Skip to content

feat: Add Linux/auditd pipeline#33

Merged
suryamajhi merged 3 commits intologpoint:mainfrom
vl43den:linux-pipeline
Mar 11, 2026
Merged

feat: Add Linux/auditd pipeline#33
suryamajhi merged 3 commits intologpoint:mainfrom
vl43den:linux-pipeline

Conversation

@vl43den
Copy link
Copy Markdown
Contributor

@vl43den vl43den commented Feb 28, 2026

Description

This PR adds a Linux pipeline for converting Sigma rules targeting Linux/auditd logs into Logpoint queries. This was split out from #27 per feedback to keep separation of concerns, now that #28 (pySigma v1.0.0 upgrade) has been merged (and many more enhancements of course). As this is touching only a fraction of volume, I'll be working on expanding logic and mapping to more sources!

New Features

  • logpoint_linux_pipeline with support for:
    • Linux auditd field mappings (type, proctitle, auid, exe, comm, etc.)
    • Generic Linux taxonomy (Image, CommandLine, ParentImage, etc.)
    • Snake_case conversion for unmapped fields

Files Changed

File Change
sigma/pipelines/logpoint/linux.py new Linux pipeline module
sigma/pipelines/logpoint/logpoint_mapping.py added logpoint_linux_auditd_mapping and logpoint_linux_common_taxonomy
sigma/pipelines/logpoint/__init__.py registered logpoint_linux pipeline
tests/test_pipelines_linux.py tests for auditd mapping, generic taxonomy, and snake_case

Testing

All existing tests pass + three new tests added:
test_logpoint_linux_auditd which validates auditd field mapping
test_logpoint_linux_generic which validates generic Linux taxonomy
test_logpoint_linux_snake_case which validates snake_case fallback for unmapped fields

@suryamajhi
Copy link
Copy Markdown
Contributor

suryamajhi commented Mar 4, 2026 •
edited
Loading

Hi @vl43den ,
Thank you for the contribution. We would love to have this pipeline introduced in our backend.
I have suggested couple of taxonomy changes based on the actual knowledge base of the Logpoint System. Please change them accordingly. Feel free correct the review if you have evidence of otherwise.
And also update README.md file by adding new pipeline.
We would love to see gradual expansion of linux event logs as well.

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
logpoint_linux_auditd_mapping = {
"type": "event_type",
"proctitle": "command",
"auid": "user_id",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

auid -> audit_user_id

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"gid": "group_id",
"euid": "effective_user_id",
"egid": "effective_group_id",
"fsuid": "filesystem_user_id",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fsuid -> file_system_user_id

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"egid": "effective_group_id",
"fsuid": "filesystem_user_id",
"fsgid": "filesystem_group_id",
"suid": "saved_user_id",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suid -> set_user_id

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"fsuid": "filesystem_user_id",
"fsgid": "filesystem_group_id",
"suid": "saved_user_id",
"sgid": "saved_group_id",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sgid -> set_group_id

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"pid": "process_id",
"ppid": "parent_process_id",
"ses": "session_id",
"comm": "command_name",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

comm -> command

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"ppid": "parent_process_id",
"ses": "session_id",
"comm": "command_name",
"exe": "process",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

exe -> path

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"exe": "process",
"key": "key",
"cwd": "path",
"name": "file",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

name -> path

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"key": "key",
"cwd": "path",
"name": "file",
"nametype": "file_type",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nametype -> path_type

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"cwd": "path",
"name": "file",
"nametype": "file_type",
"addr": "address",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

addr -> source_address

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"name": "file",
"nametype": "file_type",
"addr": "address",
"hostname": "host",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hostname -> hostname

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"addr": "address",
"hostname": "host",
"terminal": "terminal",
"res": "result",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

res -> status

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"terminal": "terminal",
"res": "result",
"msg": "message",
"acct": "account",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

acct -> user

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
sigma/pipelines/logpoint/logpoint_mapping.py Outdated
"hostname": "host",
"terminal": "terminal",
"res": "result",
"msg": "message",
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove this mapping

suryamajhi
suryamajhi reviewed Mar 4, 2026
View reviewed changes
@vl43den
Copy link
Copy Markdown
Contributor Author

vl43den commented Mar 7, 2026

@suryamajhi Hi, thank you for the detailed feedback! I have adapted all the mapping fields and the taxonomy according to your input. I also added the new linux pipeline to the README.md - as requested. If anything else pops into your mind or if any adjustments are needed, just let me know & we're going to fix it quickly!

suryamajhi
suryamajhi approved these changes Mar 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@suryamajhi suryamajhi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@suryamajhi suryamajhi merged commit 4bb77e7 into logpoint:main Mar 11, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@suryamajhi suryamajhi suryamajhi approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vl43den @suryamajhi