Skip to content

Commit 9ab5577

Browse files
nbeckstead-ddognbeckstead-ddog
authored
Linux Audit Logs: Map event_id to ocsf.metadata.uid (DataDog#23184)
* Map event_id to ocsf.metadata.correlation_uid in all sub-pipelines * use uid instead of correlation_uid
1 parent 75f1d03 commit 9ab5577

2 files changed

Lines changed: 146 additions & 0 deletions

File tree

‎linux_audit_logs/assets/logs/linux-audit-logs.yaml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -570,6 +570,15 @@ pipeline:
570570
preserveSource: true
571571
overrideOnConflict: true
572572
type: schema-remapper
573+
- name: Map `event_id` to `ocsf.metadata.uid`
574+
sources:
575+
- event_id
576+
sourceType: attribute
577+
target: ocsf.metadata.uid
578+
targetFormat: string
579+
preserveSource: true
580+
overrideOnConflict: true
581+
type: schema-remapper
573582
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
574583
sources:
575584
- original_timestamp
@@ -759,6 +768,15 @@ pipeline:
759768
preserveSource: true
760769
overrideOnConflict: true
761770
type: schema-remapper
771+
- name: Map `event_id` to `ocsf.metadata.uid`
772+
sources:
773+
- event_id
774+
sourceType: attribute
775+
target: ocsf.metadata.uid
776+
targetFormat: string
777+
preserveSource: true
778+
overrideOnConflict: true
779+
type: schema-remapper
762780
- name: Map `ocsf.file.name` to `ocsf.file.name`
763781
sources:
764782
- ocsf.file.name
@@ -1003,6 +1021,15 @@ pipeline:
10031021
preserveSource: true
10041022
overrideOnConflict: true
10051023
type: schema-remapper
1024+
- name: Map `event_id` to `ocsf.metadata.uid`
1025+
sources:
1026+
- event_id
1027+
sourceType: attribute
1028+
target: ocsf.metadata.uid
1029+
targetFormat: string
1030+
preserveSource: true
1031+
overrideOnConflict: true
1032+
type: schema-remapper
10061033
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
10071034
sources:
10081035
- original_timestamp
@@ -1229,6 +1256,15 @@ pipeline:
12291256
preserveSource: true
12301257
overrideOnConflict: true
12311258
type: schema-remapper
1259+
- name: Map `event_id` to `ocsf.metadata.uid`
1260+
sources:
1261+
- event_id
1262+
sourceType: attribute
1263+
target: ocsf.metadata.uid
1264+
targetFormat: string
1265+
preserveSource: true
1266+
overrideOnConflict: true
1267+
type: schema-remapper
12321268
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
12331269
sources:
12341270
- original_timestamp
@@ -1365,6 +1401,15 @@ pipeline:
13651401
preserveSource: true
13661402
overrideOnConflict: true
13671403
type: schema-remapper
1404+
- name: Map `event_id` to `ocsf.metadata.uid`
1405+
sources:
1406+
- event_id
1407+
sourceType: attribute
1408+
target: ocsf.metadata.uid
1409+
targetFormat: string
1410+
preserveSource: true
1411+
overrideOnConflict: true
1412+
type: schema-remapper
13681413
- name: Map `ocsf.metadata.product.vendor_name` to `ocsf.metadata.product.vendor_name`
13691414
sources:
13701415
- ocsf.metadata.product.vendor_name
@@ -1679,6 +1724,15 @@ pipeline:
16791724
preserveSource: true
16801725
overrideOnConflict: true
16811726
type: schema-remapper
1727+
- name: Map `event_id` to `ocsf.metadata.uid`
1728+
sources:
1729+
- event_id
1730+
sourceType: attribute
1731+
target: ocsf.metadata.uid
1732+
targetFormat: string
1733+
preserveSource: true
1734+
overrideOnConflict: true
1735+
type: schema-remapper
16821736
- name: Map `ocsf.metadata.product.vendor_name` to `ocsf.metadata.product.vendor_name`
16831737
sources:
16841738
- ocsf.metadata.product.vendor_name
@@ -1968,6 +2022,15 @@ pipeline:
19682022
preserveSource: true
19692023
overrideOnConflict: true
19702024
type: schema-remapper
2025+
- name: Map `event_id` to `ocsf.metadata.uid`
2026+
sources:
2027+
- event_id
2028+
sourceType: attribute
2029+
target: ocsf.metadata.uid
2030+
targetFormat: string
2031+
preserveSource: true
2032+
overrideOnConflict: true
2033+
type: schema-remapper
19712034
- name: Map `msg.exe` to `ocsf.actor.process.path`
19722035
sources:
19732036
- msg.exe
@@ -2150,6 +2213,15 @@ pipeline:
21502213
preserveSource: true
21512214
overrideOnConflict: true
21522215
type: schema-remapper
2216+
- name: Map `event_id` to `ocsf.metadata.uid`
2217+
sources:
2218+
- event_id
2219+
sourceType: attribute
2220+
target: ocsf.metadata.uid
2221+
targetFormat: string
2222+
preserveSource: true
2223+
overrideOnConflict: true
2224+
type: schema-remapper
21532225
- name: Map `msg.acct` to `ocsf.group.name`
21542226
sources:
21552227
- msg.acct
@@ -2450,6 +2522,15 @@ pipeline:
24502522
preserveSource: true
24512523
overrideOnConflict: true
24522524
type: schema-remapper
2525+
- name: Map `event_id` to `ocsf.metadata.uid`
2526+
sources:
2527+
- event_id
2528+
sourceType: attribute
2529+
target: ocsf.metadata.uid
2530+
targetFormat: string
2531+
preserveSource: true
2532+
overrideOnConflict: true
2533+
type: schema-remapper
24532534
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
24542535
sources:
24552536
- original_timestamp
@@ -2701,6 +2782,15 @@ pipeline:
27012782
preserveSource: true
27022783
overrideOnConflict: true
27032784
type: schema-remapper
2785+
- name: Map `event_id` to `ocsf.metadata.uid`
2786+
sources:
2787+
- event_id
2788+
sourceType: attribute
2789+
target: ocsf.metadata.uid
2790+
targetFormat: string
2791+
preserveSource: true
2792+
overrideOnConflict: true
2793+
type: schema-remapper
27042794
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
27052795
sources:
27062796
- original_timestamp
@@ -2854,6 +2944,15 @@ pipeline:
28542944
preserveSource: true
28552945
overrideOnConflict: true
28562946
type: schema-remapper
2947+
- name: Map `event_id` to `ocsf.metadata.uid`
2948+
sources:
2949+
- event_id
2950+
sourceType: attribute
2951+
target: ocsf.metadata.uid
2952+
targetFormat: string
2953+
preserveSource: true
2954+
overrideOnConflict: true
2955+
type: schema-remapper
28572956
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
28582957
sources:
28592958
- original_timestamp
@@ -3052,6 +3151,15 @@ pipeline:
30523151
preserveSource: true
30533152
overrideOnConflict: true
30543153
type: schema-remapper
3154+
- name: Map `event_id` to `ocsf.metadata.uid`
3155+
sources:
3156+
- event_id
3157+
sourceType: attribute
3158+
target: ocsf.metadata.uid
3159+
targetFormat: string
3160+
preserveSource: true
3161+
overrideOnConflict: true
3162+
type: schema-remapper
30553163
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
30563164
sources:
30573165
- original_timestamp
@@ -3195,6 +3303,15 @@ pipeline:
31953303
preserveSource: true
31963304
overrideOnConflict: true
31973305
type: schema-remapper
3306+
- name: Map `event_id` to `ocsf.metadata.uid`
3307+
sources:
3308+
- event_id
3309+
sourceType: attribute
3310+
target: ocsf.metadata.uid
3311+
targetFormat: string
3312+
preserveSource: true
3313+
overrideOnConflict: true
3314+
type: schema-remapper
31983315
- name: Map `original_timestamp` to `ocsf.metadata.original_time`
31993316
sources:
32003317
- original_timestamp

0 commit comments

Comments
 (0)