Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add_process_metadata: enrich process info with process owner (#21068) #21111

Merged
merged 6 commits into from
Jul 19, 2021
Merged

add_process_metadata: enrich process info with process owner (#21068) #21111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2c2c4ee
Packetbeat: enrich process info with process owner (#21068)
dddpaul Sep 13, 2020
9c01c3d
Do not fail on getting process owner errors. Do not enrich event on e…
dddpaul Sep 28, 2020
e2148ae
Move changelog entry to proper place
dddpaul Nov 10, 2020
5d9855a
Populate process.owner.{name,pid}
adriansr Jul 9, 2021
06b4af0
Make update
adriansr Jul 15, 2021
06aa7b2
Correct changelog duplication
adriansr Jul 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -612,6 +612,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Add orchestrator.cluster.name/url fields as k8s metadata {pull}26056[26056]
- Libbeat: report beat version to monitoring. {pull}26214[26214]
- Ensure common proxy settings support in HTTP clients: proxy_disabled, proxy_url, proxy_headers and typical environment variables HTTP_PROXY, HTTPS_PROXY, NOPROXY. {pull}25219[25219]
- `add_process_metadata` processor enrich process information with owner name and id. {issue}21068[21068] {pull}21111[21111]

*Auditbeat*

Expand Down
33 changes: 33 additions & 0 deletions auditbeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12676,6 +12676,39 @@ alias to: process.executable

--

[float]
=== owner

Process owner information.


*`process.owner.id`*::
+
--
Unique identifier of the user.

type: keyword

--

*`process.owner.name`*::
+
--
Short name or login of the user.

type: keyword

example: albert

--

*`process.owner.name.text`*::
+
--
type: text

--

[[exported-fields-system]]
== System fields

Expand Down
2 changes: 1 addition & 1 deletion auditbeat/include/fields.go
View file
Open in desktop

Large diffs are not rendered by default.

33 changes: 33 additions & 0 deletions filebeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114836,6 +114836,39 @@ alias to: process.executable

--

[float]
=== owner

Process owner information.


*`process.owner.id`*::
+
--
Unique identifier of the user.

type: keyword

--

*`process.owner.name`*::
+
--
Short name or login of the user.

type: keyword

example: albert

--

*`process.owner.name.text`*::
+
--
type: text

--

[[exported-fields-proofpoint]]
== Proofpoint Email Security fields

Expand Down
2 changes: 1 addition & 1 deletion filebeat/include/fields.go
View file
Open in desktop

Large diffs are not rendered by default.

33 changes: 33 additions & 0 deletions heartbeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10258,6 +10258,39 @@ alias to: process.executable

--

[float]
=== owner

Process owner information.


*`process.owner.id`*::
+
--
Unique identifier of the user.

type: keyword

--

*`process.owner.name`*::
+
--
Short name or login of the user.

type: keyword

example: albert

--

*`process.owner.name.text`*::
+
--
type: text

--

[[exported-fields-resolve]]
== Host lookup fields

Expand Down
2 changes: 1 addition & 1 deletion heartbeat/include/fields.go
View file
Open in desktop

Large diffs are not rendered by default.

33 changes: 33 additions & 0 deletions journalbeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10603,3 +10603,36 @@ alias to: process.executable

--

[float]
=== owner

Process owner information.


*`process.owner.id`*::
+
--
Unique identifier of the user.

type: keyword

--

*`process.owner.name`*::
+
--
Short name or login of the user.

type: keyword

example: albert

--

*`process.owner.name.text`*::
+
--
type: text

--

2 changes: 1 addition & 1 deletion journalbeat/include/fields.go
View file
Open in desktop

Large diffs are not rendered by default.

19 changes: 19 additions & 0 deletions libbeat/processors/add_process_metadata/_meta/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,22 @@
type: alias
path: process.executable
migration: true
- name: owner
type: group
description: Process owner information.
fields:
- name: id
type: keyword
ignore_above: 1024
description: Unique identifier of the user.
- name: name
type: keyword
ignore_above: 1024
multi_fields:
- name: text
type: text
norms: false
default_field: false
description: Short name or login of the user.
example: albert

42 changes: 27 additions & 15 deletions libbeat/processors/add_process_metadata/add_process_metadata.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,11 +65,11 @@ type addProcessMetadata struct {
}

type processMetadata struct {
name, title, exe string
args []string
env map[string]string
startTime time.Time
pid, ppid int
name, title, exe, username, userid string
args []string
env map[string]string
startTime time.Time
pid, ppid int
//
fields common.MapStr
}
Expand Down Expand Up @@ -301,16 +301,28 @@ func (p *addProcessMetadata) String() string {
}

func (p *processMetadata) toMap() common.MapStr {
process := common.MapStr{
"name": p.name,
"title": p.title,
"executable": p.exe,
"args": p.args,
"env": p.env,
"pid": p.pid,
"ppid": p.ppid,
"start_time": p.startTime,
}
if p.username != "" || p.userid != "" {
user := common.MapStr{}
if p.username != "" {
user["name"] = p.username
}
if p.userid != "" {
user["id"] = p.userid
}
process["owner"] = user
}

return common.MapStr{
"process": common.MapStr{
"name": p.name,
"title": p.title,
"executable": p.exe,
"args": p.args,
"env": p.env,
"pid": p.pid,
"ppid": p.ppid,
"start_time": p.startTime,
},
"process": process,
}
}
48 changes: 48 additions & 0 deletions libbeat/processors/add_process_metadata/add_process_metadata_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ func TestAddProcessMetadata(t *testing.T) {
pid: 1,
ppid: 0,
startTime: startTime,
username: "root",
userid: "0",
},
3: {
name: "systemd",
Expand All @@ -65,6 +67,8 @@ func TestAddProcessMetadata(t *testing.T) {
pid: 1,
ppid: 0,
startTime: startTime,
username: "user",
userid: "1001",
},
}

Expand Down Expand Up @@ -136,6 +140,10 @@ func TestAddProcessMetadata(t *testing.T) {
"pid": 1,
"ppid": 0,
"start_time": startTime,
"owner": common.MapStr{
"name": "root",
"id": "0",
},
},
"container": common.MapStr{
"id": "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1",
Expand Down Expand Up @@ -217,6 +225,10 @@ func TestAddProcessMetadata(t *testing.T) {
"pid": 1,
"ppid": 0,
"start_time": startTime,
"owner": common.MapStr{
"name": "root",
"id": "0",
},
},
"container": common.MapStr{
"id": "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1",
Expand Down Expand Up @@ -251,6 +263,10 @@ func TestAddProcessMetadata(t *testing.T) {
"BOOT_IMAGE": "/boot/vmlinuz-4.11.8-300.fc26.x86_64",
"LANG": "en_US.UTF-8",
},
"owner": common.MapStr{
"name": "root",
"id": "0",
},
},
"container": common.MapStr{
"id": "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1",
Expand Down Expand Up @@ -286,6 +302,10 @@ func TestAddProcessMetadata(t *testing.T) {
"BOOT_IMAGE": "/boot/vmlinuz-4.11.8-300.fc26.x86_64",
"LANG": "en_US.UTF-8",
},
"owner": common.MapStr{
"name": "root",
"id": "0",
},
},
},
},
Expand Down Expand Up @@ -474,6 +494,10 @@ func TestAddProcessMetadata(t *testing.T) {
"pid": 1,
"ppid": 0,
"start_time": startTime,
"owner": common.MapStr{
"name": "root",
"id": "0",
},
},
"container": common.MapStr{
"id": "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1",
Expand Down Expand Up @@ -593,6 +617,10 @@ func TestAddProcessMetadata(t *testing.T) {
"pid": 1,
"ppid": 0,
"start_time": startTime,
"owner": common.MapStr{
"name": "user",
"id": "1001",
},
},
},
},
Expand Down Expand Up @@ -646,6 +674,26 @@ func TestAddProcessMetadata(t *testing.T) {
},
},
},
{
description: "only user",
config: common.MapStr{
"match_pids": []string{"ppid"},
"target": "",
"include_fields": []string{"process.owner"},
},
event: common.MapStr{
"ppid": "1",
},
expected: common.MapStr{
"ppid": "1",
"process": common.MapStr{
"owner": common.MapStr{
"id": "0",
"name": "root",
},
},
},
},
} {
t.Run(test.description, func(t *testing.T) {
config, err := common.NewConfigFrom(test.config)
Expand Down
4 changes: 4 additions & 0 deletions libbeat/processors/add_process_metadata/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,10 @@ var defaultFields = common.MapStr{
"pid": nil,
"ppid": nil,
"start_time": nil,
"owner": common.MapStr{
"name": nil,
"id": nil,
},
},
"container": common.MapStr{
"id": nil,
Expand Down
4 changes: 4 additions & 0 deletions libbeat/processors/add_process_metadata/docs/add_process_metadata.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,10 @@ The fields added to the event look as follows:
"pid": 1,
"ppid": 0,
"start_time": "2018-08-22T08:44:50.684Z",
"owner": {
"name": "root",
"id": "0"
}
},
"container": {
"id": "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1"
Expand Down
1 change: 1 addition & 0 deletions libbeat/processors/add_process_metadata/gosigar_provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ func (p gosigarProvider) GetProcessMetadata(pid int) (result *processMetadata, e
env: procEnv.Vars,
pid: pid,
ppid: procState.Ppid,
username: procState.Username,
startTime: time.Unix(int64(procTime.StartTime/1000), int64(procTime.StartTime%1000)*1000000),
}
r.fields = r.toMap()
Expand Down
Loading