aucoalesce

Documentation

Overview

Package aucoalesce provides functions to coalesce compound audit messages into a single event and normalize all message types with some common fields.

Index

• func LoadNormalizationConfig(b []byte) (syscalls map[string]*Normalization, recordTypes map[string]*Normalization, ...)
• func ResolveIDs(event *Event)
• type AuditEventType
  • func GetAuditEventType(t AuditMessageType) AuditEventType
  • func (t AuditEventType) MarshalText() (text []byte, err error)
  • func (t AuditEventType) String() string
• type Event
  • func CoalesceMessages(msgs []*auparse.AuditMessage) (*Event, error)
• type GroupCache
  • func NewGroupCache() GroupCache
  • func (c GroupCache) LookupGID(gid string) string
• type HowMapping
• type Normalization
• type NormalizationConfig
• type Object
• type ObjectMapping
• type Strings
  • func (s *Strings) UnmarshalYAML(unmarshal func(interface{}) error) error
• type Subject
• type SubjectMapping
• type UserCache
  • func NewUserCache() UserCache
  • func (c UserCache) LookupUID(uid string) string

Functions

func LoadNormalizationConfig

func LoadNormalizationConfig(b []byte) (syscalls map[string]*Normalization, recordTypes map[string]*Normalization, err error)

func ResolveIDs

func ResolveIDs(event *Event)

ResolveIDs translates all uid and gid values to their associated names. This requires cgo on Linux.

Types

type AuditEventType

type AuditEventType uint16

AuditEventType is a categorization of a simple or compound audit event.

const (
	EventTypeUnknown AuditEventType = iota
	EventTypeUserspace
	EventTypeSystemServices
	EventTypeConfig
	EventTypeTTY
	EventTypeUserAccount
	EventTypeUserLogin
	EventTypeAuditDaemon
	EventTypeMACDecision
	EventTypeAnomoly
	EventTypeIntegrity
	EventTypeAnomolyResponse
	EventTypeMAC
	EventTypeCrypto
	EventTypeVirt
	EventTypeAuditRule
	EventTypeDACDecision
	EventTypeGroupChange
)

func GetAuditEventType

func GetAuditEventType(t AuditMessageType) AuditEventType

func (AuditEventType) MarshalText

func (t AuditEventType) MarshalText() (text []byte, err error)

func (AuditEventType) String

func (t AuditEventType) String() string

type Event

type Event struct {
	Timestamp time.Time                `json:"@timestamp"       yaml:"timestamp"`
	Sequence  uint32                   `json:"sequence"         yaml:"sequence"`
	Category  AuditEventType           `json:"category"         yaml:"category"`
	Type      auparse.AuditMessageType `json:"record_type"      yaml:"type"`
	Result    string                   `json:"result,omitempty" yaml"result,omitempty"`
	Session   string                   `json:"session"          yaml:"session"`
	Subject   Subject                  `json:"actor"            yaml:"actor"`
	Action    string                   `json:"action,omitempty" yaml:"action,omitempty"`
	Object    Object                   `json:"thing,omitempty"  yaml:"thing,omitempty"`
	How       string                   `json:"how,omitempty"    yaml:"how,omitempty"`
	Key       string                   `json:"key,omitempty"    yaml:"key,omitempty"`

	Data   map[string]string   `json:"data,omitempty"   yaml:"data,omitempty"`
	Paths  []map[string]string `json:"paths,omitempty"  yaml:"paths,omitempty"`
	Socket map[string]string   `json:"socket,omitempty" yaml:"socket,omitempty"`

	Warnings []error `json:"-" yaml:"-"`
}

func CoalesceMessages

func CoalesceMessages(msgs []*auparse.AuditMessage) (*Event, error)

CoalesceMessages combines the given messages into a single event. It assumes that all the messages in the slice have the same timestamp and sequence number. An error is returned is msgs is empty or nil or only contains and EOE (end-of-event) message.

type GroupCache

type GroupCache map[string]stringItem

GroupCache is a cache of GID to group name.

func NewGroupCache

func NewGroupCache() GroupCache

NewGroupCache returns a new GroupCache.

func (GroupCache) LookupGID

func (c GroupCache) LookupGID(gid string) string

LookupGID looks up a GID and returns the group associated with it. If no group could be found an empty string is returned. The value will be cached for a minute. This requires cgo on Linux.

type HowMapping

type HowMapping struct {
	FieldName string `yaml:"field"`
}

type Normalization

type Normalization struct {
	Subject     SubjectMapping `yaml:"subject"`
	Action      string         `yaml:"action"`
	Object      ObjectMapping  `yaml:"object"`
	How         Strings        `yaml:"how"`
	RecordTypes Strings        `yaml:"record_types"`
	Syscalls    Strings        `yaml:"syscalls"`
}

type NormalizationConfig

type NormalizationConfig struct {
	Default        Normalization `yaml:"default"`
	Normalizations []Normalization
}

type Object

type Object struct {
	Primary   string            `json:"primary,omitempty"   yaml:"primary,omitempty"`
	Secondary string            `json:"secondary,omitempty" yaml:"secondary,omitempty"`
	What      string            `json:"what,omitempty"      yaml:"what,omitempty"`
	SELinux   map[string]string `json:"selinux,omitempty"   yaml:"selinux,omitempty"`
}

type ObjectMapping

type ObjectMapping struct {
	PrimaryFieldName   Strings `yaml:"primary"`
	SecondaryFieldName Strings `yaml:"secondary"`
	What               string  `yaml:"what"`
	PathIndex          int     `yaml:"path_index"`
}

type Strings

type Strings struct {
	Values []string
}

Strings is a custom type to enable YAML values that can be either a string or a list of strings.

func (*Strings) UnmarshalYAML

func (s *Strings) UnmarshalYAML(unmarshal func(interface{}) error) error

type Subject

type Subject struct {
	Primary    string            `json:"primary,omitempty"   yaml:"primary,omitempty"`
	Secondary  string            `json:"secondary,omitempty" yaml:"secondary,omitempty"`
	Attributes map[string]string `json:"attrs,omitempty"     yaml:"attrs,omitempty"`   // Other identifying data like euid, suid, fsuid, gid, egid, sgid, fsgid.
	SELinux    map[string]string `json:"selinux,omitempty"   yaml:"selinux,omitempty"` // SELinux labels.
}

type SubjectMapping

type SubjectMapping struct {
	PrimaryFieldName   Strings `yaml:"primary"`
	SecondaryFieldName Strings `yaml:"secondary"`
}

type UserCache

type UserCache map[string]stringItem

UserCache is a cache of UID to username.

func NewUserCache

func NewUserCache() UserCache

NewUserCache returns a new UserCache.

func (UserCache) LookupUID

func (c UserCache) LookupUID(uid string) string

LookupUID looks up a UID and returns the username associated with it. If no username could be found an empty string is returned. The value will be cached for a minute. This requires cgo on Linux.