Raijin Database Engine

<Extension _json>
    Module        xm_json
</Extension>

<Input m1_uls_auth>
    Module        im_maculs
    UUIDTextPath  "/var/db/uuidtext"
    TimeSyncPath  "/var/db/diagnostics/timesync"
    TraceV3Path   "/var/db/diagnostics"
    <Exec>
#       Process only ssh or sudo events
        if $processImagePath == '/usr/bin/ssh'
        {
            $Process = 'ssh';
        }
        else if $processImagePath == '/usr/bin/sudo'
        {
            $Process = 'sudo';
        }
        else
        {
            drop();
        }
#       The "Retrieve Group by ID" event is of no value
        if $eventMessage == 'Retrieve Group by ID'  drop();

        $Hostname = hostname();
        $OS = 'macOS';
        $OSversion = '11.2.3';
        to_json();
    </Exec>
</Input>

<Output raijin1_auditdb_auth>
    Module        om_raijin
    URL           http://raijin-1.example.com:2500
    DBName        auditdb
    DBTable       auth
</Output>

{
  "eventMessage": "nw_connection_report_state_with_handler_on_nw_queue [C1] reporting state ready",
  "formatString": "%{public}s [C%u] reporting state %{public}s",
  "activityIdentifier": 0,
  "subsystem": "com.apple.network",
  "category": "connection",
  "threadID": 12580538,
  "senderImageUUID": "07ec53a0-293c-3403-8394-755ae0bddfa4",
  "bootUUID": "80243e89-2bee-44e5-b841-736299e7c5e3",
  "processImagePath": "/usr/bin/ssh",
  "senderImagePath": "/usr/lib/libnetwork.dylib",
  "EventTime": "2021-04-07T13:05:18.807648-05:00",
  "machTimestamp": 48909128392309,
  "messageType": "Default",
  "processImageUUID": "0a7536c1-ab16-31cc-a7c6-be89530f9e6c",
  "processID": 56919,
  "senderProgramCounter": 643704,
  "parentActivityIdentifier": 0,
  "TTL": 0,
  "EventReceivedTime": "2021-04-07T13:06:38.814108-05:00",
  "SourceModuleName": "m1_uls_auth",
  "SourceModuleType": "im_maculs",
  "Process": "ssh",
  "Hostname": "mm37",
  "OS": "macOS",
  "OSversion": "11.2.3"
}

<Extension _json>
    Module        xm_json
</Extension>

<Input var_log>
    Module        im_file
    File          '/var/log/*log'
    <Exec>
        parse_syslog();
#       Process only ssh or sudo events
        if $SourceName == 'sshd'
        {
            $Process = 'ssh';
        }
        else if $SourceName == 'sudo'
        {
            $Process = 'sudo';
        }
        else
        {
            drop();
        }
        $OS = 'Ubuntu';
        $OSversion = '20.04 LTS';
        to_json();
    </Exec>
</Input>

<Extension _resolver>
    Module        xm_resolver
</Extension>

<Input LinuxAudit_auth>
    Module        im_linuxaudit
    FlowControl   FALSE
    LoadRule      '/opt/nxlog/etc/im_linuxaudit_auth.rules'
    ResolveValues TRUE
    <Exec>
        # Process only ssh or sudo events
        if $key == 'ssh'
        {
            $Process = 'ssh';
        }
        else if $key == 'sudo'
        {
            $Process = 'sudo';
        }
        else
        {
            drop();
        }
        $OS = 'Ubuntu';
        $OSversion = '20.04 LTS';
        to_json();
    </Exec>
</Input>

<Output raijin1_auditdb_auth>
    Module        om_raijin
    URL           http://raijin-1.example.com:2500
    DBName        auditdb
    DBTable       auth
</Output>

## SSH
-w /etc/ssh/sshd_config -k ssh
-w /usr/bin/ssh -p x -k ssh

## sudo
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers -p rw -k sudo
-w /bin/su -p x -k sudo
-w /usr/bin/sudo -p x -k sudo

{
  "EventReceivedTime": "2021-04-07T17:43:42.144177+00:00",
  "SourceModuleName": "var_log",
  "SourceModuleType": "im_file",
  "SyslogFacilityValue": 1,
  "SyslogFacility": "USER",
  "SyslogSeverityValue": 5,
  "SyslogSeverity": "NOTICE",
  "SeverityValue": 2,
  "Severity": "INFO",
  "Hostname": "u20server-1",
  "EventTime": "2021-04-07T17:22:37.000000+00:00",
  "SourceName": "sshd",
  "ProcessID": "46325",
  "Message": "pam_unix(sshd:session): session closed for user root",
  "Process": "ssh",
  "OS": "Ubuntu",
  "OSversion": "20.04 LTS"
}

{
  "type": "CONFIG_CHANGE",
  "time": "2021-04-07T17:43:41.695000+00:00",
  "seq": 7036,
  "auid": "unset",
  "ses": "4294967295",
  "op": 0,
  "key": "ssh",
  "list": "4",
  "res": "1",
  "Hostname": "u20server-1",
  "EventReceivedTime": "2021-04-07T17:43:42.154010+00:00",
  "SourceModuleName": "LinuxAudit_auth",
  "SourceModuleType": "im_linuxaudit",
  "Process": "ssh",
  "OS": "Ubuntu",
  "OSversion": "20.04 LTS"
}

select "EventTime",
       "Hostname",
       "OS",
       "OSversion",
       "Process",
       CONCAT("eventMessage","Message") as "Message"
from auditdb.auth
order by "EventTime" desc
limit 30
offset 300;

{
  "EventTime": "2021-04-07T16:09:16.000000+00:00",
  "Hostname": "u20server-1",
  "OS": "Ubuntu",
  "OSversion": "20.04 LTS",
  "Process": "ssh",
  "Message": "pam_unix(sshd:session): session opened for user root by (uid=0)"
}
{
  "EventTime": "2021-04-07T16:09:16.000000+00:00",
  "Hostname": "u20server-1",
  "OS": "Ubuntu",
  "OSversion": "20.04 LTS",
  "Process": "ssh",
  "Message": "Accepted publickey for root from 192.168.1.7 port 40310 ssh2: RSA SHA256:hyxG8VslYTlmqxFedvCXQYIWRa8Bcl3uf30rmGiuC6c"
}
{
  "EventTime": "2021-04-07T16:03:12.000000+00:00",
  "Hostname": "u20server-1",
  "OS": "Ubuntu",
  "OSversion": "20.04 LTS",
  "Process": "ssh",
  "Message": "Disconnected from user root 192.168.1.7 port 40302"
}
{
  "EventTime": "2021-04-07T13:05:35.244269-05:00",
  "Hostname": "mm37",
  "OS": "macOS",
  "OSversion": "11.2.3",
  "Process": "sudo",
  "Message": "      jk : TTY=ttys000 ; PWD=/Users/jk ; USER=root ; COMMAND=/usr/bin/su - root"
}
{
  "EventTime": "2021-04-07T13:05:18.807659-05:00",
  "Hostname": "mm37",
  "OS": "macOS",
  "OSversion": "11.2.3",
  "Process": "ssh",
  "Message": "[C1.1 192.168.1.51:22 ready socket-flow (satisfied (Path is satisfied), viable, interface: en0, ipv4, ipv6, dns)] event: flow:changed_viability @0.003s"
}
{
  "EventTime": "2021-04-07T12:52:56.000000-05:00",
  "Hostname": "PN61",
  "OS": "Ubuntu",
  "OSversion": "20.04 LTS",
  "Process": "ssh",
  "Message": "Accepted password for jk from 192.168.1.160 port 63037 ssh2"
}

select "Process",
       count("Process") as "Event Count",
       "Hostname",
       "OS"
from auditdb.auth
where "Process" NotNull
group by "Process","Hostname","OS"
order by "Process","Event Count" desc,"Hostname","OS";

{
  "Process": "ssh",
  "Event Count": 567,
  "Hostname": "mm37",
  "OS": "macOS"
}
{
  "Process": "ssh",
  "Event Count": 119,
  "Hostname": "u20server-1",
  "OS": "Ubuntu"
}
{
  "Process": "ssh",
  "Event Count": 110,
  "Hostname": "PN61",
  "OS": "Ubuntu"
}
{
  "Process": "sudo",
  "Event Count": 564,
  "Hostname": "mm37",
  "OS": "macOS"
}
{
  "Process": "sudo",
  "Event Count": 113,
  "Hostname": "PN61",
  "OS": "Ubuntu"
}
{
  "Process": "sudo",
  "Event Count": 12,
  "Hostname": "u20server-1",
  "OS": "Ubuntu"
}