Skip to content

Commit 5c6167b

Browse files
kcreddykcreddy
authored
SysmonForLinux | New integration to support Sysmon logs for Linux (elastic#4531)
* initial sysmon commit * remove grok processor; add dissect module * tests * run tests * add simpler logic in filestream * add code owners for sysmon * sysmon_linux instead of sysmon and PR review * update name in codeowners * add dockercompo * Drop if not sysmon process
1 parent f9afcc0 commit 5c6167b

File tree

25 files changed

+4561
-0
lines changed

25 files changed

+4561
-0
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@
172172
/packages/suricata @elastic/security-external-integrations
173173
/packages/symantec_endpoint @elastic/security-external-integrations
174174
/packages/synthetics @elastic/uptime
175+
/packages/sysmon_linux @elastic/security-external-integrations
175176
/packages/system @elastic/elastic-agent-data-plane
176177
/packages/system/kibana @elastic/elastic-agent-data-plane @elastic/kibana-visualizations
177178
/packages/tcp @elastic/security-external-integrations

‎packages/sysmon_linux/_dev/build/build.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
dependencies:
2+
ecs:
3+
reference: [email protected]

‎packages/sysmon_linux/_dev/build/docs/README.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Sysmon for Linux Integration
2+
3+
The Sysmon for Linux integration allows you to monitor the [Sysmon for Linux](https://github.com/Sysinternals/SysmonForLinux), which is an open-source system monitor tool developed to collect security events from Linux environments.
4+
5+
Use the Sysmon for Linux integration to collect logs from linux machine which has sysmon tool running.
6+
Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference data when troubleshooting an issue.
7+
8+
NOTE: To collect Sysmon events from Windows event log, use [Windows `sysmon_operational` data stream](https://docs.elastic.co/en/integrations/windows#sysmonoperational) instead.
9+
10+
## Requirements
11+
12+
You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it.
13+
You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
14+
15+
## Setup
16+
17+
For step-by-step instructions on how to set up an integration,
18+
see the {{ url "getting-started-observability" "Getting started" }} guide.
19+
20+
## Data streams
21+
22+
The Sysmon for Linux `log` data stream provides events from logs produced by Sysmon tool running on Linux machine.
23+
24+
{{event "log"}}
25+
26+
{{fields "log"}}

‎packages/sysmon_linux/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: "2.3"
2+
services:
3+
sysmon_linux:
4+
image: alpine
5+
volumes:
6+
- ./sample_logs:/sample_logs:ro
7+
- ${SERVICE_LOGS_DIR}:/var/log
8+
command: /bin/sh -c "cp /sample_logs/* /var/log/"

‎packages/sysmon_linux/_dev/deploy/docker/sample_logs/sysmon.log‎

Lines changed: 50 additions & 0 deletions
Large diffs are not rendered by default.

‎packages/sysmon_linux/changelog.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# newer versions go on top
2+
- version: "0.1.0"
3+
changes:
4+
- description: initial release
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/4531

‎packages/sysmon_linux/data_stream/log/_dev/test/pipeline/test-common-config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
fields:
2+
tags:
3+
- preserve_original_event

‎packages/sysmon_linux/data_stream/log/_dev/test/pipeline/test-sysmon.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"events": [
3+
{
4+
"log": {
5+
"syslog": {
6+
"hostname": "user-ubuntu",
7+
"appname": "sysmon",
8+
"procid": "3099"
9+
}
10+
},
11+
"winlog": {
12+
"record_id": "24",
13+
"computer_name": "user-ubuntu",
14+
"process": {
15+
"pid": 3099,
16+
"thread": {
17+
"id": 3099
18+
}
19+
},
20+
"event_id": "5",
21+
"provider_guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
22+
"level": "information",
23+
"channel": "Linux-Sysmon/Operational",
24+
"time_created": "2022-10-24T17:06:14.193Z",
25+
"event_data": {
26+
"User": "root",
27+
"ProcessId": "783",
28+
"Image": "/opt/Elastic/Agent/data/elastic-agent-5ae799/install/osquerybeat-7.15.1-linux-x86_64/osqueryd",
29+
"RuleName": "-",
30+
"ProcessGuid": "{d65774de-8d1e-6175-0000-000000000000}",
31+
"UtcTime": "2022-10-24 17:06:14.200",
32+
"opcode": "Info",
33+
"provider_name": "Linux-Sysmon",
34+
"version": "3"
35+
}
36+
}
37+
},
38+
{
39+
"log": {
40+
"syslog": {
41+
"hostname": "user-ubuntu",
42+
"appname": "sysmon"
43+
}
44+
},
45+
"winlog": {
46+
"computer_name": "user-ubuntu",
47+
"record_id": "22",
48+
"process": {
49+
"pid": 3099,
50+
"thread": {
51+
"id": 3099
52+
}
53+
},
54+
"event_id": "5",
55+
"level": "information",
56+
"provider_guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
57+
"channel": "Linux-Sysmon/Operational",
58+
"time_created": "2022-10-24T17:05:48.296Z",
59+
"event_data": {
60+
"User": "root",
61+
"ProcessId": "3100",
62+
"Image": "(null)",
63+
"ProcessGuid": "{d65774de-8d10-6175-0000-000000000000}",
64+
"RuleName": "-",
65+
"UtcTime": "2022-10-24 17:05:48.302",
66+
"provider_name": "Linux-Sysmon",
67+
"opcode": "Info",
68+
"version": "3"
69+
}
70+
}
71+
}
72+
]
73+
}

‎packages/sysmon_linux/data_stream/log/_dev/test/pipeline/test-sysmon.json-expected.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"expected": [
3+
{
4+
"ecs": {
5+
"version": "8.5.0"
6+
},
7+
"event": {
8+
"action": "log",
9+
"category": [
10+
"process"
11+
],
12+
"code": "5",
13+
"created": "2022-10-24T17:06:14.193Z",
14+
"kind": "event",
15+
"provider": "Linux-Sysmon",
16+
"type": [
17+
"end"
18+
]
19+
},
20+
"host": {
21+
"hostname": "user-ubuntu"
22+
},
23+
"log": {
24+
"level": "information"
25+
},
26+
"process": {
27+
"entity_id": "{d65774de-8d1e-6175-0000-000000000000}",
28+
"executable": "/opt/Elastic/Agent/data/elastic-agent-5ae799/install/osquerybeat-7.15.1-linux-x86_64/osqueryd",
29+
"name": "sysmon",
30+
"pid": 783
31+
},
32+
"tags": [
33+
"preserve_original_event"
34+
],
35+
"winlog": {
36+
"channel": "Linux-Sysmon/Operational",
37+
"computer_name": "user-ubuntu",
38+
"event_id": "5",
39+
"opcode": "Info",
40+
"process": {
41+
"pid": 3099,
42+
"thread": {
43+
"id": 3099
44+
}
45+
},
46+
"provider_guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
47+
"record_id": "24",
48+
"version": 3
49+
}
50+
},
51+
{
52+
"ecs": {
53+
"version": "8.5.0"
54+
},
55+
"event": {
56+
"action": "log",
57+
"category": [
58+
"process"
59+
],
60+
"code": "5",
61+
"created": "2022-10-24T17:05:48.296Z",
62+
"kind": "event",
63+
"provider": "Linux-Sysmon",
64+
"type": [
65+
"end"
66+
]
67+
},
68+
"host": {
69+
"hostname": "user-ubuntu"
70+
},
71+
"log": {
72+
"level": "information"
73+
},
74+
"process": {
75+
"entity_id": "{d65774de-8d10-6175-0000-000000000000}",
76+
"executable": "(null)",
77+
"name": "sysmon",
78+
"pid": 3100
79+
},
80+
"tags": [
81+
"preserve_original_event"
82+
],
83+
"winlog": {
84+
"channel": "Linux-Sysmon/Operational",
85+
"computer_name": "user-ubuntu",
86+
"event_id": "5",
87+
"opcode": "Info",
88+
"process": {
89+
"pid": 3099,
90+
"thread": {
91+
"id": 3099
92+
}
93+
},
94+
"provider_guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
95+
"record_id": "22",
96+
"version": 3
97+
}
98+
}
99+
]
100+
}

‎packages/sysmon_linux/data_stream/log/_dev/test/system/test-filestream-config.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
service: sysmon_linux
2+
input: filestream
3+
data_stream:
4+
vars:
5+
paths:
6+
- "{{SERVICE_LOGS_DIR}}/*.log"
7+
preserve_original_event: true

0 commit comments

Comments
 (0)