Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] Auditd: Change user fields to ECS #10456

Merged
merged 4 commits into from Feb 5, 2019
Merged

[Auditbeat] Auditd: Change user fields to ECS #10456

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9a12dd2
Adjust user fields to ECS.
Jan 31, 2019
86c4a69
Aliases and ecs-migration.yml.
Jan 31, 2019
cfb597a
Changelog
Jan 31, 2019
290247d
Move user.audit.* and user.filesystem.* to fields.common.yml
Feb 1, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Expand Up @@ -38,6 +38,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Change data type of `file.uid` and `file.gid` to string in JSON output of the
FIM module. {pull}10195[10195]
- Field `file.origin` changed type from `text` to `keyword`. {pull}10544[10544]
- Rename user fields to ECS in auditd module. {pull}10456[10456]

*Filebeat*

Expand Down
44 changes: 44 additions & 0 deletions auditbeat/_meta/fields.common.yml
View file
Open in desktop
Expand Up @@ -55,20 +55,58 @@
description: User information.
fields:

- name: audit
type: group
description: Audit user information.
fields:
- name: id
type: keyword
description: Audit user ID.
- name: name
type: keyword
description: Audit user name.

- name: effective
type: group
description: Effective user information.
fields:
- name: id
type: keyword
description: Effective user ID.
- name: name
type: keyword
description: Effective user name.
- name: group
type: group
description: Effective group information.
fields:
- name: id
type: keyword
description: Effective group ID.
- name: name
type: keyword
description: Effective group name.

- name: filesystem
type: group
description: Filesystem user information.
fields:
- name: id
type: keyword
description: Filesystem user ID.
- name: name
type: keyword
description: Filesystem user name.
- name: group
type: group
description: Filesystem group information.
fields:
- name: id
type: keyword
description: Filesystem group ID.
- name: name
type: keyword
description: Filesystem group name.

- name: saved
type: group
Expand All @@ -77,10 +115,16 @@
- name: id
type: keyword
description: Saved user ID.
- name: name
type: keyword
description: Saved user name.
- name: group
type: group
description: Saved group information.
fields:
- name: id
type: keyword
description: Saved group ID.
- name: name
type: keyword
description: Saved group name.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I find it confusing to have the effective & saved fields defined here, and the audit & filesystem fields defined only in the auditd module. Especially since they're defined mixed in the ECS user field set.

I think it would make most sense to have them grouped together here.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would assume Auditbeat's FIM has events with ouid and ogid (file owner). I think it would make sense to define them here as (and adjust FIM to use them ;-) ).

I've seen them pop up in the Filebeat auditd module, so you can pilfer the definitions from there.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To clarify about FIM above: I would define the fields in this PR. Addressing whether FIM emits owner IDs in these fields can be addressed as a separate PR.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I find it confusing to have the effective & saved fields defined here, and the audit & filesystem fields defined only in the auditd module. Especially since they're defined mixed in the ECS user field set.

I think it would make most sense to have them grouped together here.

+1 I'll make the change

I would assume Auditbeat's FIM has events with ouid and ogid (file owner). I think it would make sense to define them here as (and adjust FIM to use them ;-) ).

I think we have a few options. But regardless, I don't think we should address it here in this PR.

The FIM file metadata has a uid, gid, owner, and group. This is also what is currently in ECS.

Our options for moving the fields:

  1. Move them under user.*: user.id, user.name, user.group.id, user.group.name - no new definitions required, easy field names, but problematic if we ever have another user object (e.g. the user that modified the file)
  2. Move them under user.owner.*: user.owner.id, user.owner.name, user.owner.group.id, user.owner.group.name - more future proof, somewhat longer field names
  3. Move them under file.user.*: file.user.owner.id, file.user.owner.name, file.user.owner.group.id, file.user.owner.group.name
  4. Move them under file.owner.*: file.owner.id, file.owner.name, file.owner.group.id, file.owner.group.name

The benefit the last two options under file have is that it would allow us to keep the file object of the FIM module and the auditd.paths object (containing multiple files) of the Auditd module to share the same fields for users. They're a bit disparate at the moment, with FIM using uid/gid and Auditd using ouid/ogid for the same data.

Again, I think we should address this whole thing in another PR, including any field definitions.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for moving the fields defs :-)

I agree the owner stuff is to be addressed in another PR, if we address it.

The discrepancy in representing users in file.* in ECS saddens me a bit, haha. This one slipped by. But I think we should leave it as is and concentrate on polishing everything that's already in flight, for FF. I don't think we should open this can of worms as well.

19 changes: 18 additions & 1 deletion auditbeat/docs/breaking.asciidoc
View file
Open in desktop
Expand Up @@ -9,6 +9,24 @@ In version 7.0 the following fields were renamed.
|Old Field|New Field
|`process.cwd` |`process.working_directory`
|`source.hostname` |`source.domain`
|`user.auid` |`user.audit.id`
|`user.uid` |`user.id`
|`user.euid` |`user.effective.id`
|`user.fsuid` |`user.filesystem.id`
|`user.suid` |`user.saved.id`
|`user.gid` |`user.group.id`
|`user.egid` |`user.effective.group.id`
|`user.sgid` |`user.saved.group.id`
|`user.fsgid` |`user.filesystem.group.id`
|`user.name_map.auid` |`user.audit.name`
|`user.name_map.uid` |`user.name`
|`user.name_map.euid` |`user.effective.name`
|`user.name_map.fsuid` |`user.filesystem.name`
|`user.name_map.suid` |`user.saved.name`
|`user.name_map.gid` |`user.group.name`
|`user.name_map.egid` |`user.effective.group.name`
|`user.name_map.sgid` |`user.saved.group.name`
|`user.name_map.fsgid` |`user.filesystem.group.name`
|======================

The JSON data types produced by the output have been changed to align with
Expand Down Expand Up @@ -148,4 +166,3 @@ moved under the `file` namespace.]
|`audit.file.hash` |`hash`
|`audit.file` |`file`
|======================