[Auditd Manager] Add Session Data option#11500
Conversation
|
Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform) |
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
|
|
| {{#if session_data}} | ||
| audit_rules: "{{escape_multiline_string "# Session data audit rules | ||
| -a always,exit -F arch=b64 -S execve,execveat -k exec | ||
| -a always,exit -F arch=b64 -S exit_group | ||
| -a always,exit -F arch=b64 -S setsid | ||
| "}}{{escape_multiline_string audit_rules}}" |
There was a problem hiding this comment.
@andrewkroh Unfortunately I couldn't manage to update the to_json method before the 8.16 Feature Freeze, so I kept the escape_multiline_string method for this version.
The Policy tests under the data_stream/auditd/_dev/test/policy folder use Kibana and Fleet to generate the Agent Policy output based on the policy variables, those tests also check if the Handlebars methods used in the auditd.yml.hbs file are available in kibana, such as the escape_multiline_string method and that they are generating the desired output in the agent policy.
|
I've used this integration version to install the auditd_manager, and enabled session view with the toggle, and everything's working. Session data was collected and sessions were shown in Kibana with it. |
|
Package auditd_manager - 1.18.2 containing this change is available at https://epr.elastic.co/search?package=auditd_manager |
* Add Session Data Option to manifest * Updating docs * Adding integration policy tests * updating changelog PR number
* Add Session Data Option to manifest * Updating docs * Adding integration policy tests * updating changelog PR number
Proposed commit message
hbsfile to append Session Data Audit Rules and Session Data Processors when Session Data is selected.Checklist
changelog.ymlfile.How to test this PR locally
To test these changes, go to Kibana -> Integrations -> Create new integration -> upload it as a .zip; and upload the following package:
auditd_manager-1.18.2.zip
Related issues
Screenshots
Session Data Switcher
Docs
Policy Tests Included