Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] Remove unset user.auid and auditd.session #11431

Closed
andrewkroh opened this issue Mar 25, 2019 · 2 comments · Fixed by #11815
Closed

[Auditbeat] Remove unset user.auid and auditd.session #11431

andrewkroh opened this issue Mar 25, 2019 · 2 comments · Fixed by #11815
Labels
Auditbeat enhancement

Comments

@andrewkroh
Copy link
Member

It has been requested to drop the user.auid field when the value is unset.

Likewise we should follow the same practice for the unset session IDs (auditd.session:unset).
@andrewkroh
Copy link
Member Author

cc: @FrankHassanabad

@adriansr
Copy link
Contributor

Is there a reason to do this only for user.auid and not for all the uid fields?

adriansr added a commit to adriansr/beats that referenced this issue Apr 15, 2019
@adriansr
[Auditbeat] Remove unset auid and session fields
b97b362 
The auditd module sets `user.audit.id` and `auditd.session` to `unset`
when they are not present in the original event.

This changes this behavior and removes the fields from the event. The
same logic is applied to any other *ID field that might be marked as
unset.

Closes elastic#11431
@adriansr adriansr mentioned this issue Apr 15, 2019
Merged
adriansr added a commit that referenced this issue Apr 18, 2019
@adriansr
[Auditbeat] Remove unset auid and session fields (#11815)
a3856b9 
The auditd module sets `user.audit.id` and `auditd.session` to `unset`
when they are not present in the original event.

This changes this behavior and removes the fields from the event. The
same logic is applied to any other *ID field that might be marked as
unset.

Closes #11431
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Auditbeat enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Auditbeat] Remove unset auid and session fields adriansr/beats
2 participants
@andrewkroh @adriansr