☰

Auditbeat 排除 /usr/sbin/cron

tag-icon • tag-icon elasticsearch kibana
Auditbeat 排除 /usr/sbin/cron

我将尝试从运行的 cron 作业中排除事件，该事件可以通过 KQL 请求找到：auditd.summary.how :"/usr/sbin/cron"

我的主机没有运行 SE Linux，所以我发现的规则（如下所示）不起作用：

-a never,user -F subj_type=crond_t
-a exit,never -F subj_type=crond_t

我会尝试这个：

-a never,user -F exe=/usr/sbin/cron

也不干活了。

感谢帮助。

答案1

因此，经过更多搜索后，我发现它工作正常：

- module: auditd
  # Load audit rules from separate files. Same format as audit.rules(7).
  audit_rule_files: [ '${path.config}/audit.rules.d/*.conf' ]
  audit_rules: |
    ## Define audit rules here.
    ## Create file watches (-w) or syscall audits (-a or -A). Uncomment these
    ## examples or add your own rules.

    ## If you are on a 64 bit platform, everything should be running
    ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls
    ## because this might be a sign of someone exploiting a hole in the 32
    ## bit API.
    #-a always,exit -F arch=b32 -S all -F key=32bit-abi

    ## Executions.
    #-a always,exit -F arch=b64 -S execve,execveat -k exec

    ## External access (warning: these can be expensive to audit).
    #-a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access

    ## Identity changes.
    -w /etc/group -p wa -k identity
    -w /etc/passwd -p wa -k identity
    -w /etc/gshadow -p wa -k identity

    ## Unauthorized access attempts.
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access

  processors:
    - drop_event:
        when:
          equals:
            process.executable: "/usr/sbin/cron"

有趣的部分是：

processors:
        - drop_event:
            when:
              equals:
                process.executable: "/usr/sbin/cron"

我会要求auditbeat在进程“/usr/sbin/cron”运行时删除该事件

相关内容