Hello,
I have been using the Linux Auditd app, which has been great, but I noticed that the learnt_posix_identities lookup filters out the root user.
[|inputlookup auditd_indices] [|inputlookup auditd_sourcetypes] type="USER_START" acct=* NOT acct=root NOT auid=0 terminal=/dev/tty* OR NOT addr=? | dedup auid | table auid acct | rename auid as _key | rename acct as user | outputlookup append=true learnt_posix_identities
A lot of my syscalls are coming from root and the dashboards display unknown user. I could just manually edit the KV Store to add root, however I wanted to understand why this filter was here to make sure I don't break something.
Regards,
Dave
The root user is the only truly universal user on any Linux machine so it's not in the learnt identities but the static identities lookup (https://github.com/doksu/splunk_auditd/blob/master/TA-linux_auditd/lookups/posix_identities.csv), and they get merged together automatically. Best check your static identities lookup to ensure it has root in it.