Skip to content

Commit

Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Auditbeat] Add system module package dataset ECS categorization fiel…
Browse files Browse the repository at this point in the history
…ds (elastic#18033)

* [Auditbeat] Add system module package dataset ECS categorization fields

* add changelog entry

* Add ECS package fields

(cherry picked from commit 5a308fe)
Andrew Stucki committed May 5, 2020

Unverified

This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
1 parent de2248f commit 3106ec4
Showing 7 changed files with 64 additions and 7 deletions.
3 changes: 3 additions & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
@@ -283,6 +283,9 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Fix syscall kprobe arguments for 32-bit systems in socket module. {pull}17500[17500]
- Fix memory leak on when we miss socket close kprobe events. {pull}17500[17500]
- Add system module process dataset ECS categorization fields. {pull}18032[18032]
- Add system module socket dataset ECS categorization fields. {pull}18036[18036]
- Add ECS categories for system module host dataset. {pull}18031[18031]
- Add system module package dataset ECS categorization fields. {pull}18033[18033]

*Filebeat*

48 changes: 42 additions & 6 deletions x-pack/auditbeat/module/system/package/package.go
Original file line number Diff line number Diff line change
@@ -76,6 +76,21 @@ func (action eventAction) String() string {
}
}

func (action eventAction) Type() string {
switch action {
case eventActionExistingPackage:
return "info"
case eventActionPackageInstalled:
return "installation"
case eventActionPackageRemoved:
return "deletion"
case eventActionPackageUpdated:
return "change"
default:
return "info"
}
}

func init() {
mb.Registry.MustAddMetricSet(moduleName, metricsetName, New,
mb.DefaultMetricSet(),
@@ -107,6 +122,7 @@ type Package struct {
Summary string
URL string
Error error
Type string
}

// Hash creates a hash for Package.
@@ -119,41 +135,55 @@ func (pkg Package) Hash() uint64 {
return h.Sum64()
}

func (pkg Package) toMapStr() common.MapStr {
func (pkg Package) toMapStr() (common.MapStr, common.MapStr) {
mapstr := common.MapStr{
"name": pkg.Name,
"version": pkg.Version,
}
ecsMapstr := common.MapStr{
"name": pkg.Name,
"version": pkg.Version,
}

if pkg.Release != "" {
mapstr.Put("release", pkg.Release)
}

if pkg.Arch != "" {
mapstr.Put("arch", pkg.Arch)
ecsMapstr.Put("architecture", pkg.License)
}

if pkg.License != "" {
mapstr.Put("license", pkg.License)
ecsMapstr.Put("license", pkg.License)
}

if !pkg.InstallTime.IsZero() {
mapstr.Put("installtime", pkg.InstallTime)
ecsMapstr.Put("installed", pkg.InstallTime)
}

if pkg.Size != 0 {
mapstr.Put("size", pkg.Size)
ecsMapstr.Put("size", pkg.Size)
}

if pkg.Summary != "" {
mapstr.Put("summary", pkg.Summary)
ecsMapstr.Put("description", pkg.Summary)
}

if pkg.URL != "" {
mapstr.Put("url", pkg.URL)
ecsMapstr.Put("reference", pkg.URL)
}

return mapstr
if pkg.Type != "" {
ecsMapstr.Put("type", pkg.Type)
}

return mapstr, ecsMapstr
}

// entityID creates an ID that uniquely identifies this package across machines.
@@ -340,15 +370,19 @@ func convertToPackage(cacheValues []interface{}) []*Package {
}

func (ms *MetricSet) packageEvent(pkg *Package, eventType string, action eventAction) mb.Event {
pkgFields, ecsPkgFields := pkg.toMapStr()
event := mb.Event{
RootFields: common.MapStr{
"event": common.MapStr{
"kind": eventType,
"action": action.String(),
"kind": eventType,
"category": []string{"package"},
"type": []string{action.Type()},
"action": action.String(),
},
"package": ecsPkgFields,
"message": packageMessage(pkg, action),
},
MetricSetFields: pkg.toMapStr(),
MetricSetFields: pkgFields,
}

if ms.HostID() != "" {
@@ -538,7 +572,9 @@ func (ms *MetricSet) listDebPackages() ([]*Package, error) {
value := strings.TrimSpace(words[1])

if pkg == nil {
pkg = &Package{}
pkg = &Package{
Type: "dpkg",
}
}

switch strings.ToLower(words[0]) {
1 change: 1 addition & 0 deletions x-pack/auditbeat/module/system/package/package_homebrew.go
Original file line number Diff line number Diff line change
@@ -52,6 +52,7 @@ func listBrewPackages() ([]*Package, error) {
Name: packageDir.Name(),
Version: version.Name(),
InstallTime: version.ModTime(),
Type: "brew",
}

// Read formula
Original file line number Diff line number Diff line change
@@ -51,11 +51,19 @@ func TestHomebrew(t *testing.T) {

if assert.Len(t, events, 1) {
event := mbtest.StandardizeEvent(f, events[0], core.AddDatasetToEvent)
checkFieldValue(t, event, "event.kind", "state")
checkFieldValue(t, event, "event.category", []string{"package"})
checkFieldValue(t, event, "event.type", []string{"info"})
checkFieldValue(t, event, "system.audit.package.name", "test-package")
checkFieldValue(t, event, "system.audit.package.summary", "Test package")
checkFieldValue(t, event, "system.audit.package.url", "https://www.elastic.co/")
checkFieldValue(t, event, "system.audit.package.version", "1.0.0")
checkFieldValue(t, event, "system.audit.package.entity_id", "Krm421rtYM4wgq1S")
checkFieldValue(t, event, "package.name", "test-package")
checkFieldValue(t, event, "package.description", "Test package")
checkFieldValue(t, event, "package.reference", "https://www.elastic.co/")
checkFieldValue(t, event, "package.version", "1.0.0")
checkFieldValue(t, event, "package.type", "brew")
}
}
}
6 changes: 6 additions & 0 deletions x-pack/auditbeat/module/system/package/package_test.go
Original file line number Diff line number Diff line change
@@ -75,6 +75,12 @@ func TestDpkg(t *testing.T) {
checkFieldValue(t, event, "system.audit.package.summary", "Test Package")
checkFieldValue(t, event, "system.audit.package.url", "https://www.elastic.co/")
checkFieldValue(t, event, "system.audit.package.version", "8.2.0-1ubuntu2~18.04")
checkFieldValue(t, event, "package.name", "test")
checkFieldValue(t, event, "package.size", uint64(269))
checkFieldValue(t, event, "package.description", "Test Package")
checkFieldValue(t, event, "package.reference", "https://www.elastic.co/")
checkFieldValue(t, event, "package.version", "8.2.0-1ubuntu2~18.04")
checkFieldValue(t, event, "package.type", "dpkg")
}
}

1 change: 1 addition & 0 deletions x-pack/auditbeat/module/system/package/rpm_common_test.go
Original file line number Diff line number Diff line change
@@ -41,6 +41,7 @@ func rpmPackagesByExec() ([]*Package, error) {
// size - 6
URL: words[7],
Summary: words[8],
Type: "rpm",
}
ts, err := strconv.ParseInt(words[5], 10, 64)
if err != nil {
4 changes: 3 additions & 1 deletion x-pack/auditbeat/module/system/package/rpm_linux.go
Original file line number Diff line number Diff line change
@@ -357,7 +357,9 @@ func packageFromHeader(header C.Header, openedLibrpm *librpm) (*Package, error)
}
defer C.my_headerFree(openedLibrpm.headerFree, header)

pkg := Package{}
pkg := Package{
Type: "rpm",
}

name := C.my_headerGetString(openedLibrpm.headerGetString, header, RPMTAG_NAME)
if name != nil {

0 comments on commit 3106ec4

Please sign in to comment.