Hi there,
i’d like to ask for help in this matter:
im running 4 node opensearch cluster in version 2.15.0 on RKE2 cluster.
flow:
collecting logs from multiple servers where is running auditbeat 8.13.2 agent, then logs goes to logstash which is running next to opensearch deployment , finally from logstash goes to opensearch.
auditbeat conf:
root@jump.1:~# cat /etc/auditbeat/auditbeat.yml | grep -v "#" | grep -v "^$"
auditbeat.modules:
- module: auditd
audit_rules: |
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295 -k export
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
-a exclude,never -F msgtype=PATH
-w /etc/apparmor -p wa
-w /etc/apparmor.d -p wa
-w /etc/anacrontab
-w /etc/at.allow
-w /etc/at.deny
-w /etc/cron.allow
-w /etc/cron.d/
-w /etc/cron.daily
-w /etc/cron.deny
-w /etc/cron.hourly/
-w /etc/cron.monthly/
-w /etc/cron.weekly/
-w /etc/crontab
-w /etc/group -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/localtime -p wa -k time-change
-w /etc/modprobe.conf
-w /etc/network -p wa -k system-locale
-w /etc/networks -p wa -k system-locale
-w /etc/nsswitch.conf
-w /etc/pam.d/
-w /etc/passwd -p wa -k identity
-w /etc/profile
-w /etc/profile.d/
-w /etc/rsyslog.conf
-w /etc/rsyslog.d/conf
-w /etc/security/opasswd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/shells
-w /etc/ssh/sshd_config -p warx -k sshd_config
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d -p wa -k scope
-w /etc/sysctl.conf
-w /etc/syslog.conf
-w /sbin/insmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /var/log/lastlog -p wa -k logins
-w /var/log/sudo.log -p wa -k actions
-w /var/spool/at/
- module: file_integrity
paths:
- /bin
- /usr/bin
- /sbin
- /usr/sbin
- /etc
- /var/log
- /var/lib/docker
exclude_files:
- '(?i)\.sw[nop]$'
- '~$'
- '/\.git($|/)'
scan_at_start: true
scan_rate_per_sec: 50 MiB
max_file_size: 100 MiB
hash_types: [sha1]
recursive: true
- module: system
datasets:
- host
- login
- user
state.period: 12h
user.detect_password_changes: true
login.wtmp_file_pattern: /var/log/wtmp*
login.btmp_file_pattern: /var/log/btmp*
output.logstash:
hosts: ["logs.com:9400"]
ssl.certificate: "/certs/logs.pem"
ssl.key: "/certs/logs.key"
ssl.certificate_authorities: ["/certs/ca.pem"]
processors:
- add_host_metadata:
- drop_event:
when:
contains:
status: "/var/log/pods"
logging.level: info
logging.selectors: ["*"]
fields:
server_name: "1"
location_jump:
lat: 49.5889
lon: 11.0079
fields_under_root: true
…
…
logstash conf:
logstash.conf
input {
beats {
port => 5044
ssl_enabled => true
ssl_certificate_authorities => ["/certs/ca.crt"]
ssl_certificate => "/certs/logs.crt"
ssl_key => "/certs/logs.key"
ssl_client_authentication => "required"
}
}
filter {
mutate {
convert => { "user.id" => "integer" }
}
}
output {
opensearch {
hosts => ["https://opensearch-cluster-master:9200"]
ssl => 'true'
cacert => '/certs/ca.crt'
user => 'fluentbit'
password => '*/*/*/*/*/*/*'
index => "%{[host][name]}-%{+YYYY.MM.dd}"
action => "create"
}
}
i am receiving logs into opensearch and there are template/index pattern and alias configure for these logs.
In security analytics i created detector with :
Log type:
Linux System Logs
Detection rules:
192
Threat intelligence:
Enabled
so i tried to check if i activate for example rule called:
id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06
logsource:
product: linux
title: Cat Sudoers
description: >-
Detects the execution of a cat /etc/sudoers to list all users that have sudo
rights
tags:
- attack.reconnaissance
- attack.t1592.004
falsepositives:
- Legitimate administration activities
level: medium
status: test
references:
- 'https://github.com/sleventyeleven/linuxprivchecker/'
author: Florian Roth (Nextron Systems)
detection:
selection:
Image|endswith:
- /cat
- grep
- /head
- /tail
- /more
CommandLine|contains: ' /etc/sudoers'
condition: selection
but no findings/alert in detector.
I can see within discovery in index that such action has happend.
So i create custom rule for that based on result from discovery where the right one fields are used:
id: c-4GxpABBd68fWPzNMHl
logsource:
product: linux
title: Sudoers File Access Detected via Cat Command
description: Detects when the sudoers file is accessed using the cat command
tags:
- attack.reconnaissance
- attack.t1592.004
falsepositives:
- Legitimate administration activities
level: medium
status: test
references:
- 'https://github.com/sleventyeleven/linuxprivchecker/'
author:
detection:
selection:
process.title: cat /etc/sudoers
condition: selection
so my question is:
- why “official” Log type: Linux System Logs does not match the fields which are in index which is generated by auditbeat/logstash ?
Or is there something wrong with configuration auditbeat/logstash ?
THanks a lot.
L
