auditd-logs

1#type=SYSCALL msg=audit(1672330955.273:4433): arch=c000003e syscall=263 success=no exit=-2 a0=ffffff9c a1=557162396590 a2=0 a3=0 items=1 ppid=144571 pid=145400 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=79 comm="rm" exe="/usr/bin/rm" key="file_modification"
2name: crowdsecurity/auditd-logs
3description: "Parse auditd logs"
4filter: "evt.Parsed.program == 'auditd'"1
5onsuccess: next_stage2
6pattern_syntax:3
7  FLOAT: '[0-9\.]+'
8
9nodes:4
10  #SYSCALL 59 on x86_64 -> execve
11  - filter: ParseKV(evt.Parsed.message, evt.Unmarshaled, "auditd") == nil # == nil is required because ParseKV does not return a value
12    nodes:
13      - grok:5
14          pattern: '%{WORD:msg_type}\(%{FLOAT:timestamp}:%{INT:event_inc_id}\):'
15          expression: evt.Unmarshaled.auditd.msg
16        nodes:4
17          - filter: evt.Unmarshaled.auditd.type == "SYSCALL" and evt.Unmarshaled.auditd.arch == "c000003e" and evt.Unmarshaled.auditd.syscall == "59"
18            statics:6
19              - meta: log_type
20                value: execve
21              #let's hydrate with ppid process if we can :)
22              - target: evt.Meta.parent_progname
23                expression: GetFromStash("auditd_pid_progname", evt.Unmarshaled.auditd.ppid)
24            #let's capture process name if we can4
25            stash:
26              - name: auditd_pid_progname
27                key: evt.Unmarshaled.auditd.pid
28                value: evt.Unmarshaled.auditd.exe
29                ttl: 1m
30                size: 100
31          - filter: evt.Unmarshaled.auditd.type == "ANOM_ABEND"
32            statics:6
33              - meta: log_type
34                value: anom_abend
35        statics:4
36          - target: evt.StrTime
37            expression: evt.Parsed.timestamp
38          - meta: ppid
39            expression: evt.Unmarshaled.auditd.ppid
40          - meta: exe