elastic / elastic/integrations

[Auditd Manager]: Wrong log content with session tracing feature on

Open
#15,477 2 comments 0 reactions 0 assignees View on GitHub
Integration:auditd_manager needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Auditd Manager [auditd_manager]

### Dataset Name

_No response_

### Integration Version

1.19.0

### Agent Version

8.18.5

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.18.5

### OS Version and Architecture

ubuntu 24.04.03 LTS

### Software/API Version

_No response_

### Error Message

_No response_

### Event Original

[type=SYSCALL msg=audit(1758885372.736:43290108): arch=c000003e syscall=59 success=yes exit=0 a0=61db43358790 a1=61db43204a40 a2=61db433398a0 a3=61db43204a40 items=2 ppid=2830 pid=32736 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=3 comm="mkdir" exe="/usr/bin/mkdir" subj=unconfined key="exec", type=EXECVE msg=audit(1758885372.736:43290108): argc=2 a0="mkdir" a1="aal", type=PATH msg=audit(1758885372.736:43290108): item=0 name="/usr/bin/mkdir" inode=1198344 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0, type=PATH msg=audit(1758885372.736:43290108): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=1201555 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0, type=PROCTITLE msg=audit(1758885372.736:43290108): proctitle=6D6B6469720061616C]

### What did you do?

I configured it with my auditd rules and turned on/off session tracking feature from GUI.

### What did you see?

I saw wrong process.name, process.executable for process execution events when session tracing is turned on. raw log content was ok and it looked like auditd manager was supposed to pull data from auditd events appropriately.After turning before mentioned feature off log fields were matching original logs and other fields such as process.args or process.title.

### What did you expect to see?

I expected process.executable and process.name to match the process that is executed, the way it is logged in auditd events and parsed in other fields such as process.args.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.