Add kernel module name and taint fields to load_module events

custom_documentation/doc/endpoint/process/linux/linux_process_load_module.md

@@ -65,6 +65,11 @@ This event is generated when when a process loads a kernel module.
 | orchestrator.resource.type |
 | process.Ext.ancestry |
 | process.Ext.command_line_truncated |
+| process.Ext.load_module.name |
+| process.Ext.load_module.src_version |
+| process.Ext.load_module.taint_flags |
+| process.Ext.load_module.taints |
+| process.Ext.load_module.version |
 | process.Ext.ptrace.addr |
 | process.Ext.ptrace.child_pid |
 | process.Ext.ptrace.data |

custom_documentation/src/endpoint/data_stream/process/linux/linux_process_load_module.yaml

@@ -69,6 +69,11 @@ fields:
   - orchestrator.resource.type
   - process.Ext.ancestry
   - process.Ext.command_line_truncated
+  - process.Ext.load_module.name
+  - process.Ext.load_module.src_version
+  - process.Ext.load_module.taint_flags
+  - process.Ext.load_module.taints
+  - process.Ext.load_module.version
   - process.Ext.ptrace.addr
   - process.Ext.ptrace.child_pid
   - process.Ext.ptrace.data

custom_schemas/custom_process.yml

@@ -197,6 +197,39 @@
       type: long
       description: ptrace data.
 
+    - name: Ext.load_module
+      level: custom
+      type: object
+      description: Object for kernel module load events.
+
+    - name: Ext.load_module.name
+      level: custom
+      type: keyword
+      example: "dummy"
+      description: Name of the kernel module.
+
+    - name: Ext.load_module.version
+      level: custom
+      type: keyword
+      description: Version of the kernel module, if the module declares one.
+
+    - name: Ext.load_module.src_version
+      level: custom
+      type: keyword
+      description: Source version checksum of the kernel module.
+
+    - name: Ext.load_module.taints
+      level: custom
+      type: long
+      example: "4096"
+      description: Bitmask of the taint flags this module sets on the kernel. Zero means the module does not taint the kernel.
+
+    - name: Ext.load_module.taint_flags
+      level: custom
+      type: keyword
+      example: "OE"
+      description: Kernel taint letters for this module, e.g. O for out-of-tree and E for unsigned. Only present when the module taints the kernel.
+
     - name: Ext.memfd
       level: custom
       type: object

custom_subsets/elastic_endpoint/process/process.yaml

@@ -175,6 +175,13 @@ fields:
               request: {}
               addr: {}
               data: {}
+          load_module:
+            fields:
+              name: {}
+              version: {}
+              src_version: {}
+              taints: {}
+              taint_flags: {}
           shmget:
             fields:
               key: {}

package/endpoint/changelog.yml

@@ -1,5 +1,8 @@
 - version: "9.5.0-next"
   changes:
+    - description: Add kernel module name and taint fields to Linux load_module events
+      type: enhancement
+      link: https://github.com/elastic/endpoint-package/pull/761
     - description: Add cross-cluster search source to the metadata_united transform for Elastic Defend remote Elasticsearch output support
       type: enhancement
       link: https://github.com/elastic/endpoint-package/pull/756

package/endpoint/data_stream/process/fields/fields.yml

@@ -902,6 +902,43 @@
       description: Process ID.
       example: 4242
       default_field: false
+    - name: Ext.load_module
+      level: custom
+      type: object
+      description: Object for kernel module load events.
+      default_field: false
+    - name: Ext.load_module.name
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: Name of the kernel module.
+      example: dummy
+      default_field: false
+    - name: Ext.load_module.src_version
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: Source version checksum of the kernel module.
+      default_field: false
+    - name: Ext.load_module.taint_flags
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: Kernel taint letters for this module, e.g. O for out-of-tree and E for unsigned. Only present when the module taints the kernel.
+      example: OE
+      default_field: false
+    - name: Ext.load_module.taints
+      level: custom
+      type: long
+      description: Bitmask of the taint flags this module sets on the kernel. Zero means the module does not taint the kernel.
+      example: 4096
+      default_field: false
+    - name: Ext.load_module.version
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: Version of the kernel module, if the module declares one.
+      default_field: false
     - name: Ext.memfd
       level: custom
       type: object

package/endpoint/data_stream/process/sample_event.json

@@ -138,6 +138,13 @@
             },
             "windows": {
                 "zone_identifier": 3
+            },
+            "load_module": {
+                "name": "dummy",
+                "version": "1.0",
+                "src_version": "541BA167DCA57C2B4F2D95D",
+                "taints": 12288,
+                "taint_flags": "OE"
             }
         },
         "parent": {

package/endpoint/docs/README.md

@@ -2409,6 +2409,12 @@ sent by the endpoint.
 | process.Ext.effective_parent.executable | Executable name for the effective process. | keyword |
 | process.Ext.effective_parent.name | Process name for the effective process. | keyword |
 | process.Ext.effective_parent.pid | Process ID. | long |
+| process.Ext.load_module | Object for kernel module load events. | object |
+| process.Ext.load_module.name | Name of the kernel module. | keyword |
+| process.Ext.load_module.src_version | Source version checksum of the kernel module. | keyword |
+| process.Ext.load_module.taint_flags | Kernel taint letters for this module, e.g. O for out-of-tree and E for unsigned. Only present when the module taints the kernel. | keyword |
+| process.Ext.load_module.taints | Bitmask of the taint flags this module sets on the kernel. Zero means the module does not taint the kernel. | long |
+| process.Ext.load_module.version | Version of the kernel module, if the module declares one. | keyword |
 | process.Ext.memfd | Object for memfd events. | object |
 | process.Ext.memfd.flag_allow_seal | Allow sealing operations on this file. | boolean |
 | process.Ext.memfd.flag_cloexec | Sets the the close-on-exec flag on the new file descriptor. | boolean |