Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

aucoalesce: Be more forgiving of compound events. #3

Merged
merged 1 commit into from
Mar 13, 2023
Merged

aucoalesce: Be more forgiving of compound events. #3

merged 1 commit into from
Mar 13, 2023

Commits on Mar 13, 2023

  1. aucoalesce: Be more forgiving of compound events. 

    The CoalesceMessages function takes one or more audit messages and
creates an Event object. An Event containing more than one message
is known as a "compound event".

Prior to this commit, the compound event parsing logic required that
a "syscall" message be included in the slice passed to the function.
This requirement may be a little over-zealous. In GitHub issue 127,
we discovered examples of audit events that did not include a syscall
message. [1] This resulted in CoalesceMessages returning an error.

This commit modifies the syscall message check to only return an
error if both the "special" and syscall audit messages are missing.
In such a case, a new (testable) error is returned.

1. elastic/go-libaudit#127
    @sfox-equinix
    sfox-equinix committed Mar 13, 2023
    Configuration menu
    Copy the full SHA
    3d62faa View commit details
    Browse the repository at this point in the history