admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

auditd_data_source

Browse Source
This commit is contained in:
tccontre
2024-08-08 14:47:22 +02:00
parent 883729353d
commit 89902ee34b
6 changed files with 182 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/Linux_Auditd_Add_User.yml
+32
View File
@@ -0,0 +1,32 @@
name: Linux Auditd Add User
id: 5a25984a-2789-400a-858b-d75c923e06b1
version: 1
date: '2024-08-08'
author: Teoderick Contreras, Splunk
description: Data source object for Linux Auditd Add User Type
source: /var/log/audit/audit.log
sourcetype: linux:audit
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 9.2.0
fields:
- msg
- type
- pid
- uid
- auid
- ses
- subj
- msg
- op
- id
- exe
- hostname
- addr
- terminal
- res
- UID
- AUID
- ID
example_logs: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"'
data_sources/Linux_Auditd_Execve.yml
+18
View File
@@ -0,0 +1,18 @@
name: Linux Auditd Execve
id: 9ef6364d-cc67-480e-8448-3306829a6a24
version: 1
date: '2024-08-08'
author: Teoderick Contreras, Splunk
description: Data source object for Linux Auditd Execve Type
source: /var/log/audit/audit.log
sourcetype: linux:audit
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 9.2.0
fields:
- msg
- type
- msg
- argc
example_logs: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so" a2="./prog"'
data_sources/Linux_Auditd_Path.yml
+32
View File
@@ -0,0 +1,32 @@
name: Linux Auditd Path
id: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d
version: 1
date: '2024-08-08'
author: Teoderick Contreras, Splunk
description: Data source object for Linux Auditd Path Type
source: /var/log/audit/audit.log
sourcetype: linux:audit
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 9.2.0
fields:
- msg
- type
- item
- name
- inode
- dev
- mode
- ouid
- ogid
- rdev
- nametype
- cap_fp
- cap_fi
- cap_fe
- cap_fver
- cap_frootid
- OUID
- OGID
example_logs: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"'
data_sources/Linux_Auditd_Proctitle.yml
+17
View File
@@ -0,0 +1,17 @@
name: Linux Auditd Proctitle
id: 5a25984a-2789-400a-858b-d75c923e06b1
version: 1
date: '2024-08-08'
author: Teoderick Contreras, Splunk
description: Data source object for Linux Auditd Proctitle Type
source: /var/log/audit/audit.log
sourcetype: linux:audit
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 9.2.0
fields:
- proctitle
- msg
- type
example_logs: 'type=PROCTITLE msg=audit(1722944427.844:4146): proctitle=63686D6F640037373700312E7368'
data_sources/Linux_Auditd_Service_Stop.yml
+30
View File
@@ -0,0 +1,30 @@
name: Linux Auditd Service Stop
id: 5a25984a-2789-400a-858b-d75c923e06b1
version: 1
date: '2024-08-08'
author: Teoderick Contreras, Splunk
description: Data source object for Linux Auditd Service Stop Type
source: /var/log/audit/audit.log
sourcetype: linux:audit
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 9.2.0
fields:
- msg
- type
- pid
- uid
- auid
- ses
- subj
- msg
- comm
- exe
- hostname
- addr
- terminal
- res
- UID
- AUID
example_logs: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"'
data_sources/Linux_Auditd_Syscall.yml
+53
View File
@@ -0,0 +1,53 @@
name: Linux Auditd Syscall
id: 4dff7047-0d43-4096-bb3f-b756c889bbad
version: 1
date: '2024-08-08'
author: Teoderick Contreras, Splunk
description: Data source object for Linux Auditd Syscall Type
source: /var/log/audit/audit.log
sourcetype: linux:audit
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 9.2.0
fields:
- msg
- type
- msg
- arch
- syscall
- success
- exit
- a1
- a2
- a3
- items
- ppid
- pid
- auid
- uid
- gid
- euid
- suid
- fsuid
- egid
- sgid
- fsgid
- tty
- ses
- comm
- exe
- subj
- key
- ARCH
- SYSCALL
- AUID
- UID
- GID
- EUID
- SUID
- FSUID
- EGID
- SGID
- FSGID
example_logs: 'type=SYSCALL msg=audit(1723035666.627:3663): arch=c000003e syscall=59 success=yes exit=0 a0=556a6d697a58 a1=556a6d68ad00 a2=556a6d69c980 a3=0 items=2 ppid=1300 pid=1301 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="lsmod" exe="/usr/bin/kmod" subj=unconfined key="rootcmd" ARCH=x86_64 SYSCALL=execve AUID="ubuntu" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"'