« Auditd Logs Integration Auth0 Log Streams Integration »
Elastic Docs ›Elastic integrations ›Auditd

Auditd Manager Integration

edit

Auditd Manager Integration

edit

Version

1.18.2 (View all)

Compatible Kibana version(s)

8.16.0 or higher

Supported Serverless project types
What’s this?

Security
Observability

Subscription level
What’s this?

Basic

Level of support
What’s this?

Elastic

The Auditd Manager Integration receives audit events from the Linux Audit Framework that is a part of the Linux kernel.

This integration is available only for Linux.

Session View powered by Auditd Manager

edit

The Auditd Manager is one of the integrations that can power the Session View utility for the Elastic Security Platform. This feature provides a visual representation of session and process execution data, organized according to the Linux process model to help you investigate process, user, and service activity on your Linux infrastructure.

Enabling Session Data Capture
edit

There are two ways to enable session data capture for the Session View feature:

Method 1: Using the Toggle Switch (Recommended)
edit
  1. Navigate to the Auditd Manager integration configuration in Kibana.
  2. Locate the "Session data" toggle switch.
  3. Turn the switch on to enable session data capture.
Method 2: Manual Configuration
edit
  1. Navigate to the Auditd Manager integration configuration in Kibana.
  2. Add the add_session_metadata processor configuration under the Processors section of Advanced options. 
  - add_session_metadata:
     backend: "auto"
  1. Add these rules to the Audit Rules section of the configuration: 
  -a always,exit -F arch=b64 -S execve,execveat -k exec
  -a always,exit -F arch=b64 -S exit_group
  -a always,exit -F arch=b64 -S setsid

Changes are applied automatically, and you do not have to restart the service.

Important Notes
edit
  • Using the toggle switch (Method 1) automatically applies these configurations, making it the simpler option for most users.
  • When enabling session data capture, be aware that it will collect extended process data, which may have privacy and storage implications.
  • You can disable session data capture at any time by turning off the toggle switch or removing the manual configurations.
  • If you switch between methods or disable the feature, ensure that any conflicting configurations are removed to avoid unexpected behaviour.

How it works

edit

This integration establishes a subscription to the kernel to receive the events as they occur.

The Linux Audit Framework can send multiple messages for a single auditable event. For example, a rename syscall causes the kernel to send eight separate messages. Each message describes a different aspect of the activity that is occurring (the syscall itself, file paths, current working directory, process title). This integration will combine all of the data from each of the messages into a single event.

Messages for one event can be interleaved with messages from another event. This module will buffer the messages in order to combine related messages into a single event even if they arrive interleaved or out of order.

Useful commands

edit

When running this integration, you might find that other monitoring tools interfere with it.

For example, you might encounter errors if another process, such as auditd, is registered to receive data from the Linux Audit Framework. You can use these commands to see if the auditd service is running and stop it:

  • See if auditd is running:

    service auditd status

  • Stop the auditd service:

    service auditd stop

  • Disable auditd from starting on boot:

    `chkconfig auditd off`

  • Stop journald from listening to audit messages (to save CPU usage and disk space):

    systemctl mask systemd-journald-audit.socket

Audit rules

edit

The audit rules are where you configure the activities that are audited. These rules are configured as either syscalls or files that should be monitored. For example you can track all connect syscalls or file system writes to /etc/passwd.

Auditing a large number of syscalls can place a heavy load on the system so consider carefully the rules you define and try to apply filters in the rules themselves to be as selective as possible.

The kernel evaluates the rules in the order in which they were defined so place the most active rules first in order to speed up evaluation.

You can assign keys to each rule for better identification of the rule that triggered an event and easier filtering later in Elasticsearch.

Defining any audit rules in the config causes elastic-agent to purge all existing audit rules prior to adding the rules specified in the config. Therefore it is unnecessary and unsupported to include a -D (delete all) rule.

Examples:

## If you are on a 64 bit platform, everything should be running
## in 64 bit mode. This rule will detect any use of the 32 bit syscalls
## because this might be a sign of someone exploiting a hole in the 32
## bit API.
-a always,exit -F arch=b32 -S all -F key=32bit-abi

## Executions.
-a always,exit -F arch=b64 -S execve,execveat -k exec

## External access (warning: these can be expensive to audit).
-a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access

## Unauthorized access attempts.
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access

# Things that affect identity.
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity

# Unauthorized access attempts to files (unsuccessful).
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access
Example

An example event for auditd looks as following:

{
    "@timestamp": "2022-05-12T13:10:13.230Z",
    "agent": {
        "ephemeral_id": "cfe4170e-f9b4-435f-b19c-a0e75b573b3a",
        "id": "753ce520-4f32-45b1-9212-c4dcc9d575a1",
        "name": "custom-agent",
        "type": "auditbeat",
        "version": "8.2.0"
    },
    "auditd": {
        "data": {
            "a0": "a",
            "a1": "c00024e8c0",
            "a2": "38",
            "a3": "0",
            "arch": "x86_64",
            "audit_pid": "22501",
            "auid": "unset",
            "exit": "56",
            "old": "0",
            "op": "set",
            "result": "success",
            "ses": "unset",
            "socket": {
                "family": "netlink",
                "saddr": "100000000000000000000000"
            },
            "syscall": "sendto",
            "tty": "(none)"
        },
        "message_type": "config_change",
        "messages": [
            "type=CONFIG_CHANGE msg=audit(1652361013.230:94471): op=set audit_pid=22501 old=0 auid=4294967295 ses=4294967295 res=1",
            "type=SYSCALL msg=audit(1652361013.230:94471): arch=c000003e syscall=44 success=yes exit=56 a0=a a1=c00024e8c0 a2=38 a3=0 items=0 ppid=9509 pid=22501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"auditbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat\" key=(null)",
            "type=SOCKADDR msg=audit(1652361013.230:94471): saddr=100000000000000000000000",
            "type=PROCTITLE msg=audit(1652361013.230:94471): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D6239613238612F696E7374616C6C2F6175646974626561742D382E322E302D6C696E75782D7838365F36342F617564697462656174002D63006175646974626561742E656C61737469632D6167656E742E796D6C"
        ],
        "result": "success",
        "summary": {
            "actor": {
                "primary": "unset",
                "secondary": "root"
            },
            "how": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat",
            "object": {
                "primary": "set",
                "type": "audit-config"
            }
        },
        "user": {
            "filesystem": {
                "group": {
                    "id": "0",
                    "name": "root"
                },
                "id": "0",
                "name": "root"
            },
            "saved": {
                "group": {
                    "id": "0",
                    "name": "root"
                },
                "id": "0",
                "name": "root"
            }
        }
    },
    "data_stream": {
        "dataset": "auditd_manager.auditd",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "753ce520-4f32-45b1-9212-c4dcc9d575a1",
        "snapshot": false,
        "version": "8.2.0"
    },
    "event": {
        "action": "changed-audit-configuration",
        "agent_id_status": "verified",
        "category": [
            "process",
            "configuration",
            "network"
        ],
        "dataset": "auditd_manager.auditd",
        "ingested": "2022-05-12T13:10:16Z",
        "kind": "event",
        "module": "auditd",
        "original": "type=CONFIG_CHANGE msg=audit(1652361013.230:94471): op=set audit_pid=22501 old=0 auid=4294967295 ses=4294967295 res=1\ntype=SYSCALL msg=audit(1652361013.230:94471): arch=c000003e syscall=44 success=yes exit=56 a0=a a1=c00024e8c0 a2=38 a3=0 items=0 ppid=9509 pid=22501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"auditbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat\" key=(null)\ntype=SOCKADDR msg=audit(1652361013.230:94471): saddr=100000000000000000000000\ntype=PROCTITLE msg=audit(1652361013.230:94471): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D6239613238612F696E7374616C6C2F6175646974626561742D382E322E302D6C696E75782D7838365F36342F617564697462656174002D63006175646974626561742E656C61737469632D6167656E742E796D6C",
        "outcome": "success",
        "sequence": 94471,
        "type": [
            "change",
            "connection",
            "info"
        ]
    },
    "host": {
        "name": "custom-agent"
    },
    "network": {
        "direction": "egress"
    },
    "process": {
        "executable": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat",
        "name": "auditbeat",
        "parent": {
            "pid": 9509
        },
        "pid": 22501,
        "title": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat -c auditbeat.elastic-agent.yml"
    },
    "service": {
        "type": "auditd"
    },
    "tags": [
        "preserve_original_event",
        "auditd_manager-auditd"
    ],
    "user": {
        "group": {
            "id": "0",
            "name": "root"
        },
        "id": "0",
        "name": "root"
    }
}
Exported fields
Field Description Type

@timestamp

Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.

date

auditd.data

Auditd related data

flattened

auditd.data.a0-N

the arguments to a syscall

keyword

auditd.data.acct

a user’s account name

keyword

auditd.data.acl

access mode of resource assigned to vm

keyword

auditd.data.action

netfilter packet disposition

keyword

auditd.data.added

number of new files detected

long

auditd.data.addr

the remote address that the user is connecting from

keyword

auditd.data.apparmor

apparmor event information

keyword

auditd.data.arch

the elf architecture flags

keyword

auditd.data.argc

the number of arguments to an execve syscall

long

auditd.data.audit_backlog_limit

audit system’s backlog queue size

keyword

auditd.data.audit_backlog_wait_time

audit system’s backlog wait time

keyword

auditd.data.audit_enabled

audit systems’s enable/disable status

keyword

auditd.data.audit_failure

audit system’s failure mode

keyword

auditd.data.audit_pid

long

auditd.data.auid

keyword

auditd.data.banners

banners used on printed page

keyword

auditd.data.bool

name of SELinux boolean

keyword

auditd.data.bus

name of subsystem bus a vm resource belongs to

keyword

auditd.data.cap_fe

file assigned effective capability map

keyword

auditd.data.cap_fi

file inherited capability map

keyword

auditd.data.cap_fp

file permitted capability map

keyword

auditd.data.cap_fver

file system capabilities version number

keyword

auditd.data.cap_pe

process effective capability map

keyword

auditd.data.cap_pi

process inherited capability map

keyword

auditd.data.cap_pp

process permitted capability map

keyword

auditd.data.capability

posix capabilities

keyword

auditd.data.cgroup

path to cgroup in sysfs

keyword

auditd.data.changed

number of changed files

long

auditd.data.cipher

name of crypto cipher selected

keyword

auditd.data.class

resource class assigned to vm

keyword

auditd.data.cmd

command being executed

keyword

auditd.data.code

seccomp action code

keyword

auditd.data.compat

is_compat_task result

keyword

auditd.data.daddr

remote IP address

ip

auditd.data.data

TTY text

keyword

auditd.data.default_context

default MAC context

keyword

auditd.data.device

device name

keyword

auditd.data.dir

directory name

keyword

auditd.data.direction

direction of crypto operation

keyword

auditd.data.dmac

remote MAC address

keyword

auditd.data.dport

remote port number

long

auditd.data.enforcing

new MAC enforcement status

keyword

auditd.data.entries

number of entries in the netfilter table

long

auditd.data.exit

syscall exit code

keyword

auditd.data.fam

socket address family

keyword

auditd.data.family

netfilter protocol

keyword

auditd.data.fd

file descriptor number

keyword

auditd.data.fe

file assigned effective capability map

keyword

auditd.data.feature

kernel feature being changed

keyword

auditd.data.fi

file assigned inherited capability map

keyword

auditd.data.file

file name

keyword

auditd.data.flags

mmap syscall flags

keyword

auditd.data.format

audit log’s format

keyword

auditd.data.fp

crypto key finger print

keyword

auditd.data.frootid

keyword

auditd.data.fver

file system capabilities version number

keyword

auditd.data.grantors

pam modules approving the action

keyword

auditd.data.grp

group name

keyword

auditd.data.hook

netfilter hook that packet came from

keyword

auditd.data.hostname

the hostname that the user is connecting from

keyword

auditd.data.icmp_type

type of icmp message

keyword

auditd.data.id

during account changes

keyword

auditd.data.igid

ipc object’s group ID

keyword

auditd.data.img_ctx

the vm’s disk image context string

keyword

auditd.data.inif

in interface number

keyword

auditd.data.ino

inode number

keyword

auditd.data.inode_gid

group ID of the inode’s owner

keyword

auditd.data.inode_uid

user ID of the inode’s owner

keyword

auditd.data.invalid_context

SELinux context

keyword

auditd.data.ioctlcmd

The request argument to the ioctl syscall

keyword

auditd.data.ip

network address of a printer

ip

auditd.data.ipid

IP datagram fragment identifier

keyword

auditd.data.ipx_net

IPX network number

keyword

auditd.data.items

the number of path records in the event

long

auditd.data.iuid

ipc object’s user ID

keyword

auditd.data.kernel

kernel’s version number

keyword

auditd.data.kind

server or client in crypto operation

keyword

auditd.data.ksize

key size for crypto operation

keyword

auditd.data.laddr

local network address

keyword

auditd.data.len

length

keyword

auditd.data.list

the audit system’s filter list number

keyword

auditd.data.lport

local network port

long

auditd.data.mac

crypto MAC algorithm selected

keyword

auditd.data.macproto

ethernet packet type ID field

keyword

auditd.data.maj

device major number

keyword

auditd.data.major

device major number

keyword

auditd.data.minor

device minor number

keyword

auditd.data.model

security model being used for virt

keyword

auditd.data.msg

the payload of the audit record

keyword

auditd.data.nargs

the number of arguments to a socket call

long

auditd.data.net

network MAC address

keyword

auditd.data.new

value being set in feature

keyword

auditd.data.new_chardev

new character device being assigned to vm

keyword

auditd.data.new_disk

disk being added to vm

keyword

auditd.data.new_enabled

new TTY audit enabled setting

keyword

auditd.data.new_fs

file system being added to vm

keyword

auditd.data.new_gid

new group ID being assigned

keyword

auditd.data.new_level

new run level

keyword

auditd.data.new_lock

new value of feature lock

keyword

auditd.data.new_log_passwd

new value for TTY password logging

keyword

auditd.data.new_mem

new amount of memory in KB

keyword

auditd.data.new_net

MAC address being assigned to vm

keyword

auditd.data.new_pe

new process effective capability map

keyword

auditd.data.new_pi

new process inherited capability map

keyword

auditd.data.new_pp

new process permitted capability map

keyword

auditd.data.new_range

new SELinux range

keyword

auditd.data.new_rng

device name of rng being added from a vm

keyword

auditd.data.new_role

new SELinux role

keyword

auditd.data.new_ses

ses value

keyword

auditd.data.new_seuser

new SELinux user

keyword

auditd.data.new_vcpu

new number of CPU cores

long

auditd.data.nlnk_fam

netlink protocol number

keyword

auditd.data.nlnk_grp

netlink group number

keyword

auditd.data.nlnk_pid

pid of netlink packet sender

long

auditd.data.oauid

object’s login user ID

keyword

auditd.data.obj

lspp object context string

keyword

auditd.data.obj_gid

group ID of object

keyword

auditd.data.obj_uid

user ID of object

keyword

auditd.data.ocomm

object’s command line name

keyword

auditd.data.oflag

open syscall flags

keyword

auditd.data.old

old value

keyword

auditd.data.old_auid

previous auid value

keyword

auditd.data.old_chardev

present character device assigned to vm

keyword

auditd.data.old_disk

disk being removed from vm

keyword

auditd.data.old_enabled

present TTY audit enabled setting

keyword

auditd.data.old_enforcing

old MAC enforcement status

keyword

auditd.data.old_fs

file system being removed from vm

keyword

auditd.data.old_level

old run level

keyword

auditd.data.old_lock

present value of feature lock

keyword

auditd.data.old_log_passwd

present value for TTY password logging

keyword

auditd.data.old_mem

present amount of memory in KB

keyword

auditd.data.old_net

present MAC address assigned to vm

keyword

auditd.data.old_pa

keyword

auditd.data.old_pe

old process effective capability map

keyword

auditd.data.old_pi

old process inherited capability map

keyword

auditd.data.old_pp

old process permitted capability map

keyword

auditd.data.old_prom

network promiscuity flag

keyword

auditd.data.old_range

present SELinux range

keyword

auditd.data.old_rng

device name of rng being removed from a vm

keyword

auditd.data.old_role

present SELinux role

keyword

auditd.data.old_ses

previous ses value

keyword

auditd.data.old_seuser

present SELinux user

keyword

auditd.data.old_val

current value of SELinux boolean

keyword

auditd.data.old_vcpu

present number of CPU cores

long

auditd.data.op

the operation being performed that is audited

keyword

auditd.data.opid

object’s process ID

long

auditd.data.oses

object’s session ID

keyword

auditd.data.outif

out interface number

keyword

auditd.data.pa

keyword

auditd.data.parent

the inode number of the parent file

keyword

auditd.data.pe

keyword

auditd.data.per

linux personality

keyword

auditd.data.perm

the file permission being used

keyword

auditd.data.perm_mask

file permission mask that triggered a watch event

keyword

auditd.data.permissive

SELinux is in permissive mode

keyword

auditd.data.pfs

perfect forward secrecy method

keyword

auditd.data.pi

keyword

auditd.data.pp

keyword

auditd.data.printer

printer name

keyword

auditd.data.prom

network promiscuity flag

keyword

auditd.data.proto

network protocol

keyword

auditd.data.qbytes

ipc objects quantity of bytes

keyword

auditd.data.range

user’s SE Linux range

keyword

auditd.data.reason

text string denoting a reason for the action

keyword

auditd.data.removed

number of deleted files

long

auditd.data.res

result of the audited operation(success/fail)

keyword

auditd.data.reset

keyword

auditd.data.resrc

resource being assigned

keyword

auditd.data.result

keyword

auditd.data.rport

remote port number

long

auditd.data.sauid

sent login user ID

keyword

auditd.data.scontext

the subject’s context string

keyword

auditd.data.selected_context

new MAC context assigned to session

keyword

auditd.data.seperm

SELinux permission being decided on

keyword

auditd.data.seperms

SELinux permissions being used

keyword

auditd.data.seqno

sequence number

long

auditd.data.seresult

SELinux AVC decision granted/denied

keyword

auditd.data.ses

login session ID

keyword

auditd.data.seuser

user’s SE Linux user acct

keyword

auditd.data.sig

signal number

keyword

auditd.data.sigev_signo

signal number

keyword

auditd.data.smac

local MAC address

keyword

auditd.data.socket.addr

The remote address.

keyword

auditd.data.socket.family

The socket family (unix, ipv4, ipv6, netlink).

keyword

auditd.data.socket.path

This is the path associated with a unix socket.

keyword

auditd.data.socket.port

The port number.

long

auditd.data.socket.saddr

The raw socket address structure.

keyword

auditd.data.spid

sent process ID

long

auditd.data.sport

local port number

long

auditd.data.state

audit daemon configuration resulting state

keyword

auditd.data.subj

lspp subject’s context string

keyword

auditd.data.success

whether the syscall was successful or not

keyword

auditd.data.syscall

syscall number in effect when the event occurred

keyword

auditd.data.table

netfilter table name

keyword

auditd.data.tclass

target’s object classification

keyword

auditd.data.tcontext

the target’s or object’s context string

keyword

auditd.data.terminal

terminal name the user is running programs on

keyword

auditd.data.tty

tty udevice the user is running programs on

keyword

auditd.data.unit

systemd unit

keyword

auditd.data.uri

URI pointing to a printer

keyword

auditd.data.uuid

a UUID

keyword

auditd.data.val

generic value associated with the operation

keyword

auditd.data.ver

audit daemon’s version number

keyword

auditd.data.virt

kind of virtualization being referenced

keyword

auditd.data.vm

virtual machine name

keyword

auditd.data.vm_ctx

the vm’s context string

keyword

auditd.data.vm_pid

vm’s process ID

long

auditd.data.watch

file name in a watch record

keyword

auditd.file.selinux.domain

The actor’s SELinux domain or type.

keyword

auditd.file.selinux.level

The actor’s SELinux level.

keyword

auditd.file.selinux.role

User’s SELinux role

keyword

auditd.file.selinux.user

Account submitted for authentication

keyword

auditd.message_type

The audit message type (e.g. syscall or apparmor_denied).

keyword

auditd.messages

An ordered list of the raw messages received from the kernel that were used to construct this document. This field is present if an error occurred processing the data or if include_raw_message is set in the config.

keyword

auditd.paths

flattened

auditd.paths.dev

Device name as found in /dev

keyword

auditd.paths.inode

inode number

keyword

auditd.paths.item

Which item is being recorded

keyword

auditd.paths.mode

Mode flags on a file

keyword

auditd.paths.name

File name in avcs

keyword

auditd.paths.nametype

Kind of file operation being referenced

keyword

auditd.paths.obj_domain

keyword

auditd.paths.obj_level

keyword

auditd.paths.obj_role

keyword

auditd.paths.obj_type

keyword

auditd.paths.obj_user

keyword

auditd.paths.ogid

File owner group ID

keyword

auditd.paths.ouid

File owner user ID

keyword

auditd.paths.rdev

The device identifier (special files only)

keyword

auditd.result

The result of the audited operation (success/fail).

keyword

auditd.session

The session ID assigned to a login. All events related to a login session will have the same value.

keyword

auditd.summary.actor.primary

The primary identity of the actor. This is the actor’s original login ID. It will not change even if the user changes to another account.

keyword

auditd.summary.actor.secondary

The secondary identity of the actor. This is typically the same as the primary, except for when the user has used su.

keyword

auditd.summary.how

This describes how the action was performed. Usually this is the exe or command that was being executed that triggered the event.

keyword

auditd.summary.object.primary

keyword

auditd.summary.object.secondary

keyword

auditd.summary.object.type

A description of the what the "thing" is (e.g. file, socket, user-session).

keyword

auditd.user.audit.id

keyword

auditd.user.audit.name

keyword

auditd.user.filesystem.group.id

keyword

auditd.user.filesystem.group.name

keyword

auditd.user.filesystem.id

keyword

auditd.user.filesystem.name

keyword

auditd.user.new_auid.id

keyword

auditd.user.new_auid.name

keyword

auditd.user.old_auid.id

keyword

auditd.user.old_auid.name

keyword

auditd.user.saved.group.id

keyword

auditd.user.saved.group.name

keyword

auditd.user.saved.id

keyword

auditd.user.saved.name

keyword

auditd.user.selinux.category

The actor’s SELinux category or compartments.

keyword

auditd.user.selinux.domain

The actor’s SELinux domain or type.

keyword

auditd.user.selinux.level

The actor’s SELinux level.

keyword

auditd.user.selinux.role

User’s SELinux role

keyword

auditd.user.selinux.user

Account submitted for authentication

keyword

auditd.warnings

The warnings generated by the Beat during the construction of the event. These are disabled by default and are used for development and debug purposes only.

keyword

data_stream.dataset

Data stream dataset.

constant_keyword

data_stream.namespace

Data stream namespace.

constant_keyword

data_stream.type

Data stream type.

constant_keyword

destination.address

Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain, depending on which one it is.

keyword

destination.ip

IP address of the destination (IPv4 or IPv6).

ip

destination.port

Port of the destination.

long

ecs.version

ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices — which may conform to slightly different ECS versions — this field lets integrations adjust to the schema version of the events.

keyword

event.dataset

Event dataset

constant_keyword

event.id

Unique ID to describe the event.

keyword

event.module

Event module

constant_keyword

event.outcome

This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. event.outcome simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of event.outcome, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with event.type:info, or any events for which an outcome does not make logical sense.

keyword

file.device

Device that is the source of the file.

keyword

file.gid

Primary group ID (GID) of the file.

keyword

file.group

Primary group name of the file.

keyword

file.inode

Inode representing the file in the filesystem.

keyword

file.mode

Mode of the file in octal representation.

keyword

file.owner

File owner’s username.

keyword

file.path

Full path to the file, including the file name. It should include the drive letter, when appropriate.

keyword

file.path.text

Multi-field of file.path.

match_only_text

file.uid

The user ID (UID) or security identifier (SID) of the file owner.

keyword

group.id

Unique identifier for the group on the system/platform.

keyword

group.name

Name of the group.

keyword

network.direction

Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host’s point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.

keyword

process.args

Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information.

keyword

process.executable

Absolute path to the process executable.

keyword

process.executable.text

Multi-field of process.executable.

match_only_text

process.exit_code

The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start).

long

process.name

Process name. Sometimes called program name or similar.

keyword

process.name.text

Multi-field of process.name.

match_only_text

process.parent.pid

Process id.

long

process.pid

Process id.

long

process.title

Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.

keyword

process.title.text

Multi-field of process.title.

match_only_text

process.working_directory

The working directory of the process.

keyword

process.working_directory.text

Multi-field of process.working_directory.

match_only_text

related.user

All the user names or other user identifiers seen on the event.

keyword

service.type

The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, service.type would be elasticsearch.

keyword

source.address

Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain, depending on which one it is.

keyword

source.ip

IP address of the source (IPv4 or IPv6).

ip

source.port

Port of the source.

long

tags

List of keywords used to tag each event.

keyword

user.effective.group.id

Unique identifier for the group on the system/platform.

keyword

user.effective.group.name

Name of the group.

keyword

user.effective.id

Unique identifier of the user.

keyword

user.effective.name

Short name or login of the user.

keyword

user.effective.name.text

Multi-field of user.effective.name.

match_only_text

user.group.id

Unique identifier for the group on the system/platform.

keyword

user.group.name

Name of the group.

keyword

user.id

Unique identifier of the user.

keyword

user.name

Short name or login of the user.

keyword

user.name.text

Multi-field of user.name.

match_only_text

user.target.group.id

Unique identifier for the group on the system/platform.

keyword

user.target.group.name

Name of the group.

keyword

user.target.id

Unique identifier of the user.

keyword

user.target.name

Short name or login of the user.

keyword

user.target.name.text

Multi-field of user.target.name.

match_only_text

Changelog

edit
Changelog
Version Details Kibana version(s)

1.18.2

Enhancement (View pull request)
Added Session data option

8.16.0 or higher

1.18.1

Bug fix (View pull request)
Reverting Session data option

8.16.0 or higher

1.18.0

Enhancement (View pull request)
Added Session data option

8.16.0 or higher
9.0.0 or higher

1.17.1

Enhancement (View pull request)
Doc: Add doc for configuring Auditd Manager for Session View

8.12.0 or higher

1.17.0

Enhancement (View pull request)
Allow @custom pipeline access to event.original without setting preserve_original_event.

8.12.0 or higher

1.16.4

Bug fix (View pull request)
Fix audit_rule_files

8.7.1 or higher

1.16.3

Enhancement (View pull request)
capture root requirement

8.7.1 or higher

1.16.2

Enhancement (View pull request)
Changed owners

8.7.1 or higher

1.16.1

Bug fix (View pull request)
Fix socket type selection and documentation.

8.7.1 or higher

1.16.0

Enhancement (View pull request)
ECS version updated to 8.11.0.

8.7.1 or higher

1.15.0

Enhancement (View pull request)
ECS version updated to 8.10.0.

8.7.1 or higher

1.14.0

Enhancement (View pull request)
The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added owner.type: elastic to package manifest.

8.7.1 or higher

1.13.0

Enhancement (View pull request)
Add tags.yml file so that integration’s dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.

8.7.1 or higher

1.12.0

Enhancement (View pull request)
Update package to ECS 8.9.0.

8.7.1 or higher

1.11.0

Enhancement (View pull request)
Convert visualizations to lens.

8.7.1 or higher

1.10.0

Enhancement (View pull request)
Ensure event.kind is correctly set for pipeline errors.

8.4.0 or higher

1.9.0

Enhancement (View pull request)
Update package to ECS 8.8.0.

8.4.0 or higher

1.8.0

Enhancement (View pull request)
Update package-spec version to 2.7.0.

8.4.0 or higher

1.7.1

Bug fix (View pull request)
Fix wrong field type for auditd.data.exit

8.4.0 or higher

1.7.0

Enhancement (View pull request)
Update package to ECS 8.7.0.

8.4.0 or higher

1.6.1

Enhancement (View pull request)
Added categories and/or subcategories.

8.4.0 or higher

1.6.0

Enhancement (View pull request)
Update package to ECS 8.6.0.

8.4.0 or higher

1.5.0

Enhancement (View pull request)
Add audit rule files option.

8.4.0 or higher

1.4.0

Enhancement (View pull request)
Update package to ECS 8.5.0.

8.4.0 or higher

1.3.0

Enhancement (View pull request)
Update package to ECS 8.4.0

8.4.0 or higher

1.2.0

Enhancement (View pull request)
Expose immutable option.

Enhancement (View pull request)
Change audit rules to be a textarea instead of a list.

8.4.0 or higher

1.1.0

Enhancement (View pull request)
Update package to ECS 8.3.0.

8.2.0 or higher

1.0.0

Enhancement (View pull request)
Initial release

8.2.0 or higher
« Auditd Logs Integration Auth0 Log Streams Integration »