Skip to content

Commit 527d744

Browse files
committed
feat(filters): add auditd support to linux filter v5.0.0
- Support native auditd collector JSON format (type: auditd) - Map auditd fields to Standard Event Schema: - syscall/category -> action - result -> actionResult - exe/comm -> origin.process - proctitle -> origin.command - subj_user -> origin.user - cwd -> origin.path - exit -> statusCode (cast to int) - Set default severity 'info' for auditd events - Preserve numeric IDs in log.* for correlation rules - Maintain backwards compatibility with journald format
1 parent 88d0d7d commit 527d744

1 file changed

Lines changed: 475 additions & 51 deletions

File tree

0 commit comments

Comments
 (0)