstash
into logstash
.
I piped the line you provided through streamstash
using this and the output is a much more elasticsearch friendly blob:
{
"message": "henrique.goncalves as root succeeded to execve `cat /etc/passwd` via `/usr/bin/cat`",
"go-audit": {
"timestamp": "2017-06-29T00:46:11.657Z",
"sequence": 2487,
"unknown": [],
"syscall": {
"arch": {
"bits": "64",
"endianness": "little",
"name": "x86_64"
},
"success": "yes",
"exit": "0",
"a0": "e4fee0",
"a1": "e510a0",
"a2": "e22540",
"a3": "5a1",
"items": "2",
"ppid": "18824",
"pid": "18848",
"auid": {
"name": "henrique.goncalves",
"id": "1000"
},
"uid": {
"name": "root",
"id": "0"
},
"gid": "0",
"euid": {
"name": "root",
"id": "0"
},
"suid": {
"name": "root",
"id": "0"
},
"fsuid": {
"name": "root",
"id": "0"
},
"egid": "0",
"sgid": "0",
"fsgid": "0",
"tty": "pts0",
"key": "user_commands",
"id": "59",
"session_id": "1",
"name": "execve",
"command": "cat",
"executable": "/usr/bin/cat"
},
"paths": [
{
"name": "/usr/bin/cat",
"inode": "409296",
"dev": "ca:01",
"mode": "0100755",
"ouid": {
"name": "root",
"id": "0"
},
"ogid": "0",
"rdev": "00:00",
"nametype": "NORMAL"
},
{
"name": "/lib64/ld-linux-x86-64.so.2",
"inode": "395436",
"dev": "ca:01",
"mode": "0100755",
"ouid": {
"name": "root",
"id": "0"
},
"ogid": "0",
"rdev": "00:00",
"nametype": "NORMAL"
}
],
"execve": {
"command": "cat /etc/passwd"
},
"proctitle": "cat /etc/passwd"
}
}
from go-audit.
Closed due to inactivity. I think nate explained well ^
from go-audit.
Related Issues (20)
- How to filter to command run in local0 to 7
- Reverse Function for Filters
- Including node hostname/ip info in log HOT 2
- Failed to open syslog writer on LXC HOT 1
- Pre-compiled version? HOT 3
- Replacing auditd with go-audit HOT 1
- wrong app name in syslogs HOT 1
- extras.go does not support disabled container auditing HOT 3
- LXD support
- Migrate away from govendor to go modules
- Migrate from "syscall" to "golang.org/x/sys/unix"
- Consider using code generation (ex: easyjson) for JSON models
- no tags/releases HOT 3
- go-audit relies on github.com/capsule8/capsule8, which was deleted or made private HOT 1
- "type":1305 AUDIT_CONFIG_CHANGE log noise HOT 2
- Do we need to implement logrotate for the go-audit.log file?
- Publish debian packages
- Process dies and go-audit stops logging HOT 2
- Enhance request for ECS compatible go-audit output
- When go-audit and linux auditd are started at the same time, go-audit cannot obtain any data. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from go-audit.