diff --git a/Content/Content Packs/Linux Auditbeat Content Pack.html b/Content/Content Packs/Linux Auditbeat Content Pack.html index 4394e5d..d203f53 100644 --- a/Content/Content Packs/Linux Auditbeat Content Pack.html +++ b/Content/Content Packs/Linux Auditbeat Content Pack.html @@ -1,47 +1,109 @@  - + - - - - Linux Auditbeat Content Pack - - + Linux Auditbeat Content Pack + +

The Illuminate Linux Auditbeat Spotlight for Graylog works with Graylog Illuminate Core and Elastic Auditbeat agent for Linux. The Auditbeat agent is a "lightweight shipper for audit data." The Auditbeat agent for Linux communicates with the Audit framework for LInux and adds processing, enrichment, and delivery of Linux audit messages.

The Linux Auditbeat Spotlight comes ready to use with pre-built dashboard views including:

These built-in views can serve as a starting point for creating custom dashboards.

-

Supported Version(s)

+

Supported Version(s)

This Spotlight supports Auditbeat for Linux versions 7-8 and will function with both the Elastic-licensed and Apache-licensed versions of Auditbeat.

+

-
-

Warning: The Apache-licensed version of Auditbeat does NOT include the "system" module, which provides additional data sets not available in the Elastic-licensed version.

+
Warning: The Apache-licensed version of Auditbeat does NOT include the "system" module, which provides additional data sets not available in the Elastic-licensed version.

By default, Graylog Sidecar comes with the Apache-licensed version of Auditbeat. If you want to utilize the "system" module, you can install the Elastic-licensed version by adding the appropriate repo and installing Auditbeat alongside the bundled version.

-

Install Elastic Version of Auditbeat

-

For the APT package manager, run the following command:

- - - wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - +

Requirements

+
    +
  • +

    A configured Beats input on Graylog server (See "Create Beats Input" below)

    +
    • +
  • +

    The "Beats type prefix" must be enabled

    +
    • +
  • +

    One or more Linux hosts with Elastic Auditbeat installed

    +
    • +
  • +

    Beats agents, including Auditbeat, can be managed using the Graylog Sidecar

    +
    • +
+

+

+
Warning: For Illuminate versions prior to Illuminate 2.2.2, the following must be added to the auditbeat.yml configuration file or to the Auditbeat configuration in the Graylog sidecar configuration for Auditbeat: +
+
fields event_source_product: linux_auditbeat +
+
+

+

Stream Configuration

+

This technology pack includes 1 stream:

+
    +
  • "Illuminate:Linux Auditbeat Messages"
    • +
+

+

+
Hint: If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream. +
+
+

+

Index Set Configuration

+

This technology pack includes 1 index set definition:

+
    +
  • "Linux Auditbeat Logs"
    • +
+

+

+
Hint: If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation. +
+
+

+

Log Format Example

+

["type=CRED_ACQ msg=audit(1633670701.685:6873): pid=5205 uid=0 auid=4294967095 ses=4294970295 subj=unconfined msg='op=PAM:setcred grantors=pam_permit,pam_cap acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"] +

+

What is Provided

+
    +
  • +

    Parsing rules to extract, normalize, and enrich fields Linux Auditbeat logs into Graylog schema compatible fields

    +
    • +
  • +

    A spotlight providing overview dashboards for Linux Auditbeat events

    +
    • +
+

Log Collection

+

Install Elastic Auditbeat

+
    +
  1. +

    For the APT package manager, run the following command:

    + + + wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list - -

    For the YUM package manager, run the following command:

    - - - sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch + +
    2. +
  2. +

    For the YUM package manager, run the following command:

    + + + sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch cat << EOF | sudo tee -a /etc/yum.repos.d/elastic-8.x.repo [elastic-8.x] name=Elastic repository for 8.x packages @@ -51,643 +113,896 @@

    Install Elastic Version of Auditbeat

    enabled=1 autorefresh=1 type=rpm-md -EOF -     -     +EOF + +
    3. +
+

Create a Beats Input

+

One beats input can service multiple log sources; therefore, this step is not required if a beats input has already been configured.

+
    +
  1. +

    On the Select Input drop-down menu, select the System menu and then choose Inputs.

    +
    2. +
  2. +

    Select Beats from the Select Input drop-down menu.

    +
    3. +
  3. +

    Click Launch New Input.

    +
    4. +
  4. +

    Assign a node or select Global mode.

    +
    5. +
  5. +

    Set the Title, Bind Address, and listening Port. For example:

    +
      +
    1. +

      Title: "Beats input 5044"

      +
      2. +
    2. +

      Bind address: "0.0.0.0" to listen on all interfaces

      +
      3. +
    3. +

      Port: "5044"

      +
      4. +
    +
    6. +
  6. +

    Make sure the option "Do not add Beats type as prefix" is not selected. Pipeline processing rules reference incoming data by field name and the pipeline will not function correctly if this prefix is omitted.

    +
    7. +
  7. +

    Save the input settings.

    +
    8. +
  8. +

    If the input does not start automatically, select Start Input to begin listening for and processing new Beats messages (including Linux Auditbeat messages).

    +
    9. +
+

Create Graylog REST API Token

+
    +
  1. +

    Navigate to the Graylog user configuration menu by selecting System > Users and Teams.

    +
    2. +
  2. +

    Select the user for which to create a token and click More Actions and then Edit Tokens.

    +
    3. +
  3. +

    Provide a Token Name (e.g. linux_auditbeat) and click Create Token.

    +
    4. +
  4. +

    Once the token is created, click Copy to Clipboard to retrieve the new API Access Token.

    +
    5. +
+

Install and Configure Graylog Sidecar Agent for Linux

+

Consult official documentation for full explanations and instructions.

Configure Auditbeat Log Collector in Graylog

-

Next, modify the Auditbeat log collector configuration. For more information on setting up Sidecar log collectors, see the Graylog documentation on default collector configurations.

+

Next, modify the Auditbeat log collector configuration. For more information on setting up Sidecar log collectors, see the Graylog documentation on default collector configurations.

  1. -

    Navigate to System > Sidecars and select the Configurations tab.

    +

    Navigate to System > Sidecars and select the Configurations tab.

  2. -

    Then, under the Log Collectors menu, select Edit next to your Auditlog collector.

    +

    Then, under the Log Collectors menu, select Edit next to your Auditlog collector.

  3. -

    Modify the "Executable Path" field to point to the new Auditbeat agent's binary path, which is set to /usr/share/auditbeat/bin/auditbeat by default.

    +

    Modify the "Executable Path" field to point to the new Auditbeat agent's binary path, which is set to /usr/share/auditbeat/bin/auditbeat by default.

    +
    4. +
  4. +

    Edit the Graylog Sidecar client configuration with your Graylog server API URL and API access token.

-

Optionally, you can also opt to create a new Auditbeat log collector with this path rather than modify the default so that you do not overwrite the default log collector. Remember to give it a unique name, like "Auditbeat (Elastic-licensed)."

-

Stream Configuration

-

This technology pack includes one stream:

-
    -
  • “Illuminate:Linux Auditbeat Messages”
    • -
-
-
-

Hint: If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

-
-
-

Index Set Configuration

-

This technology pack includes one index set definition:

-
    -
  • "Illuminate: Linux Auditbeat Messages"
    • -
-
-
Hint: If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation. -
-
-

Log Format Example

-

["type=CRED_ACQ msg=audit(1633670701.685:6873): pid=5205 uid=0 auid=4294967095 ses=4294970295 subj=unconfined msg='op=PAM:setcred grantors=pam_permit,pam_cap acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"] -

-

Requirements

-
    -
  • A configured Beats input on Graylog server (See “Create Beats Input” below)
    • -
  • The "Beats type prefix" must be enabled
    • -
  • One or more Linux hosts with Elastic Auditbeat installed
    • -
  • Beats agents, including Auditbeat, can be managed using the Graylog Sidecar
    • -
-
-
Warning: For Illuminate versions prior to Illuminate 2.2.2, the following must be added to the auditbeat.yml configuration file or to the Auditbeat configuration in the Graylog sidecar configuration for Auditbeat: -
- 
fields event_source_product: linux_auditbeat
-
-
-
-

What is Provided

-
    -
  • Parsing rules to extract Linux Auditbeat logs into Graylog schema compatible fields
    • -
  • Data lookup tables use in the normalization and enrichment of Linux Auditbeat log messages into the Graylog schema
    • -
  • Dashboards
    • -
-

Auditbeat Log Message Processing -

-

The Illuminate processing of Linux Auditbeat messages provides the following:

-
    -
  • Field extraction, normalization and message enrichment for Linux Auditbeat log messages
    • -
  • GIM Categorization of the following messages:
    • -
-

Auditbeat Module: AuditD

-

| vendor_event_category | -

-

Auditbeat Module: System

-

Auditbeat Module: File Integrity

- +

Optionally, you can also opt to create a new Auditbeat log collector with this path rather than modify the default so that you do not overwrite the default log collector. Remember to give it a unique name, like "Auditbeat (Elastic-licensed)."

+

GIM Categorization

+

GIM categorization is provided for the following messages:

+
+ + + + + + - - - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Auditbeat DatasetAuditbeat Log CategoryGIM CategoryGIM Subcategoryvendor_event_actiongim_event_type_codegim_event_categorygim_event_classgim_event_subcategorygim_event_type
-
- 		executedcellcell
-
- 		bound-socketcellcell
-
- 		connected-tocellcell
-
- 		network_flow -
- 		-
-
-
- 		process_stopped -
- 		-
-
-
- 		process_started -
- 		-
-
-
- 		existing_user -
- 		-
-
-
- 		existing_process -
- 		-
-
-
- 		opened-file -
- 		-
-
-
- 		was-authorized -
- 		-
-
-
- 		started-session -
- 		-
-
-
- 		acquired-credentials -
- 		-
-
-
- 		disposed-credentails -
- 		-
-
-
- 		ended-session -
- 		-
-
-
- 		changed-logon-id-to -
- 		-
-
-
- 		wrote-to-file -
- 		-
-
-
- 		started-service -
- 		-
-
-
- 		stopped-service -
- 		-
-
-
- 		process_error -
- 		-
-
-
- 		attributes_modified -
- 		-
-
-
- 		updated -
- 		-
-
-
- 		created -
- 		-
-
-
- 		host -
- 		-
-
-
- 		authenticated -
- 		-
-
-
- 		deleted -
- 		-
-
-
- 		moved -
- 		-
-
-
- 		violated-apparmor-policy -
- 		-
-
-
- 		package_updated -
- 		-
-
-
- 		ran-command -
- 		-
-
-
- 		refreshed-credentials -
- 		-
-
-
- 		user_logout -
- 		-
-
-
- 		package_installed -
- 		-
-
-
- 		renamed -
- 		-
-
-
- 		user_login -
- 		-
-
-
- 		accepted-connection-from -
- 		-
-
-
- 		logged-in -
- 		-
-
-
- 		changed-password -
- 		-
-
-
- 		added-group-account-to -
- 		-
-
-
- 		package_removed -
- 		-
-
-
- 		user_changed -
- 		-
-
-
- 		added-user-account -
- 		-
-
-
- 		host_changed -
- 		-
-
-
- 		password_changed -
- 		-
-
-
- 		sent-to -
- 		-
-
-
- 		user_added -
- 		-
-
-
- 		deleted-group-account-from -
- 		-
- 		190000processendpointprocess.executeprocess started
existing_package000000messagemessage.log_messagemessage
bound-socket000000messagemessage.log_messagemessage
connected-to000000messagemessage.log_messagemessage
network_flow129999networknetwork.defaultnetwork message
process_stopped190100processendpointprocess.endprocess stopped
process_started190000processendpointprocess.executeprocess started
existing_user119999iamiam.defaultiam message
existing_process000000messagemessage.log_messagemessage
opened-file201500fileendpointfile.accessfile accessed
was-authorized109999authenticationauthentication.defaultauthentication message
started-session109999authenticationauthentication.defaultauthentication message
acquired-credentials109999authenticationauthentication.defaultauthentication message
disposed-credentials109999authenticationauthentication.defaultauthentication message
ended-session109999authenticationauthentication.defaultauthentication message
changed-login-id-to109999authenticationauthentication.defaultauthentication message
wrote-to-file000000messagemessage.log_messagemessage
started-service210000serviceendpointservice.startservice started
stopped-service210100serviceendpointservice.stopservice stopped
process_error000000messagemessage.log_messagemessage
attributes_modified201000fileendpointfile.modifyfile modified
updated201000fileendpointfile.modifyfile modified
created200000fileendpointfile.createfile created
host000000messagemessage.log_messagemessage
authenticated109999authenticationauthentication.defaultauthentication message
deleted200100fileendpointfile.deletefile deleted
moved201000fileendpointfile.modifyfile modified
violated-apparmor-policy301002alertalert.host alerthips alert
package_updated000000messagemessage.log_messagemessage
ran-command000000messagemessage.log_messagemessage
refreshed-credentials109999authenticationauthentication.defaultauthentication message
user_logout102500authenticationauthentication.logofflogoff
package_installed000000messagemessage.log_messagemessage
renamed201000fileendpointfile.modifyfile modified
user_login100000authenticationauthentication.logonlogon
accepted-connection-from000000messagemessage.log_messagemessage
logged-in100000authenticationauthentication.logonlogon
changed-password111004iamiam.object modifypassword change
added-group-account-to119999iamiam.defaultiam message
package_removed000000messagemessage.log_messagemessage
user_changed111000iamiam.object modifyaccount modified
added-user-account111007iamiam.object modifygroup member added
host_changed000000messagemessage.log_messagemessage
password_changed111004iamiam.object modifypassword change
sent-to129999networknetwork.defaultnetwork message
user_added110000iamiam.object createaccount created
deleted-group-account-from110501iamiam.object deletegroup deleted
changed-audit-configuration000000messagemessage.log_messagemessage
shutdown000000messagemessage.log_messagemessage
boot000000messagemessage.log_messagemessage
initial_scan000000messagemessage.log_messagemessage
deleted-user-account000000messagemessage.log_messagemessage
user_removed000000messagemessage.log_messagemessage
reboot000000messagemessage.log_messagemessage
access-permission000000messagemessage.log_messagemessage
changed-promiscuous-mode-on-device000000messagemessage.log_messagemessage
loaded-firewall-rule-to000000messagemessage.log_messagemessage
received-from000000messagemessage.log_messagemessage
created-directory000000messagemessage.log_messagemessage
changed-to-runlevel000000messagemessage.log_messagemessage
changed-file-attributes-of000000messagemessage.log_messagemessage
changed-file-permissions-of000000messagemessage.log_messagemessage
changed-file-ownership-of000000messagemessage.log_messagemessage
symlinked000000messagemessage.log_messagemessage
killed-pid000000messagemessage.log_messagemessage
read-file000000messagemessage.log_messagemessage
listen-for-connections000000messagemessage.log_messagemessage
changed-configuration000000messagemessage.log_messagemessage
crashed-program000000messagemessage.log_messagemessage
changed-system-name000000messagemessage.log_messagemessage
violated-selinux-policy000000messagemessage.log_messagemessage
changed-role-to000000messagemessage.log_messagemessage
relabeled-filesystem000000messagemessage.log_messagemessage
changed-selinux-enforcement000000messagemessage.log_messagemessage
assigned-vm-resource000000messagemessage.log_messagemessage
assigned-vm-id000000messagemessage.log_messagemessage
issued-vm-control000000messagemessage.log_messagemessage
opened-too-many-sessions-to000000messagemessage.log_messagemessage
hostname_changed000000messagemessage.log_messagemessage
checked-metadata-of000000messagemessage.log_messagemessage
mounted000000messagemessage.log_messagemessage
unmounted000000messagemessage.log_messagemessage
end000000messagemessage.log_messagemessage
changed-system-time000000messagemessage.log_messagemessage
changed-identity-of000000messagemessage.log_messagemessage
changed-timestamp-of000000messagemessage.log_messagemessage
failed-log-in-too-many-times-to000000messagemessage.log_messagemessage
loaded-selinux-policy000000messagemessage.log_messagemessage
assigned-user-role-to000000messagemessage.log_messagemessage
removed-user-role-from000000messagemessage.log_messagemessage
changed-selinux-boolean000000messagemessage.log_messagemessage
error000000messagemessage.log_messagemessage
adjusted-scheduling-policy-of000000messagemessage.log_messagemessage
allocated-memory000000messagemessage.log_messagemessage
checked-filesystem-metadata-of000000messagemessage.log_messagemessage
loaded-kernel-module000000messagemessage.log_messagemessage
unloaded-kernel-module000000messagemessage.log_messagemessage
make-device000000messagemessage.log_messagemessage
violated-seccomp-policy000000messagemessage.log_messagemessage
-

Linux Auditbeat Spotlight Content Pack

-

Create a Beats Input

-
-
Hint: One beats input can service multiple log sources; therefore, this step is not required if a beats input has already been configured.
-
-
    -
  1. On the Select Input drop-down menu, select the System menu and then choose Inputs.
    2. -
  2. Select Beats from the Select Input drop-down menu.
    3. -
  3. Click Launch New Input.
    4. -
  4. Assign a node or select Global mode.
    5. -
  5. Set the Title, Bind Address, and listening Port. For example:
    1. Title: “Beats input 5044”
    2. Bind address: “0.0.0.0” to listen on all interfaces
    3. Port: “5044”
    6. -
  6. Make sure the option “Do not add Beats type as prefix” is not selected. Pipeline processing rules reference incoming data by field name and the pipeline will not function correctly if this prefix is omitted.
    7. -
  7. Save the input settings.
    8. -
  8. If the input does not start automatically, select Start Input to begin listening for and processing new Beats messages (including Linux Auditbeat messages).
    9. -
\ No newline at end of file