Add ECS 1.8 session and map user and groups

CHANGELOG.md

@@ -7,8 +7,12 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Added
 
+- Add user and group mapping for ECS 1.8 compatibility [#86](https://github.com/elastic/go-libaudit/pull/86)
+
 ### Changed
 
+- Change ECS category of USER_START and USER_END messages to `session`. [#86](https://github.com/elastic/go-libaudit/pull/86)
+
 ### Removed
 
 ### Deprecated

README.md

@@ -83,7 +83,7 @@ result: success
 session: "4"
 summary:
   actor:
-    primary: "1000"
+    primary: vagrant
     secondary: root
   action: acquired-credentials
   object:
@@ -95,6 +95,7 @@ user:
     auid: "1000"
     uid: "0"
   names:
+    auid: vagrant
     uid: root
   selinux:
     category: c0.c1023
@@ -116,6 +117,15 @@ ecs:
     - authentication
     type:
     - info
+  user:
+    name: vagrant
+    id: "1000"
+    effective:
+      name: root
+      id: "0"
+    target: {}
+    changes: {}
+  group: {}
 
 ---
 timestamp: 2016-12-07T02:22:14.303Z
@@ -126,7 +136,7 @@ result: success
 session: "4"
 summary:
   actor:
-    primary: "1000"
+    primary: vagrant
     secondary: root
   action: started-session
   object:
@@ -138,6 +148,7 @@ user:
     auid: "1000"
     uid: "0"
   names:
+    auid: vagrant
     uid: root
   selinux:
     category: c0.c1023
@@ -159,6 +170,15 @@ ecs:
     - authentication
     type:
     - info
+  user:
+    name: vagrant
+    id: "1000"
+    effective:
+      name: root
+      id: "0"
+    target: {}
+    changes: {}
+  group: {}
 
 ---
 timestamp: 2016-12-07T02:22:14.304Z
@@ -169,7 +189,7 @@ result: success
 session: "4"
 summary:
   actor:
-    primary: "1000"
+    primary: vagrant
     secondary: root
   action: executed
   object:
@@ -188,12 +208,13 @@ user:
     suid: "0"
     uid: "0"
   names:
-    egid: wheel
+    auid: vagrant
+    egid: root
     euid: root
-    fsgid: wheel
+    fsgid: root
     fsuid: root
-    gid: wheel
-    sgid: wheel
+    gid: root
+    sgid: root
     suid: root
     uid: root
   selinux:
@@ -218,7 +239,7 @@ file:
   uid: "0"
   gid: "0"
   owner: root
-  group: wheel
+  group: root
   selinux:
     domain: su_exec_t
     level: s0
@@ -267,8 +288,13 @@ ecs:
     - process
     type:
     - start
+  user:
+    effective: {}
+    target: {}
+    changes: {}
+  group: {}
 ```
 
 ## ECS compatibility
 
-This currently provides [Elastic Common Schema (ECS) 1.5](https://www.elastic.co/guide/en/ecs/current/index.html) categorization support for some of the more prominent or meaningful auditd events and syscalls.
+This currently provides [Elastic Common Schema (ECS) 1.8](https://www.elastic.co/guide/en/ecs/current/index.html) categorization support for some of the more prominent or meaningful auditd events and syscalls.

aucoalesce/coalesce.go

@@ -41,6 +41,24 @@ type ECSEvent struct {
 	Outcome  string   `json:"outcome,omitempty" yaml:"outcome,omitempty"`
 }
 
+type ECSEntityData struct {
+	Name string `json:"name,omitempty" yaml:"name,omitempty"`
+	ID   string `json:"id,omitempty" yaml:"id,omitempty"`
+}
+
+type ECSEntity struct {
+	ECSEntityData `json:",inline" yaml:",inline"`
+	Effective     ECSEntityData `json:"effective" yaml:"effective"`
+	Target        ECSEntityData `json:"target" yaml:"target"`
+	Changes       ECSEntityData `json:"changes" yaml:"changes"`
+}
+
+type ECSFields struct {
+	Event ECSEvent      `json:"event" yaml:"event"`
+	User  ECSEntity     `json:"user" yaml:"user"`
+	Group ECSEntityData `json:"group" yaml:"group"`
+}
+
 type Event struct {
 	Timestamp time.Time                `json:"@timestamp"       yaml:"timestamp"`
 	Sequence  uint32                   `json:"sequence"         yaml:"sequence"`
@@ -61,9 +79,7 @@ type Event struct {
 	Data  map[string]string   `json:"data,omitempty"  yaml:"data,omitempty"`
 	Paths []map[string]string `json:"paths,omitempty" yaml:"paths,omitempty"`
 
-	ECS struct {
-		Event ECSEvent `json:"event" yaml:"event"`
-	} `json:"ecs" yaml:"ecs"`
+	ECS ECSFields `json:"ecs" yaml:"ecs"`
 
 	Warnings []error `json:"-" yaml:"-"`
 }
@@ -575,6 +591,13 @@ func applyNormalization(event *Event) {
 				norm.SourceIP.Values))
 		}
 	}
+
+	// Populate ECS fields from `mappings` section.
+	for _, mapping := range norm.ECS.Mappings {
+		if mapping.To != nil && mapping.From != nil {
+			mapping.To(event, mapping.From(event))
+		}
+	}
 }
 
 func getValue(key string, event *Event) (string, bool) {
@@ -781,3 +804,34 @@ func setHowDefaults(event *Event) {
 	}
 	event.Summary.How = comm
 }
+
+func (e *ECSEntityData) set(value string) {
+	if value == "" || value == "unset" || value == "4294967295" || value == "-1" {
+		*e = ECSEntityData{ID: "unset"}
+		return
+	}
+	// This could be called using an UID or a name
+	if _, err := strconv.ParseUint(value, 10, 64); err == nil {
+		e.ID = value
+	} else {
+		e.Name = value
+	}
+}
+
+func (e *ECSEntityData) lookup(cache *EntityCache) {
+	if (e.ID == "") == (e.Name == "") {
+		return
+	}
+	if e.ID != "" {
+		e.Name = cache.LookupID(e.ID)
+	} else {
+		e.ID = cache.LookupName(e.Name)
+	}
+}
+
+func (e *ECSEntity) lookup(cache *EntityCache) {
+	e.ECSEntityData.lookup(cache)
+	e.Effective.lookup(cache)
+	e.Target.lookup(cache)
+	e.Changes.lookup(cache)
+}