Linux Auditd Technology Add-On
Overview
Details
This app is dedicated to my daughter. May this app improve the security of organisations great and small.
Please find documentation here: https://github.com/doksu/splunk_auditd/wiki
Release Notes
Version 3.1.2
Improvements:
- 'Update auditd_hosts lookup' and 'Update auditd_indices lookup' now have earliest times by default to prevent those scheduled searches from running for long periods is large environments (especially where SmartStore is used) (Thanks Martin Mueller)
- Distribution lookup updated
- Decoding of spaces in proctitle field to process_name fixed (Thanks Rafael de Vega for the pull request https://github.com/doksu/splunk_auditd/pull/27)
Version 3.1.0
.conf 2019 release - be sure to watch "ATT&CKing Linux with SPL" session to see the new features below.
New Features:
- MITRE ATT&CK eventtypes and tag
- MITRE ATT&CK in Auditd data model
- SOFTWARE_UPDATE events now supported (mapped to CIM)
Version 3.0.1
Splunk .conf 2018 Edition!
Major Changes:
- App renamed from TA_linux-auditd to TA-linux_auditd to conform with Splunk's current naming convention
New Features:
- Enriched audit events are now supported to accommodate environments with inconsistent uid/gid allocation
- New auditd event types now supported
Improvements:
- Host Inventory lookup now has an automatically updating last_boot field which can be used to indicate uptime
- Additional distribution releases now supported
- Unused capture groups in some transform regexes updated
- Unused default/data/ui/nav removed (v3.0.1)
Bug Fixes:
- Indices spelling mistake corrected throughout app