Scale Your Auditing Events
A presentation at Pass the Salt in in Lille, France by Philipp Krenn
Scale Your Auditing Events Philipp Krenn @xeraa
No silver bullet
uditd https://github.com/linux-audit
“auditd is the userspace component to the Linux Auditing System. It’s responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities.”
Monitor File and network access System calls Commands run by a user Security events
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
Demo
Understanding Logs https://access.redhat.com/documentation/en-us/ red_hat_enterprise_linux/7/html/security_guide/secunderstanding_audit_log_files
More Rules https://github.com/linux-audit/audit-userspace/tree/master/rules
Namespaces WIP https://github.com/linux-audit/audit-kernel/issues/ 32#issuecomment-395052938
Problem How to centralize?
Developer
Disclaimer I build highly monitored Hello World apps
Filebeat Module: Auditd
Demo
!
!”
https://cloud.elastic.co
Auditbeat
Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration
Auditd Module eBPF powers on older kernels Easier configuration Written in Golang
go-libaudit https://github.com/elastic/go-libaudit go-libaudit is a library for communicating with the Linux Audit Framework
Demo
System Module Easier configuration for host, process, socket, user Added in 6.6 — not based on Auditd
Demo
File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
hash_types blake2b_256, blake2b_384, blake2b_512, md5, sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512, xxh64
Demo
Elastic SIEM
https://github.com/elastic/ecs
Demo
Conclusion
Auditd Auditbeat Logs, Dashboards, SIEM
Code https://github.com/xeraa/ auditbeat-in-action
Similar Solutions https://github.com/slackhq/go-audit https://github.com/Scribery/aushape
Questions? Philipp Krenn PS: Sticker @xeraa
The Linux Audit daemon is responsible for writing audit records to the disk, which you can then access with ausearch and aureport. However, it turned out that parsing and centralizing these records is not as easy as you would hope. Elastic’s new Auditbeat fixes this by keeping the original configuration, but ships them to a centralized location where you can easily visualize all events. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. This talk shows you what can you do to discover changes, events, and potential security breaches as soon as possible on interactive dashboards. Additionally, we are combining Auditd events with logs, which are security relevant.
Video
Resources
The following resources were mentioned during the presentation or are useful additional information.
-
GitHub Demo Code
Demo for Elastic’s Auditbeat and SIEM.
Buzz and feedback
Here’s what was said about this presentation on social media.
