Auditd plugin that forwards audit events to OMS Agent for Linux
Перейти к файлу
Tad Glines 036a478738 Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
build Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
conf/outconf.d Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
installer Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
.gitignore Add containerid to AUOMS_EXECVE recordtype events (#41) 2020-01-08 14:34:01 -08:00
AuditRules.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
AuditRules.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
AuditRulesMonitor.cpp Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
AuditRulesMonitor.h Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
AuditStatus.cpp Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
AuditStatus.h Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
CMakeLists.txt Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
Cache.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
CollectionMonitor.cpp Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
CollectionMonitor.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
Config.cpp Feature v1.2 2018-03-20 18:04:05 -07:00
Config.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
ConfigTests.cpp Initial code commit 2016-11-18 12:02:01 -08:00
Defer.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Event.cpp Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
Event.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
EventFilter.cpp Patched so outputs can be added and removed and ProcessTree and GLobalFiltersMask are updated each time (#40) 2020-01-07 11:42:41 -08:00
EventFilter.h Patched so outputs can be added and removed and ProcessTree and GLobalFiltersMask are updated each time (#40) 2020-01-07 11:42:41 -08:00
EventId.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
EventProcessorTests.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
EventQueue.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
EventTests.cpp Fix build and improve syscall metrics init 2019-11-22 11:05:09 -08:00
ExecUtil.cpp Eliminate compiler warnings minor build tweak. (#33) 2019-07-25 14:16:49 -07:00
ExecUtil.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
ExecveConverter.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
ExecveConverter.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
ExecveConverterTests.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
FieldType.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
FileUtils.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
FileUtils.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
FileWatcher.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
FileWatcher.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
FiltersEngine.cpp Patched so outputs can be added and removed and ProcessTree and GLobalFiltersMask are updated each time (#40) 2020-01-07 11:42:41 -08:00
FiltersEngine.h Patched so outputs can be added and removed and ProcessTree and GLobalFiltersMask are updated each time (#40) 2020-01-07 11:42:41 -08:00
Gate.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
IEventFilter.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
IEventReader.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
IEventWriter.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
IO.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
IO.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Input.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
Input.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
InputBuffer.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Inputs.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Inputs.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Interpret.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
Interpret.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
JSONEventWriter.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
JSONEventWriter.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
KernelInfo.cpp Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
KernelInfo.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
LICENSE Initial code commit 2016-11-18 12:02:01 -08:00
Logger.cpp Initial code commit 2016-11-18 12:02:01 -08:00
Logger.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
MachineType.h Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
Metrics.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Metrics.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
MsgPackEventWriter.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
MsgPackEventWriter.h Added support for receiver ack to control cursor 2017-09-29 16:25:45 -07:00
Netlink.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Netlink.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
NetlinkAudit.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
OMSEventWriter.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
OMSEventWriter.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
OMSEventWriterTests.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
OperationalStatus.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
OperationalStatus.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Output.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Output.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Outputs.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Outputs.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
ProcFilter.cpp Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
ProcFilter.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
ProcMetrics.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
ProcMetrics.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
ProcessDefines.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
ProcessInfo.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
ProcessInfo.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
ProcessTree.cpp Add containerid to AUOMS_EXECVE recordtype events (#41) 2020-01-08 14:34:01 -08:00
ProcessTree.h Add containerid to AUOMS_EXECVE recordtype events (#41) 2020-01-08 14:34:01 -08:00
Queue.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Queue.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
QueueTests.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
README.md Update README.md 2019-08-07 07:42:05 -07:00
RawEventAccumulator.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RawEventAccumulator.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RawEventProcessor.cpp Fixed event blocking (#42) 2020-02-17 16:43:45 +00:00
RawEventProcessor.h Patched so outputs can be added and removed and ProcessTree and GLobalFiltersMask are updated each time (#40) 2020-01-07 11:42:41 -08:00
RawEventReader.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RawEventRecord.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RawEventRecord.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RawEventWriter.h Added support for receiver ack to control cursor 2017-09-29 16:25:45 -07:00
RecordType.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Retry.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RunBase.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
RunBase.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Signals.cpp Improve rule parsing, fix bugs (#28) 2019-05-09 13:34:17 -07:00
Signals.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
StdinReader.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
StdinReader.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
StdoutWriter.h Added support for receiver ack to control cursor 2017-09-29 16:25:45 -07:00
StringConstants.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
StringTable.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
StringTests.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
StringUtils.cpp Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
StringUtils.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
SyscallMetrics.cpp Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
SyscallMetrics.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
SyslogEventWriter.cpp Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
SyslogEventWriter.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
SystemMetrics.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
SystemMetrics.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
THIRD_PARTY_IP_NOTICE Rework plugin to support multi-home configuration 2017-05-22 04:13:32 -07:00
TempDir.cpp Eliminate compiler warnings minor build tweak. (#33) 2019-07-25 14:16:49 -07:00
TempDir.h Initial code commit 2016-11-18 12:02:01 -08:00
TempFile.cpp Eliminate compiler warnings minor build tweak. (#33) 2019-07-25 14:16:49 -07:00
TempFile.h Initial code commit 2016-11-18 12:02:01 -08:00
TestEventData.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
TestEventData.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
TestEventQueue.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
TextEventWriter.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
TextEventWriter.h Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
TextEventWriterConfig.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
TextEventWriterConfig.h Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
Translate.h Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
TranslateArch.cpp Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
TranslateErrno.cpp Improve rule parsing, fix bugs (#28) 2019-05-09 13:34:17 -07:00
TranslateField.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
TranslateFieldType.cpp Kesheldr syscall filter ng (#38) 2019-10-07 15:58:47 +01:00
TranslateRecordType.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
TranslateSyscall.cpp Bug fixes and add support for arm64 (#35) 2019-08-07 07:20:30 -07:00
UnixDomainListener.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
UnixDomainListener.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
UnixDomainWriter.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
UnixDomainWriter.h Added support for receiver ack to control cursor 2017-09-29 16:25:45 -07:00
UserDB.cpp Improve rule parsing, fix bugs (#28) 2019-05-09 13:34:17 -07:00
UserDB.h Improve rule parsing, fix bugs (#28) 2019-05-09 13:34:17 -07:00
UserDBTests.cpp Initial code commit 2016-11-18 12:02:01 -08:00
Version.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
Version.h Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
auoms.cpp Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
auoms.version Bump version 2020-02-18 10:18:55 -08:00
auomscollect.cpp Add metrics collection and other changes (#36) 2019-11-21 14:55:06 -08:00
auomsctl.cpp Add setting of backlog_wait_time. 2020-03-03 12:46:54 -08:00
fakeaudispd.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
file2sock.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00
testreceiver.cpp Feature 3.0 (#27) 2019-04-30 12:06:02 -07:00

README.md

OMS-Auditd-Plugin

Auditd plugin that forwards audit events to OMS Agent for Linux

Build Instructions

Env Setup

git clone https://github.com/Microsoft/pal
git clone https://github.com/microsoft/OMS-Auditd-Plugin
cd OMS-Auditd-Plugin
ROOT=$(pwd)

Build Docker images

cd build/docker
docker build -t auoms-build auoms-build
docker build -t auoms-build32 auoms-build32
cd $ROOT

Build 64bit auoms

build/run-docker-build.sh

Build 32bit auoms

build/run-docker-build.sh 32