Merge pull request #681 from mozilla/strace_audit_custom

Consolidated ptrace/strace events into custom alert

alerts/trace_audit.conf

@@ -0,0 +1,2 @@
+[options]
+hostfilter = example.hostname.com

alerts/trace_audit.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2014 Mozilla Corporation
+#
+# This code alerts on every successfully opened session on any of the host from a given list
+
+from lib.alerttask import AlertTask
+from query_models import SearchQuery, TermMatch, QueryStringMatch, PhraseMatch
+
+
+class TraceAudit(AlertTask):
+    def main(self):
+        self.parse_config('trace_audit.conf', ['hostfilter'])
+        search_query = SearchQuery(minutes=5)
+
+        search_query.add_must([
+            TermMatch('details.processname', 'strace'),
+        ])
+
+        for host in self.config.hostfilter.split():
+            search_query.add_must_not(PhraseMatch('hostname', host ))
+
+        self.filtersManual(search_query)
+        self.searchEventsAggregated('details.originaluser', samplesLimit=10)
+        self.walkAggregations(threshold=1)
+
+    def onAggregation(self, aggreg):
+        category = 'trace'
+        severity = 'WARNING'
+        tags = ['audit']
+
+        summary = ('{0} instances of Strace or Ptrace excuted on a system by {1}'.format(aggreg['count'], aggreg['value'], ))
+        hostnames = self.mostCommon(aggreg['allevents'],'_source.hostname')
+        #did they modify more than one host?
+        #or just modify an existing configuration more than once?
+        if len(hostnames) > 1:
+            for i in hostnames[:5]:
+                summary += ' on {0} ({1} hosts)'.format(i[0], i[1])
+
+        return self.createAlertDict(summary, category, tags, aggreg['events'], severity)

tests/alerts/test_trace_audit.py

@@ -0,0 +1,103 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2017 Mozilla Corporation
+
+from positive_alert_test_case import PositiveAlertTestCase
+from negative_alert_test_case import NegativeAlertTestCase
+
+from alert_test_suite import AlertTestSuite
+
+
+class TestTraceAudit(AlertTestSuite):
+    alert_filename = "trace_audit"
+    alert_classname = 'TraceAudit'
+
+    # This event is the default positive event that will cause the
+    # alert to trigger
+    default_event = {
+        "_source": {
+            "category": "ptrace",
+            "summary": "Ptrace",
+            "hostname": "exhostname",
+            "tags": ["audisp-json","2.1.0", "audit"],
+            "details": {
+                "processname": "strace",
+                "originaluser": "randomjoe",
+                "auditkey": "strace",
+            }
+        }
+    }
+
+    # This alert is the expected result from running this task
+    default_alert = {
+        "category": "trace",
+        "severity": "WARNING",
+        "summary": "5 instances of Strace or Ptrace excuted on a system by randomjoe",
+        "tags": ['audit'],
+        "notify_mozdefbot": True,
+    }
+
+    test_cases = []
+
+    test_cases.append(
+        PositiveAlertTestCase(
+            description="Positive test with default event and default alert expected",
+            events=AlertTestSuite.create_events(default_event, 5),
+            expected_alert=default_alert
+        )
+    )
+
+    events = AlertTestSuite.create_events(default_event, 5)
+    for event in events:
+        event['_source']['summary'] = 'Unknown'
+    test_cases.append(
+        PositiveAlertTestCase(
+            description="Positive test with events with a summary of 'Write: /etc/audit/rules.d/'",
+            events=events,
+            expected_alert=default_alert
+        )
+    )
+
+    events = AlertTestSuite.create_events(default_event, 5)
+    for event in events:
+        event['_source']['utctimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 1})
+        event['_source']['receivedtimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 1})
+    test_cases.append(
+        PositiveAlertTestCase(
+            description="Positive test with events a minute earlier",
+            events=events,
+            expected_alert=default_alert
+        )
+    )
+
+    events = AlertTestSuite.create_events(default_event, 5)
+    for event in events:
+        event['_source']['hostname'] = 'example.hostname.com'
+    test_cases.append(
+        NegativeAlertTestCase(
+            description="Negative test case with events with example hostname that matches exclusion of 'hostfilter'",
+            events=events,
+        )
+    )
+
+    events = AlertTestSuite.create_events(default_event, 5)
+    for event in events:
+        event['_source']['details']['originaluser'] = None
+    test_cases.append(
+        NegativeAlertTestCase(
+            description="Negative test case aggregation key excluded",
+            events=events,
+        )
+    )
+
+    events = AlertTestSuite.create_events(default_event, 5)
+    for event in events:
+        event['_source']['utctimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda({'minutes': 15})
+        event['_source']['receivedtimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda({'minutes': 15})
+    test_cases.append(
+        NegativeAlertTestCase(
+            description="Negative test case with old timestamp",
+            events=events,
+        )
+)