laurel 0.7.3

Transform Linux Audit logs for SIEM usage
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

use std::fmt::Debug;

use indexmap::IndexMap;

use serde::{Deserialize, Serialize, Serializer};

use linux_audit_parser::*;

use crate::proc::ProcessKey;

/// Collect records in [`EventBody`] context as single or multiple
/// instances.
///
/// Examples for single instances are `SYSCALL`,`EXECVE` (even if the
/// latter can be split across multiple lines). An example for
/// multiple instances is `PATH`.
///
/// "Multi" records are serialized as list-of-maps (`[ { "key":
/// "value", … }, { "key": "value", … } … ]`)
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(untagged)]
pub enum EventValues<'a> {
    // e.g SYSCALL, EXECVE
    Single(Body<'a>),
    // e.g. PATH
    Multi(Vec<Body<'a>>),
}

fn serialize_node<S: Serializer>(value: &Option<Vec<u8>>, s: S) -> Result<S::Ok, S::Error> {
    serde_bytes::Bytes::new(value.as_ref().unwrap()).serialize(s)
}

#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "UPPERCASE")]
pub struct Event<'a> {
    pub id: EventID,
    #[serde(
        skip_serializing_if = "Option::is_none",
        serialize_with = "serialize_node"
    )]
    pub node: Option<Vec<u8>>,
    #[serde(flatten)]
    pub body: IndexMap<MessageType, EventValues<'a>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub container_info: Option<Body<'a>>,
    #[serde(skip)]
    pub is_filtered: bool,
    #[serde(skip)]
    pub(crate) is_exec: bool,
    #[serde(skip)]
    pub(crate) process_key: Option<ProcessKey>,
}

impl Event<'_> {
    pub fn new(node: Option<Vec<u8>>, id: EventID) -> Self {
        Event {
            node,
            id,
            body: IndexMap::with_capacity(5),
            container_info: None,
            is_filtered: false,
            is_exec: false,
            process_key: None,
        }
    }
}

pub(crate) type NVec = tinyvec::TinyVec<[u8; 14]>;