elastic / elastic/integrations
Add user ID resolution to Elastic Agent Processors for the Auditd Manager Integration
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
**Describe the enhancement:**
Add user ID resolution to Elastic Agent Processors for the Auditd Manager Integration. Some events that get processes by Auditd Manager do not translate all the user IDs that are part of the event like euid, suid, acct, and id. As a result, user's are left with having to manually validate user IDs for events which is not feasible on large networks.
**Describe a specific use case for the enhancement or feature:**
Example:
For the auditd.message_type of acct_lock, here is the event.original:
`type=ACCT_LOCK msg=audit(1775564589.690:43283): pid=190772 uid=0 auid=1000 ses=16 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=locked-password id=2002 exe="/usr/bin/passwd" hostname=RHEL9 addr=? terminal=pts/2 res=success'`
uid gets translated into several fields:
```
auditd.summary.actor.secondary: root
process.group.name: root
process.parent.group.name: root
process.parent.user.name: root
process.session_leader.group.name: root
process.session_leader.user.name: root
process.user.name: root
user.name: root
```
auid gets translated into two fields:
```
auditd.summary.actor.primary: admin
user.audit.name: admin
```
id does not get translated (this is the user the action is taken against...in this case, admin elevated to root and locked user id 2002). The id should be the target user. Instead only the raw id is stored (auditd.data.id: 2002). Given this scenario, we know the user who committed the action but not who it was committed against without manually going to the source host and resolving the ID 2002 to get a username.
I think it would be useful to have the ability to translate user ids in a processor in cases like these. The Windows integration seems to have this capability (translate_sid-processor). https://www.elastic.co/docs/reference/fleet/translate_sid-processor
**What is the definition of done?**
1. A processor is added to Elastic Agent to resolve user IDs in the Auditd Manager integration.
2. Documentation is published on how to use this processor.
Contributor guide
Assessment
This issue has not been assessed yet.