Skip to content

Commit 63fc042

Browse files
mergify[bot]mmat11pkoutsovasilis
authored
[8.13](backport #38199) [Auditbeat] fim(ebpf): enrich file events with process data (#38742)
* [Auditbeat] fim(ebpf): enrich file events with process data (#38199) * fim(ebpf): enrich file events with process data * apply review suggestions * apply review suggestions * fix(fim/ebpf): move process fields to event root and insert them so keys do not contain dots * fix(fim/ebpf): refactor HostID to utilise sync.OnceValue and expose boot time * fix(fim/ebpf): refactor TicksPerSecond to utilise sync.OnceValue * fix(fim/ebpf): remove empty slice allocation * chore: go mod tidy * fix: explicitly set go 1.21.8 in go.mod * fix(fim/ebpf): nil slice of errors in TestNewEventFromEbpfEvent * fix(fim/ebpf): remove re-declaration of already ecs included fields * fix(fim/ebpf): utilise OnceValues to declutter the code * fix(fim/ebpf): remove x-pack import from OSS package * fix(fim/ebpf): propagate process fields changes to integration tests * chore: go mod tidy * ci: temporary solution to outdated docker compose python library * ci: transition to a fixed tag for docker image instead of a rolling one --------- Co-authored-by: Panos Koutsovasilis <[email protected]> Co-authored-by: Pierre HILBERT <[email protected]> (cherry picked from commit dbdaac3) # Conflicts: # go.mod # go.sum * fix: resolve conflicts --------- Co-authored-by: Mattia Meleleo <[email protected]> Co-authored-by: Panos Koutsovasilis <[email protected]>
1 parent 938e13c commit 63fc042

File tree

11 files changed

+419
-97
lines changed

11 files changed

+419
-97
lines changed

‎CHANGELOG.next.asciidoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,9 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
109109

110110
*Auditbeat*
111111

112+
- Add linux capabilities to processes in the system/process. {pull}37453[37453]
113+
- Add opt-in eBPF backend for file_integrity module. {pull}37223[37223]
114+
- Add process data to file events (Linux only, eBPF backend). {pull}38199[38199]
112115

113116
*Filebeat*
114117

‎NOTICE.txt

Lines changed: 78 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -12257,11 +12257,11 @@ SOFTWARE.
1225712257

1225812258
--------------------------------------------------------------------------------
1225912259
Dependency : github.com/elastic/ebpfevents
12260-
Version: v0.4.0
12260+
Version: v0.5.0
1226112261
Licence type (autodetected): Apache-2.0
1226212262
--------------------------------------------------------------------------------
1226312263

12264-
Contents of probable licence file $GOMODCACHE/github.com/elastic/ebpfevents@v0.4.0/LICENSE.txt:
12264+
Contents of probable licence file $GOMODCACHE/github.com/elastic/ebpfevents@v0.5.0/LICENSE.txt:
1226512265

1226612266
The https://github.com/elastic/ebpfevents repository contains source code under
1226712267
various licenses:
@@ -22891,6 +22891,45 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
2289122891
SOFTWARE.
2289222892

2289322893

22894+
--------------------------------------------------------------------------------
22895+
Dependency : github.com/tklauser/go-sysconf
22896+
Version: v0.3.10
22897+
Licence type (autodetected): BSD-3-Clause
22898+
--------------------------------------------------------------------------------
22899+
22900+
Contents of probable licence file $GOMODCACHE/github.com/tklauser/[email protected]/LICENSE:
22901+
22902+
BSD 3-Clause License
22903+
22904+
Copyright (c) 2018-2021, Tobias Klauser
22905+
All rights reserved.
22906+
22907+
Redistribution and use in source and binary forms, with or without
22908+
modification, are permitted provided that the following conditions are met:
22909+
22910+
* Redistributions of source code must retain the above copyright notice, this
22911+
list of conditions and the following disclaimer.
22912+
22913+
* Redistributions in binary form must reproduce the above copyright notice,
22914+
this list of conditions and the following disclaimer in the documentation
22915+
and/or other materials provided with the distribution.
22916+
22917+
* Neither the name of the copyright holder nor the names of its
22918+
contributors may be used to endorse or promote products derived from
22919+
this software without specific prior written permission.
22920+
22921+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
22922+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22923+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
22924+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
22925+
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22926+
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22927+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
22928+
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
22929+
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
22930+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
22931+
22932+
2289422933
--------------------------------------------------------------------------------
2289522934
Dependency : github.com/tsg/go-daemon
2289622935
Version: v0.0.0-20200207173439-e704b93fd89b
@@ -36539,11 +36578,11 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
3653936578

3654036579
--------------------------------------------------------------------------------
3654136580
Dependency : github.com/cilium/ebpf
36542-
Version: v0.12.3
36581+
Version: v0.13.2
3654336582
Licence type (autodetected): MIT
3654436583
--------------------------------------------------------------------------------
3654536584

36546-
Contents of probable licence file $GOMODCACHE/github.com/cilium/ebpf@v0.12.3/LICENSE:
36585+
Contents of probable licence file $GOMODCACHE/github.com/cilium/ebpf@v0.13.2/LICENSE:
3654736586

3654836587
MIT License
3654936588

@@ -38575,11 +38614,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3857538614

3857638615
--------------------------------------------------------------------------------
3857738616
Dependency : github.com/frankban/quicktest
38578-
Version: v1.14.5
38617+
Version: v1.14.3
3857938618
Licence type (autodetected): MIT
3858038619
--------------------------------------------------------------------------------
3858138620

38582-
Contents of probable licence file $GOMODCACHE/github.com/frankban/[email protected].5/LICENSE:
38621+
Contents of probable licence file $GOMODCACHE/github.com/frankban/[email protected].3/LICENSE:
3858338622

3858438623
MIT License
3858538624

@@ -39182,6 +39221,37 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
3918239221
SOFTWARE.
3918339222

3918439223

39224+
--------------------------------------------------------------------------------
39225+
Dependency : github.com/go-quicktest/qt
39226+
Version: v1.101.0
39227+
Licence type (autodetected): MIT
39228+
--------------------------------------------------------------------------------
39229+
39230+
Contents of probable licence file $GOMODCACHE/github.com/go-quicktest/[email protected]/LICENSE:
39231+
39232+
MIT License
39233+
39234+
Copyright (c) 2017 Canonical Ltd.
39235+
39236+
Permission is hereby granted, free of charge, to any person obtaining a copy
39237+
of this software and associated documentation files (the "Software"), to deal
39238+
in the Software without restriction, including without limitation the rights
39239+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
39240+
copies of the Software, and to permit persons to whom the Software is
39241+
furnished to do so, subject to the following conditions:
39242+
39243+
The above copyright notice and this permission notice shall be included in all
39244+
copies or substantial portions of the Software.
39245+
39246+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
39247+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
39248+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
39249+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
39250+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
39251+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
39252+
SOFTWARE.
39253+
39254+
3918539255
--------------------------------------------------------------------------------
3918639256
Dependency : github.com/go-sourcemap/sourcemap
3918739257
Version: v2.1.2+incompatible
@@ -49541,27 +49611,6 @@ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
4954149611
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
4954249612

4954349613

49544-
--------------------------------------------------------------------------------
49545-
Dependency : github.com/pkg/diff
49546-
Version: v0.0.0-20210226163009-20ebb0f2a09e
49547-
Licence type (autodetected): BSD-3-Clause
49548-
--------------------------------------------------------------------------------
49549-
49550-
Contents of probable licence file $GOMODCACHE/github.com/pkg/[email protected]/LICENSE:
49551-
49552-
Copyright 2018 Joshua Bleecher Snyder
49553-
49554-
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
49555-
49556-
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
49557-
49558-
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
49559-
49560-
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
49561-
49562-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
49563-
49564-
4956549614
--------------------------------------------------------------------------------
4956649615
Dependency : github.com/pmezard/go-difflib
4956749616
Version: v1.0.0
@@ -49845,11 +49894,11 @@ Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golan
4984549894

4984649895
--------------------------------------------------------------------------------
4984749896
Dependency : github.com/rogpeppe/go-internal
49848-
Version: v1.9.0
49897+
Version: v1.11.0
4984949898
Licence type (autodetected): BSD-3-Clause
4985049899
--------------------------------------------------------------------------------
4985149900

49852-
Contents of probable licence file $GOMODCACHE/github.com/rogpeppe/go-internal@v1.9.0/LICENSE:
49901+
Contents of probable licence file $GOMODCACHE/github.com/rogpeppe/go-internal@v1.11.0/LICENSE:
4985349902

4985449903
Copyright (c) 2018 The Go Authors. All rights reserved.
4985549904

@@ -50751,45 +50800,6 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
5075150800
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
5075250801

5075350802

50754-
--------------------------------------------------------------------------------
50755-
Dependency : github.com/tklauser/go-sysconf
50756-
Version: v0.3.10
50757-
Licence type (autodetected): BSD-3-Clause
50758-
--------------------------------------------------------------------------------
50759-
50760-
Contents of probable licence file $GOMODCACHE/github.com/tklauser/[email protected]/LICENSE:
50761-
50762-
BSD 3-Clause License
50763-
50764-
Copyright (c) 2018-2021, Tobias Klauser
50765-
All rights reserved.
50766-
50767-
Redistribution and use in source and binary forms, with or without
50768-
modification, are permitted provided that the following conditions are met:
50769-
50770-
* Redistributions of source code must retain the above copyright notice, this
50771-
list of conditions and the following disclaimer.
50772-
50773-
* Redistributions in binary form must reproduce the above copyright notice,
50774-
this list of conditions and the following disclaimer in the documentation
50775-
and/or other materials provided with the distribution.
50776-
50777-
* Neither the name of the copyright holder nor the names of its
50778-
contributors may be used to endorse or promote products derived from
50779-
this software without specific prior written permission.
50780-
50781-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
50782-
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50783-
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
50784-
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
50785-
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50786-
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
50787-
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
50788-
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
50789-
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
50790-
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
50791-
50792-
5079350803
--------------------------------------------------------------------------------
5079450804
Dependency : github.com/tklauser/numcpus
5079550805
Version: v0.4.0

‎auditbeat/module/file_integrity/event.go

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,13 +134,41 @@ type Event struct {
134134
Action Action `json:"action"` // Action (like created, updated).
135135
Hashes map[HashType]Digest `json:"hash,omitempty"` // File hashes.
136136
ParserResults mapstr.M `json:"file,omitempty"` // Results from running file parsers.
137+
Process *Process `json:"process,omitempty"` // Process data. Available only on Linux when using the eBPF backend.
137138

138139
// Metadata
139140
rtt time.Duration // Time taken to collect the info.
140141
errors []error // Errors that occurred while collecting the info.
141142
hashFailed bool // Set when hashing the file failed.
142143
}
143144

145+
// Process contain information about a process.
146+
// These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
147+
type Process struct {
148+
// Unique identifier for the process.
149+
// The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
150+
// Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
151+
EntityID string `json:"entity_id,omitempty"`
152+
// Process name. Sometimes called program name or similar.
153+
Name string `json:"name,omitempty"`
154+
// The effective user (euid).
155+
User struct {
156+
// Unique identifier of the user.
157+
ID string `json:"id,omitempty"`
158+
// Short name or login of the user.
159+
Name string `json:"name,omitempty"`
160+
} `json:"user,omitempty"`
161+
// The effective group (egid).
162+
Group struct {
163+
// Unique identifier for the group on the system/platform.
164+
ID string `json:"id,omitempty"`
165+
// Name of the group.
166+
Name string `json:"name,omitempty"`
167+
} `json:"group,omitempty"`
168+
// Process id.
169+
PID uint32 `json:"pid,omitempty"`
170+
}
171+
144172
// Metadata contains file metadata.
145173
type Metadata struct {
146174
Inode uint64 `json:"inode"`
@@ -354,6 +382,24 @@ func buildMetricbeatEvent(e *Event, existedBefore bool) mb.Event {
354382
}
355383
}
356384

385+
if e.Process != nil {
386+
process := mapstr.M{
387+
"pid": e.Process.PID,
388+
"name": e.Process.Name,
389+
"entity_id": e.Process.EntityID,
390+
"user": mapstr.M{
391+
"id": e.Process.User.ID,
392+
"name": e.Process.User.Name,
393+
},
394+
"group": mapstr.M{
395+
"id": e.Process.Group.ID,
396+
"name": e.Process.Group.Name,
397+
},
398+
}
399+
400+
out.MetricSetFields.Put("process", process)
401+
}
402+
357403
if len(e.Hashes) > 0 {
358404
hashes := make(mapstr.M, len(e.Hashes))
359405
for hashType, digest := range e.Hashes {

0 commit comments

Comments
 (0)