[METRON-393] Create a parser for Linux Audit (auditd)

• Type: New Feature
• Status: To Do
• Priority: Major
• Resolution: Unresolved
• Labels: ParserExtension platform
• Assignee: Unassigned
• Reporter: Yohann
• Created: 25/Aug/16 12:05
• Updated: 25/Aug/16 12:05

Description

Creating a parser for the Linux Audit system (auditd) which provides a way to track security-relevant information on a system. Based on pre-configured rules, Audit generates log entries to record as much information about the events that are happening on a system as possible.

Full description of the log format:

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html
• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Audit_Record_Types.html