46 lines
1.7 KiB
XML
46 lines
1.7 KiB
XML
<!--
|
|
Fleet auditd-over-syslog decoder — install on the SIEM node (wazuh.master) at
|
|
/var/ossec/etc/decoders/local_decoder.xml, then restart the manager.
|
|
|
|
WHY: the fleet ships auditd agentlessly via audisp-syslog. STIG hardening sets
|
|
auditd `name_format = hostname` (SSG auditd_name_format — keep it, it's
|
|
compliance), which prepends `node=<host>` to every record. Wazuh's BUILT-IN
|
|
auditd decoder expects the line to start with `type=`, so the node= prefix made
|
|
it match nothing (`"decoder":{}`). This decoder handles the node= variant.
|
|
|
|
Pre-decoding strips the syslog header + program (`... audispd[709]: `), so the
|
|
text these decoders see starts at `node=...`.
|
|
|
|
Verify with: docker exec -it <master> /var/ossec/bin/wazuh-logtest
|
|
(paste a full_log line from archives.json; confirm decoder.name = fleet-auditd
|
|
and audit.type is extracted, then adjust if your build reports the child name).
|
|
-->
|
|
<decoder name="fleet-auditd">
|
|
<program_name>audispd</program_name>
|
|
</decoder>
|
|
|
|
<decoder name="fleet-auditd">
|
|
<parent>fleet-auditd</parent>
|
|
<regex type="pcre2">^node=(\S+) type=(\w+) msg=audit\(([\d.]+):(\d+)\):</regex>
|
|
<order>audit.node,audit.type,audit.timestamp,audit.serial</order>
|
|
</decoder>
|
|
|
|
<!-- best-effort common fields (present depending on record type) -->
|
|
<decoder name="fleet-auditd">
|
|
<parent>fleet-auditd</parent>
|
|
<regex type="pcre2"> auid=(\d+)</regex>
|
|
<order>audit.auid</order>
|
|
</decoder>
|
|
|
|
<decoder name="fleet-auditd">
|
|
<parent>fleet-auditd</parent>
|
|
<regex type="pcre2"> (?:res|success)=(\S+)</regex>
|
|
<order>audit.res</order>
|
|
</decoder>
|
|
|
|
<decoder name="fleet-auditd">
|
|
<parent>fleet-auditd</parent>
|
|
<regex type="pcre2"> exe="([^"]+)"</regex>
|
|
<order>audit.exe</order>
|
|
</decoder>
|