Log-Munger

 view release on metacpan or  search on metacpan

share/auditd.yaml  view on Meta::CPAN

        result: 'type=CRED_ACQ msg=audit(1700000001.500:457): pid=1234 uid=0 auid=1000 ses=3 msg=''op=PAM:setcred grantors=pam_unix acct="root" exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=success'''
    negative:
      - 'type=USER_LOGIN msg=audit(1700000000.123:456): pid=1234 uid=0'
      - 'this is not an auditd record'
  AUDITD_USER_LOGIN:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=USER_LOGIN msg=audit(1700000002.000:458): pid=1234 uid=0 auid=1000 ses=3 msg=''op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=success'''
        result: 'type=USER_LOGIN msg=audit(1700000002.000:458): pid=1234 uid=0 auid=1000 ses=3 msg=''op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=success'''
      - string: 'type=USER_LOGIN msg=audit(1700000003.000:459): pid=999 uid=0 auid=0 ses=1 msg=''op=login acct="badguy" exe="/usr/sbin/sshd" hostname=? addr=198.51.100.9 terminal=ssh res=failed'''
        result: 'type=USER_LOGIN msg=audit(1700000003.000:459): pid=999 uid=0 auid=0 ses=1 msg=''op=login acct="badguy" exe="/usr/sbin/sshd" hostname=? addr=198.51.100.9 terminal=ssh res=failed'''
    negative:
      - 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
      - 'this is not an auditd record'
  AUDITD_USER_CMD:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=USER_CMD msg=audit(1700000004.000:460): pid=2222 uid=1000 auid=1000 ses=3 msg=''cwd="/home/neti" cmd=6C73202D6C61 terminal=pts/0 res=success'''
        result: 'type=USER_CMD msg=audit(1700000004.000:460): pid=2222 uid=1000 auid=1000 ses=3 msg=''cwd="/home/neti" cmd=6C73202D6C61 terminal=pts/0 res=success'''
      - string: 'type=USER_CMD msg=audit(1700000005.000:461): pid=2223 uid=1000 auid=1000 ses=3 msg=''cwd="/root" cmd=6964 terminal=pts/1 res=failed'''
        result: 'type=USER_CMD msg=audit(1700000005.000:461): pid=2223 uid=1000 auid=1000 ses=3 msg=''cwd="/root" cmd=6964 terminal=pts/1 res=failed'''
    negative:
      - 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
      - 'this is not an auditd record'
  AUDITD_USER_MGMT:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=ADD_USER msg=audit(1700000006.000:462): pid=3333 uid=0 auid=0 ses=2 msg=''op=add-user id=1500 exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=success'''
        result: 'type=ADD_USER msg=audit(1700000006.000:462): pid=3333 uid=0 auid=0 ses=2 msg=''op=add-user id=1500 exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=success'''
      - string: 'type=DEL_GROUP msg=audit(1700000007.000:463): pid=3334 uid=0 auid=0 ses=2 msg=''op=delete-group grp="devs" exe="/usr/sbin/groupdel" hostname=? addr=? terminal=pts/0 res=success'''
        result: 'type=DEL_GROUP msg=audit(1700000007.000:463): pid=3334 uid=0 auid=0 ses=2 msg=''op=delete-group grp="devs" exe="/usr/sbin/groupdel" hostname=? addr=? terminal=pts/0 res=success'''
    negative:
      - 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
      - 'this is not an auditd record'
  AUDITD_AVC:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=AVC msg=audit(1700000008.000:464): avc:  denied  { read } for  pid=4444 comm="httpd" name="passwd" dev="sda1" ino=1234 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0'
        result: 'type=AVC msg=audit(1700000008.000:464): avc:  denied  { read } for  pid=4444 comm="httpd" name="passwd" dev="sda1" ino=1234 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0'
      - string: 'type=AVC msg=audit(1700000009.000:465): avc:  granted  { execute } for  pid=4445 comm="sh" scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file'
        result: 'type=AVC msg=audit(1700000009.000:465): avc:  granted  { execute } for  pid=4445 comm="sh" scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file'
    negative:
      - 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
      - 'this is not an auditd record'
  AUDITD_APPARMOR:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
        result: 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
      # Profile-load status record: no operation=, and the tail is optional.
      - string: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
        result: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
    negative:
      # SELinux AVC prose belongs to AUDITD_AVC, not to AppArmor.
      - 'type=AVC msg=audit(1700000008.000:464): avc:  denied  { read } for  pid=4444 comm="httpd" tclass=file'
      - 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
      - 'this is not an auditd record'
  AUDITD_APPARMOR_DBUS:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" m...
        result: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" m...
      - string: 'type=USER_AVC msg=audit(1700000015.000:471): pid=1 uid=0 msg=''apparmor="ALLOWED" operation="dbus_signal" bus="session" exe="/usr/bin/dbus-daemon" terminal=?'''
        result: 'type=USER_AVC msg=audit(1700000015.000:471): pid=1 uid=0 msg=''apparmor="ALLOWED" operation="dbus_signal" bus="session" exe="/usr/bin/dbus-daemon" terminal=?'''
    negative:
      # An AppArmor blob in the outer field belongs to AUDITD_APPARMOR.
      - 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" pid=1234'
      - 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0 msg=''op=PAM:authentication acct="root" res=failed'''
      - 'this is not an auditd record'
  AUDITD_ANOM:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=ANOM_ABEND msg=audit(1700000010.000:466): auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
        result: 'type=ANOM_ABEND msg=audit(1700000010.000:466): auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
      - string: 'type=ANOM_LOGIN_FAILURES msg=audit(1700000011.000:467): pid=5556 uid=0 auid=1000 ses=3 msg=''op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=failed'''
        result: 'type=ANOM_LOGIN_FAILURES msg=audit(1700000011.000:467): pid=5556 uid=0 auid=1000 ses=3 msg=''op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=203.0.113.7 terminal=ssh res=failed'''
    negative:
      - 'type=USER_AUTH msg=audit(1700000000.123:456): pid=1234 uid=0'
      - 'this is not an auditd record'
  AUDITD:
    test_template: '^(?<TEST>[% TEST_VAR %])$'
    positive:
      - string: 'type=SYSCALL msg=audit(1626345600.123:456): arch=c000003e syscall=59 success=yes exit=0 pid=5678 uid=0 comm="ls" exe="/usr/bin/ls" key="watch exec"'
        result: 'type=SYSCALL msg=audit(1626345600.123:456): arch=c000003e syscall=59 success=yes exit=0 pid=5678 uid=0 comm="ls" exe="/usr/bin/ls" key="watch exec"'
      - string: 'type=USER_AUTH msg=audit(1626345600.123:457): pid=1234 uid=0 auid=1000 ses=3 msg=''op=PAM:authentication acct="root" addr=203.0.113.7 res=failed'''
        result: 'type=USER_AUTH msg=audit(1626345600.123:457): pid=1234 uid=0 auid=1000 ses=3 msg=''op=PAM:authentication acct="root" addr=203.0.113.7 res=failed'''
      # End-of-event marker: nothing after the colon.
      - string: 'type=EOE msg=audit(1626345600.123:458):'
        result: 'type=EOE msg=audit(1626345600.123:458):'
    negative:
      - 'this is not an auditd record'
rules:
  - name: auditd
    field: MESSAGE
    anchored: true
    patterns:
      - AUDITD_USER_AUTH
      - AUDITD_USER_LOGIN
      - AUDITD_USER_CMD
      - AUDITD_USER_MGMT
      - AUDITD_AVC
      - AUDITD_APPARMOR
      - AUDITD_APPARMOR_DBUS
      - AUDITD_ANOM
      - AUDITD
    tests:
      positive:
        - string: 'type=SYSCALL msg=audit(1626345600.123:456): arch=c000003e syscall=59 success=yes exit=0 pid=5678 uid=0 comm="ls" exe="/usr/bin/ls" key="watch exec"'
          enriched:
            audit_arch: 'c000003e'
            audit_comm: 'ls'
            audit_epoch: '1626345600.123'
            audit_exe: '/usr/bin/ls'
            audit_exit: '0'
            audit_id: '1626345600.123:456'
            audit_key: 'watch exec'
            audit_pid: '5678'
            audit_serial: '456'
            audit_success: 'yes'
            audit_syscall: '59'
            audit_type: 'SYSCALL'
            audit_uid: '0'

share/auditd.yaml  view on Meta::CPAN

            audit_serial: '464'
            mac_result: 'denied'
            audit_avc_action: 'denied'
            audit_avc_perms: 'read'
            audit_fields: 'pid=4444 comm="httpd" name="passwd" dev="sda1" ino=1234 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0'
        # AppArmor file denial: the same mac_result field as the SELinux AVC
        # above, audit_apparmor alongside it, and the rest to the outer kv.
        - string: 'type=AVC msg=audit(1700000012.000:468): apparmor="DENIED" operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
          enriched:
            audit_apparmor: 'DENIED'
            audit_comm: 'foo'
            audit_denied_mask: 'r'
            audit_epoch: '1700000012'
            audit_fsuid: '0'
            audit_id: '1700000012.000:468'
            audit_name: '/etc/shadow'
            audit_operation: 'open'
            audit_ouid: '0'
            audit_pid: '1234'
            audit_profile: '/usr/bin/foo'
            audit_requested_mask: 'r'
            audit_serial: '468'
            audit_type: 'AVC'
            mac_result: 'denied'
          numeric:
            - audit_fsuid
            - audit_ouid
          result:
            audit_type: 'AVC'
            audit_id: '1700000012.000:468'
            audit_epoch: '1700000012.000'
            audit_serial: '468'
            mac_result: 'DENIED'
            audit_apparmor: 'DENIED'
            audit_fields: 'operation="open" profile="/usr/bin/foo" name="/etc/shadow" pid=1234 comm="foo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0'
        # AppArmor profile-load failure: no operation=, tail starts with info=.
        - string: 'type=APPARMOR_STATUS msg=audit(1700000013.000:469): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
          enriched:
            audit_apparmor: 'STATUS'
            audit_comm: 'apparmor_parser'
            audit_epoch: '1700000013'
            audit_error: '-71'
            audit_id: '1700000013.000:469'
            audit_info: 'failed to unpack profile'
            audit_pid: '123'
            audit_profile: 'unconfined'
            audit_serial: '469'
            audit_type: 'APPARMOR_STATUS'
            mac_result: 'status'
          numeric:
            - audit_error
          result:
            audit_type: 'APPARMOR_STATUS'
            audit_id: '1700000013.000:469'
            audit_epoch: '1700000013.000'
            audit_serial: '469'
            mac_result: 'STATUS'
            audit_apparmor: 'STATUS'
            audit_fields: 'info="failed to unpack profile" error=-71 profile="unconfined" pid=123 comm="apparmor_parser"'
        # AppArmor dbus mediation: the AppArmor blob is the nested sub-record.
        - string: 'type=USER_AVC msg=audit(1700000014.000:470): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=''apparmor="DENIED" operation="dbus_method_call" bus="system" member="StartUnit" mask="send" name="org.freedesktop.systemd1" pid=2222 label...
          enriched:
            audit_auid: '4294967295'
            audit_epoch: '1700000014'
            audit_id: '1700000014.000:470'
            audit_msg_addr: '?'
            audit_msg_apparmor: 'DENIED'
            audit_msg_bus: 'system'
            audit_msg_exe: '/usr/bin/dbus-daemon'
            audit_msg_hostname: '?'
            audit_msg_label: 'snap.foo.bar'
            audit_msg_mask: 'send'
            audit_msg_member: 'StartUnit'
            audit_msg_name: 'org.freedesktop.systemd1'
            audit_msg_operation: 'dbus_method_call'
            audit_msg_peer_label: 'unconfined'
            audit_msg_peer_pid: '1'
            audit_msg_pid: '2222'
            audit_msg_sauid: '0'
            audit_msg_terminal: '?'
            audit_pid: '1'
            audit_serial: '470'
            audit_ses: '4294967295'
            audit_type: 'USER_AVC'
            audit_uid: '0'
            mac_result: 'denied'
          numeric:
            - audit_auid
            - audit_epoch
            - audit_msg_peer_pid
            - audit_msg_pid
            - audit_msg_sauid
            - audit_pid
            - audit_ses
            - audit_uid
          result:
            audit_type: 'USER_AVC'
            audit_id: '1700000014.000:470'
            audit_epoch: '1700000014.000'
            audit_serial: '470'
            mac_result: 'DENIED'
            audit_msg_apparmor: 'DENIED'
            audit_fields: 'pid=1 uid=0 auid=4294967295 ses=4294967295'
            audit_msg: 'operation="dbus_method_call" bus="system" member="StartUnit" mask="send" name="org.freedesktop.systemd1" pid=2222 label="snap.foo.bar" peer_pid=1 peer_label="unconfined" exe="/usr/bin/dbus-daemon" sauid=0 hostname=? addr=? ter...
        # ANOM_ABEND: the outer blob only, with no nested msg.
        - string: 'type=ANOM_ABEND msg=audit(1700000010.000:466): auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
          enriched:
            audit_auid: '1000'
            audit_comm: 'crasher'
            audit_epoch: '1700000010'
            audit_exe: '/usr/bin/crasher'
            audit_id: '1700000010.000:466'
            audit_pid: '5555'
            audit_res: '1'
            audit_serial: '466'
            audit_ses: '3'
            audit_sig: '11'
            audit_type: 'ANOM_ABEND'
            audit_uid: '1000'
          result:
            audit_type: 'ANOM_ABEND'
            audit_id: '1700000010.000:466'
            audit_epoch: '1700000010.000'
            audit_serial: '466'
            audit_fields: 'auid=1000 uid=1000 ses=3 pid=5555 comm="crasher" exe="/usr/bin/crasher" sig=11 res=1'
        # EOE: no fields, only the id tying the event's records together. Falls
        # to the generic catch-all.
        - string: 'type=EOE msg=audit(1626345600.123:458):'
          result:
            audit_type: 'EOE'
            audit_id: '1626345600.123:458'
            audit_epoch: '1626345600.123'
            audit_serial: '458'
      negative:
        - 'this is not an auditd record'
        - 'Jul 15 10:00:00 host sshd[1]: Accepted publickey for x'



( run in 0.521 second using v1.01-cache-2.11-cpan-b16cb0d3907 )