WIP POC Event categorization on Linux auth logs#9905

Closed

webmat wants to merge 9 commits intoelastic:masterfrom webmat:categ-fb-system-auth

+453-41

Commits on Jan 14, 2019

Add a whole lot of other possible auth messages to the test file
Mathieu Martin
committed
DRY up the parsing of the header into a separate grok, keep same semantics
Mathieu Martin
committed
Change the semantics so the message (stripped out of leading noise) is always kept...
Mathieu Martin
committed
Move process/pid to header parsing as well:
Mathieu Martin
committed
Update the sudo command test log to include the pam logs
Mathieu Martin
committed
Start doing categorization for authentication:
Mathieu Martin
committed
Set event.action=ssh_login (too broad ATM) and event.outcome for some ssh activity
Mathieu Martin
committed
Tweak new field's description to add a new expected value
Mathieu Martin
committed
Include messages with a dropped_ip as outcome auth failure
Mathieu Martin
committed