Skip to content

Instantly share code, notes, and snippets.

@sl1pm4t

sl1pm4t/auditd logstash

Last active August 29, 2015 14:09
Show Gist options
  • Save sl1pm4t/ac7ff82b9f2e3a5802a6 to your computer and use it in GitHub Desktop.
Save sl1pm4t/ac7ff82b9f2e3a5802a6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. sl1pm4t revised this gist Jan 11, 2015. 2 changed files with 55 additions and 55 deletions.
    55 changes: 55 additions & 0 deletions auditd logstash
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,55 @@
    GROK PATTERN

    AUDIT type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): argc=(%{NUMBER:audit_argc}) %{GREEDYDATA:audit_raw_args}



    # Logstash Conf snippet

    filter {

    grok {
    match => { "message" => "%{AUDIT}" }
    }

    mutate
    {
    convert => [ "audit_argc", "integer" ]
    }

    ruby {
    code => "
    if !event['audit_argc'].nil? && event['audit_argc'] > 0 && !event['audit_raw_args'].nil?
    argc = event['audit_argc']
    raw_args = event['audit_raw_args']
    event['audit_args'] = ''

    for i in 0..(argc - 1)
    arg_key = 'a' + i.to_s

    arg_match = raw_args.match(arg_key+'=\"(.*?)\"')

    if !arg_match.nil?
    event[arg_key] = arg_match.captures[0].to_s
    event['audit_args'] = event['audit_args'] + ' ' + arg_match.captures[0].to_s
    end

    end
    end"
    }

    }




    # Example input line:

    # type=EXECVE msg=audit(1415736961.619:352083): argc=4 a0="/bin/bash" a1="/usr/bin/tester" a2="-H" a3="cool"







    55 changes: 0 additions & 55 deletions auditd logstash
    View file
    Original file line number Diff line number Diff line change
    @@ -1,55 +0,0 @@
    GROK PATTERN

    AUDIT type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): argc=(%{NUMBER:audit_argc}) %{GREEDYDATA:audit_raw_args}



    Logstash Conf snippet

    filter {

    grok {
    match => { "message" => "%{AUDIT}" }
    }

    mutate
    {
    convert => [ "audit_argc", "integer" ]
    }

    ruby {
    code => "
    if !event['audit_argc'].nil? && event['audit_argc'] > 0 && !event['audit_raw_args'].nil?;
    argc = event['audit_argc'];
    raw_args = event['audit_raw_args'];
    event['audit_args'] = ''

    for i in 0..(argc - 1);
    argKey = 'a' + i.to_s

    argMatch = raw_args.match(argKey+'=\"(.*?)\"')

    if !argMatch.nil?
    event[argKey] = argMatch.captures[0].to_s;
    event['audit_args'] = event['audit_args'] + ' ' + argMatch.captures[0].to_s
    end

    end
    end"
    }

    }




    Example input line:

    type=EXECVE msg=audit(1415736961.619:352083): argc=4 a0="/bin/bash" a1="/usr/bin/tester" a2="-H" a3="cool"







  2. sl1pm4t created this gist Nov 11, 2014.
    55 changes: 55 additions & 0 deletions auditd logstash
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,55 @@
    GROK PATTERN

    AUDIT type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): argc=(%{NUMBER:audit_argc}) %{GREEDYDATA:audit_raw_args}



    Logstash Conf snippet

    filter {

    grok {
    match => { "message" => "%{AUDIT}" }
    }

    mutate
    {
    convert => [ "audit_argc", "integer" ]
    }

    ruby {
    code => "
    if !event['audit_argc'].nil? && event['audit_argc'] > 0 && !event['audit_raw_args'].nil?;
    argc = event['audit_argc'];
    raw_args = event['audit_raw_args'];
    event['audit_args'] = ''

    for i in 0..(argc - 1);
    argKey = 'a' + i.to_s

    argMatch = raw_args.match(argKey+'=\"(.*?)\"')

    if !argMatch.nil?
    event[argKey] = argMatch.captures[0].to_s;
    event['audit_args'] = event['audit_args'] + ' ' + argMatch.captures[0].to_s
    end

    end
    end"
    }

    }




    Example input line:

    type=EXECVE msg=audit(1415736961.619:352083): argc=4 a0="/bin/bash" a1="/usr/bin/tester" a2="-H" a3="cool"