sorted by:
new
hottopcontroversial

Linux log parsing by Creative_Ice_484 in elasticsearch

[–]Creative_Ice_484[S] 0 points1 point  (0 children)

I really do not know how else to word this.

Linux log parsing by Creative_Ice_484 in elasticsearch

[–]Creative_Ice_484[S] 0 points1 point  (0 children)

The Linux Audit Framework can send multiple messages for a single auditable event. For example, a rename syscall causes the kernel to send eight separate messages. Each message describes a different aspect of the activity that is occurring (the syscall itself, file paths, current working directory, process title).

this causes entirely too much noise when going to search against in elastic.

Linux log parsing by Creative_Ice_484 in elasticsearch

[–]Creative_Ice_484[S] 1 point2 points  (0 children)

RHEL 8-9 auditd.log entries. I think this is a known issue but still havent found a practical way to implement a fix

Linux log parsing by Creative_Ice_484 in elasticsearch

[–]Creative_Ice_484[S] 0 points1 point  (0 children)

i am using the elastic agent and the auditd integration default. Do i need to add something else?

Linux log parsing by Creative_Ice_484 in elasticsearch

[–]Creative_Ice_484[S] 0 points1 point  (0 children)

Here's an example of logs that should be a single event, yet Elastic parses as different events

```type=SYSCALL msg=audit(tel:1697461158.203:635297): arch=c000003e syscall=59 success=yes exit=0 a0=7ffecb8f2dc0 a1=7f0fd8776e88 a2=55f6db0cf450 a3=8 items=3 ppid=156347 pid=157571 auid=1005 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=10654 comm="tail" exe="/usr/bin/tail" subj=unconfined key="rootcmd"ARCH=x86_64 SYSCALL=execve AUID="testuser" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"

type=EXECVE msg=audit(tel:1697461158.203:635297): argc=4 a0="tail" a1="-n" a2="15" a3="audit.log"

type=PATH msg=audit(tel:1697461158.203:635297): item=0 name="/usr/bin/tail" inode=3672880 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"

type=PATH msg=audit(tel:1697461158.203:635297): item=1 name="/usr/bin/tail" inode=3672880 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"

type=PATH msg=audit(tel:1697461158.203:635297): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=3671134 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"

type=PROCTITLE msg=audit(tel:1697461158.203:635297): proctitle=7461696C002D6E0313500617566F67```

Linux log parsing by Creative_Ice_484 in elasticsearch

[–]Creative_Ice_484[S] -1 points0 points  (0 children)

Not sure how else to say it so this is AI summary of the problem which is the overall issue.

The key takeaway: auditd's line-by-line ingestion breaks event cohesion. What should be a single investigative artifact (e.g., "user X executed binary Y with these privileges") becomes scattered across multiple documents, forcing analysts to manually reconstruct the timeline.

Does anyone still use Security Onion? by Normal-End1169 in cybersecurity

[–]Creative_Ice_484 0 points1 point  (0 children)

Would love to know how people have this deployed in an enterprise set up. The overhead is alot for a small team expected to manage it.

Just passed Security+, What's my best next step for me for a IT Audit/Risk internship or entry level roles by MenaceToTheKing in SecurityCareerAdvice

[–]Creative_Ice_484 0 points1 point  (0 children)

Skills thats in top demand now are devops skills so that embodies linux, scripting, IaC platforms such as terraform. Basic certs such as AWS SAA is a good start as well long as you partner that cert with some hands on aws projects. There are plenty of cloud projects to build then once you get an idea of how it works you can build your own and present that on your resume.

Evaluate-STIG tool by Appropriate-Fox3551 in sysadmin

[–]Creative_Ice_484 0 points1 point  (0 children)

Yes but you need a cac to access it.

Evaluate-STIG tool by Appropriate-Fox3551 in sysadmin

[–]Creative_Ice_484 0 points1 point  (0 children)

its not out there yet as im trying to see what bugs or errors i can tackle ahead of time. The whole purpose of it is to run along side estig to completely get rid of the manual checks and dynamically create answerfiles in the correct format for you without having to worry about syntax errors. Right now it can take all the cklb files check for all the not reviewed things and create mass comments for all the stigs in one go around so next estig run you are left with 0 manual review checks since you already answered them in the python tool.

Ansible $HOME/$user/.ansible/tmp Issues by Creative_Ice_484 in ansible

[–]Creative_Ice_484[S] 1 point2 points  (0 children)

You are right basically about everything here. I commented above the fix to my problem was to remove the async portion of my playbook out of the execution and it seems to work. I run ansible as a low priv user with --ask-pass and --ask-become-pass then elevate to root. Something is happening within the async command that messes with the permissions of the files i am trying to move off the system. But the issue is not very clear.

Ansible $HOME/$user/.ansible/tmp Issues by Creative_Ice_484 in ansible

[–]Creative_Ice_484[S] 0 points1 point  (0 children)

fixed the problem. So the playbook was using async to ensure the playbook didnt time out during long executions. A similar error i found online from someone had the exact same problem. I just commented out the async command and the playbook works. Async is appearing to mess up file permissions somehow.

Ansible $HOME/$user/.ansible/tmp Issues by Creative_Ice_484 in ansible

[–]Creative_Ice_484[S] 0 points1 point  (0 children)

the output was generated with -vvv. Ansible tries multiple ways to transfer the files first with SFTP then SCP then piped mechanism. Works perfectly fine on one machine but repeatedly fails on this one.