github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-01 22:47:46 +00:00
Code Issues Projects Releases Wiki Activity

Add timestamp in function outputs

Browse Source
This commit is contained in:
Henri DF 2016-03-29 19:54:15 -07:00
parent 97d7b125ba
commit 38957d3b14
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/base.txt
View File

@ -77,7 +77,7 @@ read and not proc.name in (sshd, sudo, su) and not_cron and sensitive_files | Re
modify and (bin_dir_rename or bin_dir_mkdir) | Modify bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name) modify and (bin_dir_rename or bin_dir_mkdir) | Modify bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)
# Don't load shared objects coming from unexpected places # Don't load shared objects coming from unexpected places
read and fd.name contains .so and not (ubuntu_so_dirs or centos_so_dirs) | output.first_sequence(evt, "fd.filename", "shared_obj", "%evt.time: .so from unexpected dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)") read and fd.name contains .so and not (ubuntu_so_dirs or centos_so_dirs) | output.first_sequence(evt, "fd.filename", "shared_obj", "Loaded .so from unexpected dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)")
# Attempts to access things that shouldn't be # Attempts to access things that shouldn't be
evt.res = EACCES | EACCESS (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name) evt.res = EACCES | EACCESS (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)

3
userspace/digwatch/lua/output.lua
View File

@ -2,6 +2,7 @@ local mod = {}
function mod.syslog(evt, level, format) function mod.syslog(evt, level, format)
nixio = require("nixio") nixio = require("nixio")
format = "%evt.time: "..format
formatter = digwatch.formatter(format) formatter = digwatch.formatter(format)
msg = digwatch.format_event(evt, formatter) msg = digwatch.format_event(evt, formatter)
nixio.syslog(level, msg) nixio.syslog(level, msg)
@ -14,6 +15,8 @@ function mod.first_sequence(evt, fieldname, key, format)
local field_value = digwatch.field(evt, fieldname) local field_value = digwatch.field(evt, fieldname)
local now = os.time() local now = os.time()
format = "%evt.time: "..format
if first_sequence_state[key] == nil then if first_sequence_state[key] == nil then
first_sequence_state[key] = {} first_sequence_state[key] = {}
end end