Elastic
Start free trial Contact Sales
Loading

Auditd Manager Integration

<div class="condensed-table">
| | |
| --- | --- |
| Version | 1.18.2 (View all) |
| Compatible Kibana version(s) | 8.16.0 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |
| Level of support
What’s this? | Elastic |

</div>
The Auditd Manager Integration receives audit events from the Linux Audit Framework that is a part of the Linux kernel.

This integration is available only for Linux.

The Auditd Manager is one of the integrations that can power the Session View utility for the Elastic Security Platform. This feature provides a visual representation of session and process execution data, organized according to the Linux process model to help you investigate process, user, and service activity on your Linux infrastructure.

There are two ways to enable session data capture for the Session View feature:

  1. Navigate to the Auditd Manager integration configuration in Kibana.
  2. Locate the "Session data" toggle switch.
  3. Turn the switch on to enable session data capture.
  1. Navigate to the Auditd Manager integration configuration in Kibana.
  2. Add the add_session_metadata processor configuration under the Processors section of Advanced options.
- add_session_metadata:
   backend: "auto"
  1. Add these rules to the Audit Rules section of the configuration:
-a always,exit -F arch=b64 -S execve,execveat -k exec
-a always,exit -F arch=b64 -S exit_group
-a always,exit -F arch=b64 -S setsid

Changes are applied automatically, and you do not have to restart the service.

  • Using the toggle switch (Method 1) automatically applies these configurations, making it the simpler option for most users.
  • When enabling session data capture, be aware that it will collect extended process data, which may have privacy and storage implications.
  • You can disable session data capture at any time by turning off the toggle switch or removing the manual configurations.
  • If you switch between methods or disable the feature, ensure that any conflicting configurations are removed to avoid unexpected behaviour.

This integration establishes a subscription to the kernel to receive the events as they occur.

The Linux Audit Framework can send multiple messages for a single auditable event. For example, a rename syscall causes the kernel to send eight separate messages. Each message describes a different aspect of the activity that is occurring (the syscall itself, file paths, current working directory, process title). This integration will combine all of the data from each of the messages into a single event.

Messages for one event can be interleaved with messages from another event. This module will buffer the messages in order to combine related messages into a single event even if they arrive interleaved or out of order.

When running this integration, you might find that other monitoring tools interfere with it.

For example, you might encounter errors if another process, such as auditd, is registered to receive data from the Linux Audit Framework. You can use these commands to see if the auditd service is running and stop it:

  • See if auditd is running:

    service auditd status

  • Stop the auditd service:

    service auditd stop

  • Disable auditd from starting on boot:

    `chkconfig auditd off`

  • Stop journald from listening to audit messages (to save CPU usage and disk space):

    systemctl mask systemd-journald-audit.socket

The audit rules are where you configure the activities that are audited. These rules are configured as either syscalls or files that should be monitored. For example you can track all connect syscalls or file system writes to /etc/passwd.

Auditing a large number of syscalls can place a heavy load on the system so consider carefully the rules you define and try to apply filters in the rules themselves to be as selective as possible.

The kernel evaluates the rules in the order in which they were defined so place the most active rules first in order to speed up evaluation.

You can assign keys to each rule for better identification of the rule that triggered an event and easier filtering later in Elasticsearch.

Defining any audit rules in the config causes elastic-agent to purge all existing audit rules prior to adding the rules specified in the config. Therefore it is unnecessary and unsupported to include a -D (delete all) rule.

Examples:

## If you are on a 64 bit platform, everything should be running
## in 64 bit mode. This rule will detect any use of the 32 bit syscalls
## because this might be a sign of someone exploiting a hole in the 32
## bit API.
-a always,exit -F arch=b32 -S all -F key=32bit-abi

## Executions.
-a always,exit -F arch=b64 -S execve,execveat -k exec

## External access (warning: these can be expensive to audit).
-a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access

## Unauthorized access attempts.
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access

# Things that affect identity.
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity

# Unauthorized access attempts to files (unsuccessful).
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access
**Example**

An example event for auditd looks as following:

{
    "@timestamp": "2022-05-12T13:10:13.230Z",
    "agent": {
        "ephemeral_id": "cfe4170e-f9b4-435f-b19c-a0e75b573b3a",
        "id": "753ce520-4f32-45b1-9212-c4dcc9d575a1",
        "name": "custom-agent",
        "type": "auditbeat",
        "version": "8.2.0"
    },
    "auditd": {
        "data": {
            "a0": "a",
            "a1": "c00024e8c0",
            "a2": "38",
            "a3": "0",
            "arch": "x86_64",
            "audit_pid": "22501",
            "auid": "unset",
            "exit": "56",
            "old": "0",
            "op": "set",
            "result": "success",
            "ses": "unset",
            "socket": {
                "family": "netlink",
                "saddr": "100000000000000000000000"
            },
            "syscall": "sendto",
            "tty": "(none)"
        },
        "message_type": "config_change",
        "messages": [
            "type=CONFIG_CHANGE msg=audit(1652361013.230:94471): op=set audit_pid=22501 old=0 auid=4294967295 ses=4294967295 res=1",
            "type=SYSCALL msg=audit(1652361013.230:94471): arch=c000003e syscall=44 success=yes exit=56 a0=a a1=c00024e8c0 a2=38 a3=0 items=0 ppid=9509 pid=22501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"auditbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat\" key=(null)",
            "type=SOCKADDR msg=audit(1652361013.230:94471): saddr=100000000000000000000000",
            "type=PROCTITLE msg=audit(1652361013.230:94471): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D6239613238612F696E7374616C6C2F6175646974626561742D382E322E302D6C696E75782D7838365F36342F617564697462656174002D63006175646974626561742E656C61737469632D6167656E742E796D6C"
        ],
        "result": "success",
        "summary": {
            "actor": {
                "primary": "unset",
                "secondary": "root"
            },
            "how": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat",
            "object": {
                "primary": "set",
                "type": "audit-config"
            }
        },
        "user": {
            "filesystem": {
                "group": {
                    "id": "0",
                    "name": "root"
                },
                "id": "0",
                "name": "root"
            },
            "saved": {
                "group": {
                    "id": "0",
                    "name": "root"
                },
                "id": "0",
                "name": "root"
            }
        }
    },
    "data_stream": {
        "dataset": "auditd_manager.auditd",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "753ce520-4f32-45b1-9212-c4dcc9d575a1",
        "snapshot": false,
        "version": "8.2.0"
    },
    "event": {
        "action": "changed-audit-configuration",
        "agent_id_status": "verified",
        "category": [
            "process",
            "configuration",
            "network"
        ],
        "dataset": "auditd_manager.auditd",
        "ingested": "2022-05-12T13:10:16Z",
        "kind": "event",
        "module": "auditd",
        "original": "type=CONFIG_CHANGE msg=audit(1652361013.230:94471): op=set audit_pid=22501 old=0 auid=4294967295 ses=4294967295 res=1\ntype=SYSCALL msg=audit(1652361013.230:94471): arch=c000003e syscall=44 success=yes exit=56 a0=a a1=c00024e8c0 a2=38 a3=0 items=0 ppid=9509 pid=22501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"auditbeat\" exe=\"/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat\" key=(null)\ntype=SOCKADDR msg=audit(1652361013.230:94471): saddr=100000000000000000000000\ntype=PROCTITLE msg=audit(1652361013.230:94471): proctitle=2F7573722F73686172652F656C61737469632D6167656E742F646174612F656C61737469632D6167656E742D6239613238612F696E7374616C6C2F6175646974626561742D382E322E302D6C696E75782D7838365F36342F617564697462656174002D63006175646974626561742E656C61737469632D6167656E742E796D6C",
        "outcome": "success",
        "sequence": 94471,
        "type": [
            "change",
            "connection",
            "info"
        ]
    },
    "host": {
        "name": "custom-agent"
    },
    "network": {
        "direction": "egress"
    },
    "process": {
        "executable": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat",
        "name": "auditbeat",
        "parent": {
            "pid": 9509
        },
        "pid": 22501,
        "title": "/usr/share/elastic-agent/data/elastic-agent-b9a28a/install/auditbeat-8.2.0-linux-x86_64/auditbeat -c auditbeat.elastic-agent.yml"
    },
    "service": {
        "type": "auditd"
    },
    "tags": [
        "preserve_original_event",
        "auditd_manager-auditd"
    ],
    "user": {
        "group": {
            "id": "0",
            "name": "root"
        },
        "id": "0",
        "name": "root"
    }
}
**Exported fields**
Field Description Type
@timestamp Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. date
auditd.data Auditd related data flattened
auditd.data.a0-N the arguments to a syscall keyword
auditd.data.acct a user’s account name keyword
auditd.data.acl access mode of resource assigned to vm keyword
auditd.data.action netfilter packet disposition keyword
auditd.data.added number of new files detected long
auditd.data.addr the remote address that the user is connecting from keyword
auditd.data.apparmor apparmor event information keyword
auditd.data.arch the elf architecture flags keyword
auditd.data.argc the number of arguments to an execve syscall long
auditd.data.audit_backlog_limit audit system’s backlog queue size keyword
auditd.data.audit_backlog_wait_time audit system’s backlog wait time keyword
auditd.data.audit_enabled audit systems’s enable/disable status keyword
auditd.data.audit_failure audit system’s failure mode keyword
auditd.data.audit_pid long
auditd.data.auid keyword
auditd.data.banners banners used on printed page keyword
auditd.data.bool name of SELinux boolean keyword
auditd.data.bus name of subsystem bus a vm resource belongs to keyword
auditd.data.cap_fe file assigned effective capability map keyword
auditd.data.cap_fi file inherited capability map keyword
auditd.data.cap_fp file permitted capability map keyword
auditd.data.cap_fver file system capabilities version number keyword
auditd.data.cap_pe process effective capability map keyword
auditd.data.cap_pi process inherited capability map keyword
auditd.data.cap_pp process permitted capability map keyword
auditd.data.capability posix capabilities keyword
auditd.data.cgroup path to cgroup in sysfs keyword
auditd.data.changed number of changed files long
auditd.data.cipher name of crypto cipher selected keyword
auditd.data.class resource class assigned to vm keyword
auditd.data.cmd command being executed keyword
auditd.data.code seccomp action code keyword
auditd.data.compat is_compat_task result keyword
auditd.data.daddr remote IP address ip
auditd.data.data TTY text keyword
auditd.data.default_context default MAC context keyword
auditd.data.device device name keyword
auditd.data.dir directory name keyword
auditd.data.direction direction of crypto operation keyword
auditd.data.dmac remote MAC address keyword
auditd.data.dport remote port number long
auditd.data.enforcing new MAC enforcement status keyword
auditd.data.entries number of entries in the netfilter table long
auditd.data.exit syscall exit code keyword
auditd.data.fam socket address family keyword
auditd.data.family netfilter protocol keyword
auditd.data.fd file descriptor number keyword
auditd.data.fe file assigned effective capability map keyword
auditd.data.feature kernel feature being changed keyword
auditd.data.fi file assigned inherited capability map keyword
auditd.data.file file name keyword
auditd.data.flags mmap syscall flags keyword
auditd.data.format audit log’s format keyword
auditd.data.fp crypto key finger print keyword
auditd.data.frootid keyword
auditd.data.fver file system capabilities version number keyword
auditd.data.grantors pam modules approving the action keyword
auditd.data.grp group name keyword
auditd.data.hook netfilter hook that packet came from keyword
auditd.data.hostname the hostname that the user is connecting from keyword
auditd.data.icmp_type type of icmp message keyword
auditd.data.id during account changes keyword
auditd.data.igid ipc object’s group ID keyword
auditd.data.img_ctx the vm’s disk image context string keyword
auditd.data.inif in interface number keyword
auditd.data.ino inode number keyword
auditd.data.inode_gid group ID of the inode’s owner keyword
auditd.data.inode_uid user ID of the inode’s owner keyword
auditd.data.invalid_context SELinux context keyword
auditd.data.ioctlcmd The request argument to the ioctl syscall keyword
auditd.data.ip network address of a printer ip
auditd.data.ipid IP datagram fragment identifier keyword
auditd.data.ipx_net IPX network number keyword
auditd.data.items the number of path records in the event long
auditd.data.iuid ipc object’s user ID keyword
auditd.data.kernel kernel’s version number keyword
auditd.data.kind server or client in crypto operation keyword
auditd.data.ksize key size for crypto operation keyword
auditd.data.laddr local network address keyword
auditd.data.len length keyword
auditd.data.list the audit system’s filter list number keyword
auditd.data.lport local network port long
auditd.data.mac crypto MAC algorithm selected keyword
auditd.data.macproto ethernet packet type ID field keyword
auditd.data.maj device major number keyword
auditd.data.major device major number keyword
auditd.data.minor device minor number keyword
auditd.data.model security model being used for virt keyword
auditd.data.msg the payload of the audit record keyword
auditd.data.nargs the number of arguments to a socket call long
auditd.data.net network MAC address keyword
auditd.data.new value being set in feature keyword
auditd.data.new_chardev new character device being assigned to vm keyword
auditd.data.new_disk disk being added to vm keyword
auditd.data.new_enabled new TTY audit enabled setting keyword
auditd.data.new_fs file system being added to vm keyword
auditd.data.new_gid new group ID being assigned keyword
auditd.data.new_level new run level keyword
auditd.data.new_lock new value of feature lock keyword
auditd.data.new_log_passwd new value for TTY password logging keyword
auditd.data.new_mem new amount of memory in KB keyword
auditd.data.new_net MAC address being assigned to vm keyword
auditd.data.new_pe new process effective capability map keyword
auditd.data.new_pi new process inherited capability map keyword
auditd.data.new_pp new process permitted capability map keyword
auditd.data.new_range new SELinux range keyword
auditd.data.new_rng device name of rng being added from a vm keyword
auditd.data.new_role new SELinux role keyword
auditd.data.new_ses ses value keyword
auditd.data.new_seuser new SELinux user keyword
auditd.data.new_vcpu new number of CPU cores long
auditd.data.nlnk_fam netlink protocol number keyword
auditd.data.nlnk_grp netlink group number keyword
auditd.data.nlnk_pid pid of netlink packet sender long
auditd.data.oauid object’s login user ID keyword
auditd.data.obj lspp object context string keyword
auditd.data.obj_gid group ID of object keyword
auditd.data.obj_uid user ID of object keyword
auditd.data.ocomm object’s command line name keyword
auditd.data.oflag open syscall flags keyword
auditd.data.old old value keyword
auditd.data.old_auid previous auid value keyword
auditd.data.old_chardev present character device assigned to vm keyword
auditd.data.old_disk disk being removed from vm keyword
auditd.data.old_enabled present TTY audit enabled setting keyword
auditd.data.old_enforcing old MAC enforcement status keyword
auditd.data.old_fs file system being removed from vm keyword
auditd.data.old_level old run level keyword
auditd.data.old_lock present value of feature lock keyword
auditd.data.old_log_passwd present value for TTY password logging keyword
auditd.data.old_mem present amount of memory in KB keyword
auditd.data.old_net present MAC address assigned to vm keyword
auditd.data.old_pa keyword
auditd.data.old_pe old process effective capability map keyword
auditd.data.old_pi old process inherited capability map keyword
auditd.data.old_pp old process permitted capability map keyword
auditd.data.old_prom network promiscuity flag keyword
auditd.data.old_range present SELinux range keyword
auditd.data.old_rng device name of rng being removed from a vm keyword
auditd.data.old_role present SELinux role keyword
auditd.data.old_ses previous ses value keyword
auditd.data.old_seuser present SELinux user keyword
auditd.data.old_val current value of SELinux boolean keyword
auditd.data.old_vcpu present number of CPU cores long
auditd.data.op the operation being performed that is audited keyword
auditd.data.opid object’s process ID long
auditd.data.oses object’s session ID keyword
auditd.data.outif out interface number keyword
auditd.data.pa keyword
auditd.data.parent the inode number of the parent file keyword
auditd.data.pe keyword
auditd.data.per linux personality keyword
auditd.data.perm the file permission being used keyword
auditd.data.perm_mask file permission mask that triggered a watch event keyword
auditd.data.permissive SELinux is in permissive mode keyword
auditd.data.pfs perfect forward secrecy method keyword
auditd.data.pi keyword
auditd.data.pp keyword
auditd.data.printer printer name keyword
auditd.data.prom network promiscuity flag keyword
auditd.data.proto network protocol keyword
auditd.data.qbytes ipc objects quantity of bytes keyword
auditd.data.range user’s SE Linux range keyword
auditd.data.reason text string denoting a reason for the action keyword
auditd.data.removed number of deleted files long
auditd.data.res result of the audited operation(success/fail) keyword
auditd.data.reset keyword
auditd.data.resrc resource being assigned keyword
auditd.data.result keyword
auditd.data.rport remote port number long
auditd.data.sauid sent login user ID keyword
auditd.data.scontext the subject’s context string keyword
auditd.data.selected_context new MAC context assigned to session keyword
auditd.data.seperm SELinux permission being decided on keyword
auditd.data.seperms SELinux permissions being used keyword
auditd.data.seqno sequence number long
auditd.data.seresult SELinux AVC decision granted/denied keyword
auditd.data.ses login session ID keyword
auditd.data.seuser user’s SE Linux user acct keyword
auditd.data.sig signal number keyword
auditd.data.sigev_signo signal number keyword
auditd.data.smac local MAC address keyword
auditd.data.socket.addr The remote address. keyword
auditd.data.socket.family The socket family (unix, ipv4, ipv6, netlink). keyword
auditd.data.socket.path This is the path associated with a unix socket. keyword
auditd.data.socket.port The port number. long
auditd.data.socket.saddr The raw socket address structure. keyword
auditd.data.spid sent process ID long
auditd.data.sport local port number long
auditd.data.state audit daemon configuration resulting state keyword
auditd.data.subj lspp subject’s context string keyword
auditd.data.success whether the syscall was successful or not keyword
auditd.data.syscall syscall number in effect when the event occurred keyword
auditd.data.table netfilter table name keyword
auditd.data.tclass target’s object classification keyword
auditd.data.tcontext the target’s or object’s context string keyword
auditd.data.terminal terminal name the user is running programs on keyword
auditd.data.tty tty udevice the user is running programs on keyword
auditd.data.unit systemd unit keyword
auditd.data.uri URI pointing to a printer keyword
auditd.data.uuid a UUID keyword
auditd.data.val generic value associated with the operation keyword
auditd.data.ver audit daemon’s version number keyword
auditd.data.virt kind of virtualization being referenced keyword
auditd.data.vm virtual machine name keyword
auditd.data.vm_ctx the vm’s context string keyword
auditd.data.vm_pid vm’s process ID long
auditd.data.watch file name in a watch record keyword
auditd.file.selinux.domain The actor’s SELinux domain or type. keyword
auditd.file.selinux.level The actor’s SELinux level. keyword
auditd.file.selinux.role User’s SELinux role keyword
auditd.file.selinux.user Account submitted for authentication keyword
auditd.message_type The audit message type (e.g. syscall or apparmor_denied). keyword
auditd.messages An ordered list of the raw messages received from the kernel that were used to construct this document. This field is present if an error occurred processing the data or if include_raw_message is set in the config. keyword
auditd.paths flattened
auditd.paths.dev Device name as found in /dev keyword
auditd.paths.inode inode number keyword
auditd.paths.item Which item is being recorded keyword
auditd.paths.mode Mode flags on a file keyword
auditd.paths.name File name in avcs keyword
auditd.paths.nametype Kind of file operation being referenced keyword
auditd.paths.obj_domain keyword
auditd.paths.obj_level keyword
auditd.paths.obj_role keyword
auditd.paths.obj_type keyword
auditd.paths.obj_user keyword
auditd.paths.ogid File owner group ID keyword
auditd.paths.ouid File owner user ID keyword
auditd.paths.rdev The device identifier (special files only) keyword
auditd.result The result of the audited operation (success/fail). keyword
auditd.session The session ID assigned to a login. All events related to a login session will have the same value. keyword
auditd.summary.actor.primary The primary identity of the actor. This is the actor’s original login ID. It will not change even if the user changes to another account. keyword
auditd.summary.actor.secondary The secondary identity of the actor. This is typically the same as the primary, except for when the user has used su. keyword
auditd.summary.how This describes how the action was performed. Usually this is the exe or command that was being executed that triggered the event. keyword
auditd.summary.object.primary keyword
auditd.summary.object.secondary keyword
auditd.summary.object.type A description of the what the "thing" is (e.g. file, socket, user-session). keyword
auditd.user.audit.id keyword
auditd.user.audit.name keyword
auditd.user.filesystem.group.id keyword
auditd.user.filesystem.group.name keyword
auditd.user.filesystem.id keyword
auditd.user.filesystem.name keyword
auditd.user.new_auid.id keyword
auditd.user.new_auid.name keyword
auditd.user.old_auid.id keyword
auditd.user.old_auid.name keyword
auditd.user.saved.group.id keyword
auditd.user.saved.group.name keyword
auditd.user.saved.id keyword
auditd.user.saved.name keyword
auditd.user.selinux.category The actor’s SELinux category or compartments. keyword
auditd.user.selinux.domain The actor’s SELinux domain or type. keyword
auditd.user.selinux.level The actor’s SELinux level. keyword
auditd.user.selinux.role User’s SELinux role keyword
auditd.user.selinux.user Account submitted for authentication keyword
auditd.warnings The warnings generated by the Beat during the construction of the event. These are disabled by default and are used for development and debug purposes only. keyword
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
destination.address Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain, depending on which one it is. keyword
destination.ip IP address of the destination (IPv4 or IPv6). ip
destination.port Port of the destination. long
ecs.version ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices — which may conform to slightly different ECS versions — this field lets integrations adjust to the schema version of the events. keyword
event.dataset Event dataset constant_keyword
event.id Unique ID to describe the event. keyword
event.module Event module constant_keyword
event.outcome This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. event.outcome simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of event.outcome, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with event.type:info, or any events for which an outcome does not make logical sense. keyword
file.device Device that is the source of the file. keyword
file.gid Primary group ID (GID) of the file. keyword
file.group Primary group name of the file. keyword
file.inode Inode representing the file in the filesystem. keyword
file.mode Mode of the file in octal representation. keyword
file.owner File owner’s username. keyword
file.path Full path to the file, including the file name. It should include the drive letter, when appropriate. keyword
file.path.text Multi-field of file.path. match_only_text
file.uid The user ID (UID) or security identifier (SID) of the file owner. keyword
group.id Unique identifier for the group on the system/platform. keyword
group.name Name of the group. keyword
network.direction Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host’s point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. keyword
process.args Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. keyword
process.executable Absolute path to the process executable. keyword
process.executable.text Multi-field of process.executable. match_only_text
process.exit_code The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). long
process.name Process name. Sometimes called program name or similar. keyword
process.name.text Multi-field of process.name. match_only_text
process.parent.pid Process id. long
process.pid Process id. long
process.title Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. keyword
process.title.text Multi-field of process.title. match_only_text
process.working_directory The working directory of the process. keyword
process.working_directory.text Multi-field of process.working_directory. match_only_text
related.user All the user names or other user identifiers seen on the event. keyword
service.type The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, service.type would be elasticsearch. keyword
source.address Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain, depending on which one it is. keyword
source.ip IP address of the source (IPv4 or IPv6). ip
source.port Port of the source. long
tags List of keywords used to tag each event. keyword
user.effective.group.id Unique identifier for the group on the system/platform. keyword
user.effective.group.name Name of the group. keyword
user.effective.id Unique identifier of the user. keyword
user.effective.name Short name or login of the user. keyword
user.effective.name.text Multi-field of user.effective.name. match_only_text
user.group.id Unique identifier for the group on the system/platform. keyword
user.group.name Name of the group. keyword
user.id Unique identifier of the user. keyword
user.name Short name or login of the user. keyword
user.name.text Multi-field of user.name. match_only_text
user.target.group.id Unique identifier for the group on the system/platform. keyword
user.target.group.name Name of the group. keyword
user.target.id Unique identifier of the user. keyword
user.target.name Short name or login of the user. keyword
user.target.name.text Multi-field of user.target.name. match_only_text
**Changelog**
Version Details Kibana version(s)
1.18.2 pass:[] Enhancement (View pull request)
Added Session data option
 8.16.0 or higher
1.18.1 pass:[] Bug fix (View pull request)
Reverting Session data option
 8.16.0 or higher
1.18.0 pass:[] Enhancement (View pull request)
Added Session data option
 8.16.0 or higher
9.0.0 or higher
1.17.1 pass:[] Enhancement (View pull request)
Doc: Add doc for configuring Auditd Manager for Session View
 8.12.0 or higher
1.17.0 pass:[] Enhancement (View pull request)
Allow @custom pipeline access to event.original without setting preserve_original_event.
 8.12.0 or higher
1.16.4 pass:[] Bug fix (View pull request)
Fix audit_rule_files
 8.7.1 or higher
1.16.3 pass:[] Enhancement (View pull request)
capture root requirement
 8.7.1 or higher
1.16.2 pass:[] Enhancement (View pull request)
Changed owners
 8.7.1 or higher
1.16.1 pass:[] Bug fix (View pull request)
Fix socket type selection and documentation.
 8.7.1 or higher
1.16.0 pass:[] Enhancement (View pull request)
ECS version updated to 8.11.0.
 8.7.1 or higher
1.15.0 pass:[] Enhancement (View pull request)
ECS version updated to 8.10.0.
 8.7.1 or higher
1.14.0 pass:[] Enhancement (View pull request)
The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added owner.type: elastic to package manifest.
 8.7.1 or higher
1.13.0 pass:[] Enhancement (View pull request)
Add tags.yml file so that integration’s dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.
 8.7.1 or higher
1.12.0 pass:[] Enhancement (View pull request)
Update package to ECS 8.9.0.
 8.7.1 or higher
1.11.0 pass:[] Enhancement (View pull request)
Convert visualizations to lens.
 8.7.1 or higher
1.10.0 pass:[] Enhancement (View pull request)
Ensure event.kind is correctly set for pipeline errors.
 8.4.0 or higher
1.9.0 pass:[] Enhancement (View pull request)
Update package to ECS 8.8.0.
 8.4.0 or higher
1.8.0 pass:[] Enhancement (View pull request)
Update package-spec version to 2.7.0.
 8.4.0 or higher
1.7.1 pass:[] Bug fix (View pull request)
Fix wrong field type for auditd.data.exit
 8.4.0 or higher
1.7.0 pass:[] Enhancement (View pull request)
Update package to ECS 8.7.0.
 8.4.0 or higher
1.6.1 pass:[] Enhancement (View pull request)
Added categories and/or subcategories.
 8.4.0 or higher
1.6.0 pass:[] Enhancement (View pull request)
Update package to ECS 8.6.0.
 8.4.0 or higher
1.5.0 pass:[] Enhancement (View pull request)
Add audit rule files option.
 8.4.0 or higher
1.4.0 pass:[] Enhancement (View pull request)
Update package to ECS 8.5.0.
 8.4.0 or higher
1.3.0 pass:[] Enhancement (View pull request)
Update package to ECS 8.4.0
 8.4.0 or higher
1.2.0 pass:[] Enhancement (View pull request)
Expose immutable option.

pass:[] Enhancement (View pull request)
Change audit rules to be a textarea instead of a list.
 8.4.0 or higher
1.1.0 pass:[] Enhancement (View pull request)
Update package to ECS 8.3.0.
 8.2.0 or higher
1.0.0 pass:[] Enhancement (View pull request)
Initial release
 8.2.0 or higher