Here is an event where event.action is an empty strin

Event where event.action is an empty string about go-libaudit HOT 1 CLOSED

elastic commented on June 18, 2024

Event where event.action is an empty string

from go-libaudit.

Comments (1)

FrankHassanabad commented on June 18, 2024

Looks like I was able to get some events with empty event.action off of the zeek-london using:

GET /*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "terms": {
            "event.action": [
              ""
            ]
          }
        },
        {
          "terms": {
            "event.module": [
              "auditd"
            ]
          }
        },
        {
          "terms": {
            "host.name": [
              "zeek-london"
            ]
          }
        }
      ]
    }
  }
}

Eyeballing the unique result of event.originals look to be:

         "event" : {
            "category" : "unknown",
            "action" : "",
            "original" : [
              "type=PROCTITLE msg=audit(1553295601.802:356814): proctitle=6E696365002F7573722F73686172652F62726F63746C2F736372697074732F706F737470726F636573736F72732F73756D6D6172697A652D636F6E6E656374696F6E730073746174732E323031392D30332D32322D32322D30302D30302E6C6F670073746174730031392D30332D32325F32322E30302E30300031392D30332D"
            ],
            "module" : "auditd"
          },

         "event" : {
            "category" : "unknown",
            "action" : "",
            "original" : [
              """type=PROCTITLE msg=audit(1553293612.420:327508): proctitle="/lib/systemd/systemd-udevd""""
            ],
            "module" : "auditd"
          },

          "event" : {
            "category" : "unknown",
            "action" : "",
            "original" : [
              """type=PROCTITLE msg=audit(1553293612.420:327508): proctitle="/lib/systemd/systemd-udevd""""
            ],
            "module" : "auditd"
          },

        "event" : {
            "category" : "unknown",
            "action" : "",
            "original" : [
              "type=PROCTITLE msg=audit(1553293612.568:328773): proctitle=2F62696E2F62617368002F7362696E2F617567656E72756C6573002D2D6C6F6164"
            ],
            "module" : "auditd"
          },

from go-libaudit.

Recommend Projects