mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
9 lines
1016 B
YAML
9 lines
1016 B
YAML
name: linux_auditd_normalized_proctitle_process
|
|
id: c5117ecc-4d46-4b94-b0eb-e5e64434114b
|
|
version: 1
|
|
creation_date: '2024-08-09'
|
|
modification_date: '2026-05-13'
|
|
author: Splunk Threat Research Team
|
|
description: customer specific splunk configurations to normalized auditd PROCTITLE type to recover process commandline. Replace the macro definition with configurations for your Splunk Environment.
|
|
definition: 'type=PROCTITLE | eval normalized_proctitle_delimiter = if(type=="PROCTITLE" AND isnotnull(proctitle), if(match(proctitle,"^[0-9A-F]+$"), replace(proctitle, "000", "020"),proctitle),null()) | eval normalized_proctitle_delimiter = if(type=="PROCTITLE" AND isnotnull(proctitle), if(match(normalized_proctitle_delimiter,"^[0-9A-F]+$"), replace(normalized_proctitle_delimiter, "00", "20"),normalized_proctitle_delimiter),null()) | eval process_exec = if(match(normalized_proctitle_delimiter,"^[0-9A-F]+$"),urldecode(replace(normalized_proctitle_delimiter,"([0-9A-F]{2})","%\1")),normalized_proctitle_delimiter)'
|