Filebeat feature request for auditd event merging and enrichment

[gwsales]

Requesting a new prospector type in filebeat that uses go-libaudit to parse and enrich data, basically need to read auditd logs and build json output like auditbeats for environments that are stuck using auditd and not able to use the muticast socket type due to older kernal versions

#6477

[andrewkroh]

The auparse utility in go-libaudit is an example of how to implement this. Filebeat would do that same thing which basically is:

• Read lines the auditd log
• Parses the individual line with auparse.ParseLogLine
• Writes the parsed line to a libaudit.Reassembler to combine the related messages in order. Message written by auditd can be interleaved and out of order.
• Periodically call Flush on the Reassembler
• Call aucoalesce.CoalesceMessages to create a single event from the related messages that come out of the Reassembler

This would replace the ingest pipeline (and painless scripting) in the current auditd Filebeat module.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.