elastic / elastic/integrations

Add user ID resolution to Elastic Agent Processors for the Auditd Manager Integration

Open
#18,261 0 comments 0 reactions 0 assignees View on GitHub
Integration:auditd_manager
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

**Describe the enhancement:**
Add user ID resolution to Elastic Agent Processors for the Auditd Manager Integration. Some events that get processes by Auditd Manager do not translate all the user IDs that are part of the event like euid, suid, acct, and id. As a result, user's are left with having to manually validate user IDs for events which is not feasible on large networks.

**Describe a specific use case for the enhancement or feature:**

Example:
For the auditd.message_type of acct_lock, here is the event.original:

`type=ACCT_LOCK msg=audit(1775564589.690:43283): pid=190772 uid=0 auid=1000 ses=16 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=locked-password id=2002 exe="/usr/bin/passwd" hostname=RHEL9 addr=? terminal=pts/2 res=success'`

uid gets translated into several fields:

```
auditd.summary.actor.secondary: root

process.group.name: root

process.parent.group.name: root

process.parent.user.name: root

process.session_leader.group.name: root

process.session_leader.user.name: root

process.user.name: root

user.name: root

```

auid gets translated into two fields:

```
auditd.summary.actor.primary: admin

user.audit.name: admin
```

id does not get translated (this is the user the action is taken against...in this case, admin elevated to root and locked user id 2002). The id should be the target user. Instead only the raw id is stored (auditd.data.id: 2002). Given this scenario, we know the user who committed the action but not who it was committed against without manually going to the source host and resolving the ID 2002 to get a username.

I think it would be useful to have the ability to translate user ids in a processor in cases like these. The Windows integration seems to have this capability (translate_sid-processor). https://www.elastic.co/docs/reference/fleet/translate_sid-processor

**What is the definition of done?**
1. A processor is added to Elastic Agent to resolve user IDs in the Auditd Manager integration.
2. Documentation is published on how to use this processor.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.