[system] Populate event.action for Linux IAM auth events and sudo systemctl - #21042
[system] Populate event.action for Linux IAM auth events and sudo systemctl#21042marc-gr wants to merge 3 commits into
Conversation
…temctl The system.auth pipeline categorized useradd/userdel/groupadd/groupdel as IAM events but left event.action empty, and sudo systemctl start/stop did not set service.name. Fill those ECS fields and extract group.name from gshadow lines.
marc-gr
added
Integration:system
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
There was a problem hiding this comment.
🟡 Changes recommended
The new sudo systemctl parsing logic can mis-extract service.name when flags appear after the verb, and the service-stop typing is inconsistent with the stated goal of matching system.syslog semantics.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR improves the system.auth data stream parsing so Linux IAM and sudo systemctl events are enriched with more complete ECS fields (notably event.action, plus service.name for service lifecycle commands).
Changes:
- Populate
event.actionforuseradd/userdel/groupadd/groupdel-style IAM events and extend grok coverage for/etc/groupand/etc/gshadowmessages. - Add sudo
systemctl start|stop|restartenrichment to setservice.nameand service lifecycleevent.action. - Update exported fields documentation, add pipeline test fixtures, and bump package version + changelog.
File summaries
| File | Description |
|---|---|
| packages/system/manifest.yml | Bumps the System package version to 2.23.5. |
| packages/system/docs/README.md | Documents service.name as an exported field for system.auth. |
| packages/system/data_stream/auth/fields/fields.yml | Declares service.name (ECS external) for the auth data stream. |
| packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml | Adds grok patterns for group file lines; adds IAM event.action script; adds sudo systemctl service enrichment script. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json | Updates expected output to include event.action. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-iam-systemctl.log-expected.json | Adds expected outputs for IAM + sudo systemctl parsing. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-iam-systemctl.log-config.yml | Adds pipeline test config for the new fixture. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-iam-systemctl.log | Adds new pipeline test input covering IAM + sudo systemctl. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-host-syslog-processor.json-expected.json | Updates expected output to include event.action. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json | Updates expected output to include event.action. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json | Updates expected output (including event.action, and additional group fields where parsed). |
| packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json | Updates expected output to include event.action. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json | Updates expected output to include event.action. |
| packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json | Updates expected output to include event.action. |
| packages/system/changelog.yml | Adds a 2.23.5 bugfix changelog entry with PR link. |
Review details
- Files reviewed: 14/15 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
🚀 Benchmarks reportTo see the full report comment with |
….type Take the next non-flag token as service.name so forms like `systemctl start --no-block rsyslog` parse correctly, and set event.type to end/start/change to match system.syslog service lifecycle events.
There was a problem hiding this comment.
🟢 Approval recommended
The ingest pipeline updates are covered by updated and newly added pipeline test fixtures that validate the new event.action and service.name behavior.
Review details
- Files reviewed: 14/15 changed files
- Comments generated: 0 new
- Review effort level: Lite
|
✅ All changelog entries have the correct PR link. |
|
🟢 No issues across the latest commits eda1230.
🤖 AI-Generated Review | Vera Review Bot - v0.3.0 | 📚 Knowledge base: integration-skills
|
💚 Build Succeeded
History
|
Proposed commit message
The
system.authpipeline already treateduseradd/userdel/groupadd/groupdelas IAM events but leftevent.actionempty. Sudosystemctl start|stop|restartalso omittedservice.name.This fills
event.action(user-created,user-deleted,group-created,group-deleted), extractsgroup.namefrom/etc/groupand/etc/gshadowlines, and setsservice.nameplusservice-start/service-stop/service-restartfor sudo systemctl.Checklist
changelog.ymlfile.How to test this PR locally
Related issues