The audit log integration process.args log entry only contains the user.id field; it does not contain the user.name field. Please suggest!It's urgent!

Elastic Security Endpoint Security
1

Hello Team,
I'm using the audit integration to parse audit logs. For the audit record type USER_CMD, the user.name field is not being mapped; only the user.id is present.

The log entry contains AUID, which represents the user.name, but it is not displaying in Kibana. Why is this happening?

image
image736×236 30.6 KB

grep "/home/manjunath/editnginx.sh" audit.log

type=USER_CMD msg=audit(1735732.627:1409): pid=1703 uid=104 auid=104 ses=222 subj=unconfined msg='cwd="/home/manjunath" cmd="/home/manjunath/editnginx.sh" exe="/usr/bin/sudo" terminal=pts/0 res=success'UID="manjunath" AUID="manjunath"

How can i change the pipeline to add the AUID field to print the value

2

Hi evangelin,
Can you share which version of the integration you have installed, and how you installed it?

3

Hello Maxwell_Borden, Thanks for you reply!
I have installed the elastic agent in end point where i want to send the logs to ELK, The Elastic agent version is 8.14.3 and the integration version is 3.19.2 i added the policy to the elastic agent and attached the audit log integration

4

This looks to me like the same issue as was fixed here in integration version 3.20.3 , where an enriched format log with a msg='...' field was not parsed correctly, can you try with that newer ingest pipeline?

5

Do i need to create a new ingest pipeline now and add integration to that?
Actually when i search for the pipeline in stack management > ingest pipeline there are 2 pipeline [logs-auditd.log-3.19.2] and [logs-auditd.log-3.15.0] this 3.15.0 pipeline is storing the AUID value but 3.19.2 is not! But the integration is using 3.19.2 pipeline only how can i change it to 3.15.0

6

Please reply i'm new to ELK idk how to do and what to do !

7

You cannot change the ingest pipeline used by the integration, if the integration is on version 3.19.2 it will use the ingest pipeline with this version.

The old pipeline should've been deleted, probably it wasn't deleted because of some bug.

If you are having any issue with the parsing of an integration the first thing to do is to upgrade to the last version, in this case is version 3.21.0.

See if you can upgrade to this version.

10

image
image1473×888 79.3 KB

the which im using is the latest version in mine :slightly_frowning_face:

11

Hello! It seems 3.19.2 was the latest version supporting Kibana versions under 8.11.

You mentioned you are using elastic agent 8.14.3, does the Kibana version correspond with this or is it older than 8.11? If that is the case the only way to be able to see newer versions of the integrations is by upgrading it.