mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
name: Linux Auditd Path
|
|
id: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d
|
|
version: 3
|
|
creation_date: '2024-08-08'
|
|
modification_date: '2026-05-13'
|
|
author: Teoderick Contreras, Splunk
|
|
description: Logs file system access events on a Linux system, including details about file paths, permissions, and associated processes.
|
|
mitre_components:
|
|
- File Access
|
|
- File Metadata
|
|
- Process Metadata
|
|
- OS API Execution
|
|
- Application Log Content
|
|
source: auditd
|
|
sourcetype: auditd
|
|
separator: type
|
|
separator_value: PATH
|
|
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
|
|
supported_TA:
|
|
- name: Splunk Add-on for Unix and Linux
|
|
url: https://splunkbase.splunk.com/app/833
|
|
version: 10.2.0
|
|
fields:
|
|
- msg
|
|
- type
|
|
- item
|
|
- name
|
|
- inode
|
|
- dev
|
|
- mode
|
|
- ouid
|
|
- ogid
|
|
- rdev
|
|
- nametype
|
|
- cap_fp
|
|
- cap_fi
|
|
- cap_fe
|
|
- cap_fver
|
|
- cap_frootid
|
|
- OUID
|
|
- OGID
|
|
example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"'
|