Log-Munger
view release on metacpan or search on metacpan
share/auditd.yaml view on Meta::CPAN
result: 'type=CRED_ACQ msg=audit(1700000001.500:457): pid=1234 uid=0 auid=1000 ses=3 msg=''op=PAM:setcred grantors=pam_unix acct="root" exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=success'''
negative:
- 'type=USER_LOGIN msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD_USER_LOGIN:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=USER_LOGIN msg=audit(1700000002.000:458): pid=1234 uid=0 auid=1000 ses=3 msg=''op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=success'''
result: 'type=USER_LOGIN msg=audit(1700000002.000:458): pid=1234 uid=0 auid=1000 ses=3 msg=''op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=success'''
- string: 'type=USER_LOGIN msg=audit(1700000003.000:459): pid=999 uid=0 auid=0 ses=1 msg=''op=login acct="badguy" exe="/usr/sbin/sshd" hostname=? addr=198.51.100.9 terminal=ssh res=failed'''
result: 'type=USER_LOGIN msg=audit(1700000003.000:459): pid=999 uid=0 auid=0 ses=1 msg=''op=login acct="badguy" exe="/usr/sbin/sshd" hostname=? addr=198.51.100.9 terminal=ssh res=failed'''
negative:
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD_USER_CMD:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=USER_CMD msg=audit(1700000004.000:460): pid=2222 uid=1000 auid=1000 ses=3 msg=''cwd="/home/neti" cmd=6C73202D6C61 terminal=pts/0 res=success'''
result: 'type=USER_CMD msg=audit(1700000004.000:460): pid=2222 uid=1000 auid=1000 ses=3 msg=''cwd="/home/neti" cmd=6C73202D6C61 terminal=pts/0 res=success'''
- string: 'type=USER_CMD msg=audit(1700000005.000:461): pid=2223 uid=1000 auid=1000 ses=3 msg=''cwd="/root" cmd=6964 terminal=pts/1 res=failed'''
result: 'type=USER_CMD msg=audit(1700000005.000:461): pid=2223 uid=1000 auid=1000 ses=3 msg=''cwd="/root" cmd=6964 terminal=pts/1 res=failed'''
negative:
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD_USER_MGMT:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=ADD_USER msg=audit(1700000006.000:462): pid=3333 uid=0 auid=0 ses=2 msg=''op=add-user id=1500 exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=success'''
result: 'type=ADD_USER msg=audit(1700000006.000:462): pid=3333 uid=0 auid=0 ses=2 msg=''op=add-user id=1500 exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=success'''
- string: 'type=DEL_GROUP msg=audit(1700000007.000:463): pid=3334 uid=0 auid=0 ses=2 msg=''op=delete-group grp="devs" exe="/usr/sbin/groupdel" hostname=? addr=? terminal=pts/0 res=success'''
result: 'type=DEL_GROUP msg=audit(1700000007.000:463): pid=3334 uid=0 auid=0 ses=2 msg=''op=delete-group grp="devs" exe="/usr/sbin/groupdel" hostname=? addr=? terminal=pts/0 res=success'''
negative:
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD_AVC:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=AVC msg=audit(1700000008.000:464): avc: denied { read } for pid=4444 comm="httpd" name="passwd" dev="sda1" ino=1234 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0'
result: 'type=AVC msg=audit(1700000008.000:464): avc: denied { read } for pid=4444 comm="httpd" name="passwd" dev="sda1" ino=1234 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0'
- string: 'type=AVC msg=audit(1700000009.000:465): avc: granted { execute } for pid=4445 comm="sh" scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file'
result: 'type=AVC msg=audit(1700000009.000:465): avc: granted { execute } for pid=4445 comm="sh" scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file'
negative:
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD_APPARMOR:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
result: 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
# Profile-load status record: no operation=, and the tail is optional.
- string: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
result: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
negative:
# SELinux AVC prose belongs to AUDITD_AVC, not to AppArmor.
- 'type=AVC msg=audit(1700000008.000:464): avc: denied { read } for pid=4444 comm="httpd" tclass=file'
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD_APPARMOR_DBUS:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" m...
result: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" m...
- string: 'type=USER_AVC msg=audit(1700000015.000:471): pid=1 uid=0 msg=''apparmor="ALLOWED" operation="dbus_signal" bus="session" exe="/usr/bin/dbus-daemon" terminal=?'''
result: 'type=USER_AVC msg=audit(1700000015.000:471): pid=1 uid=0 msg=''apparmor="ALLOWED" operation="dbus_signal" bus="session" exe="/usr/bin/dbus-daemon" terminal=?'''
negative:
# An AppArmor blob in the outer field belongs to AUDITD_APPARMOR.
- 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" pid=1234'
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0 msg=''op=PAM:authentication acct="root" res=failed'''
- 'this is not an auditd record'
AUDITD_ANOM:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=ANOM_ABEND msg=audit(1700000010.000:466): auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
result: 'type=ANOM_ABEND msg=audit(1700000010.000:466): auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
- string: 'type=ANOM_LOGIN_FAILURES msg=audit(1700000011.000:467): pid=5556 uid=0 auid=1000 ses=3 msg=''op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=failed'''
result: 'type=ANOM_LOGIN_FAILURES msg=audit(1700000011.000:467): pid=5556 uid=0 auid=1000 ses=3 msg=''op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=failed'''
negative:
- 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
- 'this is not an auditd record'
AUDITD:
test_template: '^(?<TEST>[% TEST_VAR %])$'
positive:
- string: 'type=SYSCALL msg=audit(1626345600.123:456): arch=c000003e syscall=59 success=yes exit=0 pid=5678 uid=0 comm="ls" exe="/usr/bin/ls" key="watch exec"'
result: 'type=SYSCALL msg=audit(1626345600.123:456): arch=c000003e syscall=59 success=yes exit=0 pid=5678 uid=0 comm="ls" exe="/usr/bin/ls" key="watch exec"'
- string: 'type=USER_AUTH msg=audit(1626345600.123:457): pid=1234 uid=0 auid=1000 ses=3 msg=''op=PAM:authentication acct="root" addr=203.0.113.7 res=failed'''
result: 'type=USER_AUTH msg=audit(1626345600.123:457): pid=1234 uid=0 auid=1000 ses=3 msg=''op=PAM:authentication acct="root" addr=203.0.113.7 res=failed'''
# End-of-event marker: nothing after the colon.
- string: 'type=EOE msg=audit(1626345600.123:458):'
result: 'type=EOE msg=audit(1626345600.123:458):'
negative:
- 'this is not an auditd record'
rules:
- name: auditd
field: MESSAGE
anchored: true
patterns:
- AUDITD_USER_AUTH
- AUDITD_USER_LOGIN
- AUDITD_USER_CMD
- AUDITD_USER_MGMT
- AUDITD_AVC
- AUDITD_APPARMOR
- AUDITD_APPARMOR_DBUS
- AUDITD_ANOM
- AUDITD
tests:
positive:
- string: 'type=SYSCALL msg=audit(1626345600.123:456): arch=c000003e syscall=59 success=yes exit=0 pid=5678 uid=0 comm="ls" exe="/usr/bin/ls" key="watch exec"'
enriched:
audit_arch: 'c000003e'
audit_comm: 'ls'
audit_epoch: '1626345600.123'
audit_exe: '/usr/bin/ls'
audit_exit: '0'
audit_id: '1626345600.123:456'
audit_key: 'watch exec'
audit_pid: '5678'
audit_serial: '456'
audit_success: 'yes'
audit_syscall: '59'
audit_type: 'SYSCALL'
audit_uid: '0'
share/auditd.yaml view on Meta::CPAN
audit_serial: '464'
mac_result: 'denied'
audit_avc_action: 'denied'
audit_avc_perms: 'read'
audit_fields: 'pid=4444 comm="httpd" name="passwd" dev="sda1" ino=1234 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0'
# AppArmor file denial: the same mac_result field as the SELinux AVC
# above, audit_apparmor alongside it, and the rest to the outer kv.
- string: 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
enriched:
audit_apparmor: 'DENIED'
audit_comm: 'foo'
audit_denied_mask: 'r'
audit_epoch: '1700000012'
audit_fsuid: '0'
audit_id: '1700000012.000:468'
audit_name: '/etc/shadow'
audit_operation: 'open'
audit_ouid: '0'
audit_pid: '1234'
audit_profile: '/usr/bin/foo'
audit_requested_mask: 'r'
audit_serial: '468'
audit_type: 'AVC'
mac_result: 'denied'
numeric:
- audit_fsuid
- audit_ouid
result:
audit_type: 'AVC'
audit_id: '1700000012.000:468'
audit_epoch: '1700000012.000'
audit_serial: '468'
mac_result: 'DENIED'
audit_apparmor: 'DENIED'
audit_fields: 'operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
# AppArmor profile-load failure: no operation=, tail starts with info=.
- string: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
enriched:
audit_apparmor: 'STATUS'
audit_comm: 'apparmor_parser'
audit_epoch: '1700000013'
audit_error: '-71'
audit_id: '1700000013.000:469'
audit_info: 'failed to unpack profile'
audit_pid: '123'
audit_profile: 'unconfined'
audit_serial: '469'
audit_type: 'APPARMOR_STATUS'
mac_result: 'status'
numeric:
- audit_error
result:
audit_type: 'APPARMOR_STATUS'
audit_id: '1700000013.000:469'
audit_epoch: '1700000013.000'
audit_serial: '469'
mac_result: 'STATUS'
audit_apparmor: 'STATUS'
audit_fields: 'info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
# AppArmor dbus mediation: the AppArmor blob is the nested sub-record.
- string: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" member="StartUnit" mask="send" name="org.freedesktop.systemd1" pid=2222 label...
enriched:
audit_auid: '4294967295'
audit_epoch: '1700000014'
audit_id: '1700000014.000:470'
audit_msg_addr: '?'
audit_msg_apparmor: 'DENIED'
audit_msg_bus: 'system'
audit_msg_exe: '/usr/bin/dbus-daemon'
audit_msg_hostname: '?'
audit_msg_label: 'snap.foo.bar'
audit_msg_mask: 'send'
audit_msg_member: 'StartUnit'
audit_msg_name: 'org.freedesktop.systemd1'
audit_msg_operation: 'dbus_method_call'
audit_msg_peer_label: 'unconfined'
audit_msg_peer_pid: '1'
audit_msg_pid: '2222'
audit_msg_sauid: '0'
audit_msg_terminal: '?'
audit_pid: '1'
audit_serial: '470'
audit_ses: '4294967295'
audit_type: 'USER_AVC'
audit_uid: '0'
mac_result: 'denied'
numeric:
- audit_auid
- audit_epoch
- audit_msg_peer_pid
- audit_msg_pid
- audit_msg_sauid
- audit_pid
- audit_ses
- audit_uid
result:
audit_type: 'USER_AVC'
audit_id: '1700000014.000:470'
audit_epoch: '1700000014.000'
audit_serial: '470'
mac_result: 'DENIED'
audit_msg_apparmor: 'DENIED'
audit_fields: 'pid=1 uid=0 auid=4294967295 ses=4294967295'
audit_msg: 'operation="dbus_method_call" bus="system" member="StartUnit" mask="send" name="org.freedesktop.systemd1" pid=2222 label="snap.foo.bar" peer_pid=1 peer_label="unconfined" exe="/usr/bin/dbus-daemon" sauid=0 hostname=? addr=? ter...
# ANOM_ABEND: the outer blob only, with no nested msg.
- string: 'type=ANOM_ABEND msg=audit(1700000010.000:466): auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
enriched:
audit_auid: '1000'
audit_comm: 'crasher'
audit_epoch: '1700000010'
audit_exe: '/usr/bin/crasher'
audit_id: '1700000010.000:466'
audit_pid: '5555'
audit_res: '1'
audit_serial: '466'
audit_ses: '3'
audit_sig: '11'
audit_type: 'ANOM_ABEND'
audit_uid: '1000'
result:
audit_type: 'ANOM_ABEND'
audit_id: '1700000010.000:466'
audit_epoch: '1700000010.000'
audit_serial: '466'
audit_fields: 'auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
# EOE: no fields, only the id tying the event's records together. Falls
# to the generic catch-all.
- string: 'type=EOE msg=audit(1626345600.123:458):'
result:
audit_type: 'EOE'
audit_id: '1626345600.123:458'
audit_epoch: '1626345600.123'
audit_serial: '458'
negative:
- 'this is not an auditd record'
- 'Jul 15 10:00:00 host sshd[1]: Accepted publickey for x'
( run in 0.521 second using v1.01-cache-2.11-cpan-b16cb0d3907 )