topic Re: Aggregate auditd events in Getting Data In

Aggregate auditd events

bosseres — Mon, 02 Oct 2023 09:09:01 GMT

Hello everyone!

Do anybody know, is it possible to aggregate (bind) auditd events (I mean logs from audit/audit.log) in one by Record ID (Event ID)? I want to make in on parsing study, and to get in my index already aggregated events in one.

Re: Aggregate auditd events

gcusello — Mon, 02 Oct 2023 09:14:03 GMT

Hi @bosseres,

usually logs are indexed as they are.

Then you can display them aggregated as you like or detailed for each event.

Could you betetr describe your requirement?

Ciao.

Giuseppe

Re: Aggregate auditd events

bosseres — Mon, 02 Oct 2023 09:37:00 GMT

you are right, I can aggregate them, but problem that I have many searches where I need make the same one aggregation, it requires a lot of resources

is it any options to aggregate them before searching?

maybe any already ready solutions for auditd logs?

Re: Aggregate auditd events

gcusello — Mon, 02 Oct 2023 09:52:01 GMT

Hi @bosseres,

my hint is to create a scheduled search that aggregates logs asaving results in a summary index.

Then you can use this aggregated summary index for your searches.

Ciao.

Giuseppe