Commit 527d744
committed
feat(filters): add auditd support to linux filter v5.0.0
- Support native auditd collector JSON format (type: auditd)
- Map auditd fields to Standard Event Schema:
- syscall/category -> action
- result -> actionResult
- exe/comm -> origin.process
- proctitle -> origin.command
- subj_user -> origin.user
- cwd -> origin.path
- exit -> statusCode (cast to int)
- Set default severity 'info' for auditd events
- Preserve numeric IDs in log.* for correlation rules
- Maintain backwards compatibility with journald format1 parent 88d0d7d commit 527d744
1 file changed
Lines changed: 475 additions & 51 deletions
0 commit comments