| Both sides previous revision Previous revision Next revision | Previous revision |
| summerofcode2016:nonbsmtobsmconversiontools:linuxaudittobsm [2016/07/05 14:13] – Rearrange the links. MateuszPiotrowski | summerofcode2016:nonbsmtobsmconversiontools:linuxaudittobsm [2016/08/08 09:06] (current) – typo MateuszPiotrowski |
|---|
| ====== Linux Audit to BSM conversion ====== | ====== Linux Audit to BSM conversion ====== |
| | |
| | ===== audit-userspace ===== |
| | |
| | [[https://github.com/linux-audit/audit-userspace|audit-userspace on GitHub]] |
| | |
| | ==== Hints ==== |
| | * Some fields have their //type// defined in ''%%auparse/typetab.h%%''. |
| | |
| | ==== Understanding a field step by step ==== |
| | |
| | - Choose your field. |
| | - Find it in the [[https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv|field dictionary]] to get any idea what it is. |
| | - Find out if it is listed in ''%%auparse/typetab.h%%'' to learn its type. |
| | |
| | You can also run ''%%grep -RI -C 2 *tab.h%%'' in ''%%auparse%%''; your field might be listed in one of those files. |
| |
| ===== Structure ===== | ===== Structure ===== |
| ==== General ==== | ==== General ==== |
| * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html|Understanding Linux Audit log files with Red Hat.]] | * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html|Understanding Linux Audit log files with Red Hat.]] |
| | * [[https://www.digitalocean.com/community/tutorials/how-to-use-the-linux-auditing-system-on-centos-7|Digital Ocean tutorial.]] |
| * [[https://github.com/linux-audit/audit-documentation/wiki|The official Linux Audit documentation.]] | * [[https://github.com/linux-audit/audit-documentation/wiki|The official Linux Audit documentation.]] |
| * [[https://github.com/linux-audit/audit-documentation/wiki/SPEC-Writing-Good-Events#fields|Some more definitions and information about the Linux Audit standard.]] | * [[https://github.com/linux-audit/audit-documentation/wiki/SPEC-Writing-Good-Events#fields|Some more definitions and information about the Linux Audit standard.]] |
| * [[https://people.redhat.com/sgrubb/audit/audit-parse.txt|A file with Linux Audit event parsing library specifications.]] | * [[https://people.redhat.com/sgrubb/audit/audit-parse.txt|A file with Linux Audit event parsing library specifications.]] |
| | * [[http://people.redhat.com/sgrubb/audit/|The official (one of many?) website of Linux Audit.]] |
| | * [[https://people.redhat.com/sgrubb/audit/event-enrichment|The enriched format.]] |
| |
| ==== Log files ==== | ==== Log files ==== |
| * [[https://www.redhat.com/archives/linux-audit/2005-May/msg00151.html|Some ancient (2005) Linux Audit log examples.]] | * [[https://www.redhat.com/archives/linux-audit/2005-May/msg00151.html|Some ancient (2005) Linux Audit log examples.]] |
| | * [[https://groups.google.com/forum/#!topic/fluentd/yMooaGMbGj8|Some logs from 2014.]] |
| * [[http://linoxide.com/how-tos/auditd-tool-security-auditing/|An article about basic usage of Linux auditd with some example logs.]] | * [[http://linoxide.com/how-tos/auditd-tool-security-auditing/|An article about basic usage of Linux auditd with some example logs.]] |
| | * [[http://unix.stackexchange.com/questions/283587/restart-a-service-through-apache|Example logs from 2016.]] |
| | * [[http://whmcr.com/2011/10/14/auditd-logging-all-commands/|Logs with an a4 field.]] |
| |
| ==== Structure ==== | ==== Structure ==== |
| === Linux Audit field === | === Linux Audit event field === |
| * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/app-Audit_Reference.html|List of the available names for Linux Audit event fields.]] | * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/app-Audit_Reference.html#sec-Audit_Events_Fields|List of the available names for Linux Audit event fields (by Red Hat).]] |
| * [[https://people.redhat.com/sgrubb/audit/field-dictionary.txt|A dictionary of available Linux Audit fields.]] | * [[https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv|A dictionary of available Linux Audit fields.]] |
| |
| === Linux Audit record === | === Linux Audit event record === |
| * [[https://github.com/linux-audit/audit-userspace/blob/master/lib/msg_typetab.h|Source file with a list of available types of Linux Audit records.]] | * [[https://github.com/linux-audit/audit-userspace/blob/master/lib/msg_typetab.h|Source file with a list of available types of Linux Audit records.]] |
| | * [[https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Audit_Record_Types.html|Audit record types list in the Red Hat documentation.]] |
| | |
| | ==== Related threads on linux-audit redhat com mailing list. ==== |
| | |
| | * [[https://www.redhat.com/archives/linux-audit/2016-July/msg00063.html|Questions about the standard.]] |
| | * [[https://www.redhat.com/archives/linux-audit/2016-July/msg00103.html|How can I install the latest version of Linux Audit on CentOS 6.8?]] |
| | * [[https://www.redhat.com/archives/linux-audit/2016-August/msg00018.html|How can I install the latest version of Linux Audit on CentOS 7 (improved)?]] |
| | * [[https://www.redhat.com/archives/linux-audit/2016-July/msg00117.html|Why does the res field has a value of 1 instead of either success or fail.]] |
| | * [[https://www.redhat.com/archives/linux-audit/2016-August/msg00000.html|Question about the a[[:digit: + \[.*\ fields.]] |
| |