From 69950cd55edfae6d03539bb24ea5a4d6da681806 Mon Sep 17 00:00:00 2001 From: Sam Crauwels Date: Wed, 1 Apr 2026 20:51:23 +0200 Subject: [PATCH] [New Package] Add FreeIPA integration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a comprehensive FreeIPA integration with five log data streams covering all major FreeIPA services: kdc — Kerberos KDC authentication events (TGS/TGT grants, failures, S4U proxy, pre-auth, encryption types) directory_access — 389 Directory Server access log (BIND, SEARCH, MOD, ADD, DELETE, MODRDN with connection tracking) directory_errors — 389 DS error log (replication failures, plugin errors, resource warnings) ca_audit — Dogtag CA signed audit log (certificate requests, approvals, revocations, CRL generation, ACL decisions) ipa_api — IPA JSON/XML-RPC API access log (commands, parameters, results, caller identity) Includes two transforms for connection-level LDAP analysis (latest bind state and operation enrichment), GeoIP enrichment on client IPs, ECS-compliant field mappings, and pipeline tests with both synthetic and real-world log samples from a multi-replica FreeIPA deployment. --- packages/freeipa/_dev/build/build.yml | 1 + packages/freeipa/_dev/build/docs/README.md | 221 +++ .../_dev/deploy/docker/docker-compose.yml | 14 + .../_dev/deploy/docker/sample_logs/access | 200 +++ .../_dev/deploy/docker/sample_logs/ca_audit | 50 + .../_dev/deploy/docker/sample_logs/error_log | 50 + .../_dev/deploy/docker/sample_logs/errors | 50 + .../deploy/docker/sample_logs/krb5kdc.log | 50 + packages/freeipa/changelog.yml | 5 + .../_dev/test/pipeline/test-default.json | 82 + .../pipeline/test-default.json-config.yml | 2 + .../pipeline/test-default.json-expected.json | 1209 ++++++++++++++ .../_dev/test/pipeline/test-real-logs.json | 64 + .../pipeline/test-real-logs.json-config.yml | 2 + .../test-real-logs.json-expected.json | 1254 +++++++++++++++ .../_dev/test/system/test-default-config.yml | 5 + .../ca_audit/agent/stream/stream.yml.hbs | 16 + .../elasticsearch/ingest_pipeline/default.yml | 445 ++++++ .../ca_audit/fields/base-fields.yml | 20 + .../data_stream/ca_audit/fields/ecs.yml | 102 ++ .../data_stream/ca_audit/fields/fields.yml | 64 + .../freeipa/data_stream/ca_audit/manifest.yml | 37 + .../data_stream/ca_audit/sample_event.json | 102 ++ .../_dev/test/pipeline/test-default.json | 88 + .../pipeline/test-default.json-config.yml | 2 + .../pipeline/test-default.json-expected.json | 997 ++++++++++++ .../_dev/test/pipeline/test-real-logs.json | 94 ++ .../pipeline/test-real-logs.json-config.yml | 2 + .../test-real-logs.json-expected.json | 1111 +++++++++++++ .../_dev/test/system/test-default-config.yml | 5 + .../agent/stream/stream.yml.hbs | 16 + .../elasticsearch/ingest_pipeline/default.yml | 516 ++++++ .../directory_access/fields/base-fields.yml | 20 + .../directory_access/fields/ecs.yml | 120 ++ .../directory_access/fields/fields.yml | 73 + .../data_stream/directory_access/manifest.yml | 37 + .../directory_access/sample_event.json | 75 + .../_dev/test/pipeline/test-default.json | 28 + .../pipeline/test-default.json-config.yml | 3 + .../pipeline/test-default.json-expected.json | 292 ++++ .../_dev/test/pipeline/test-real-logs.json | 49 + .../pipeline/test-real-logs.json-config.yml | 3 + .../test-real-logs.json-expected.json | 500 ++++++ .../_dev/test/system/test-default-config.yml | 5 + .../agent/stream/stream.yml.hbs | 16 + .../elasticsearch/ingest_pipeline/default.yml | 187 +++ .../directory_errors/fields/base-fields.yml | 20 + .../directory_errors/fields/ecs.yml | 51 + .../directory_errors/fields/fields.yml | 19 + .../data_stream/directory_errors/manifest.yml | 37 + .../directory_errors/sample_event.json | 65 + .../_dev/test/pipeline/test-default.json | 58 + .../pipeline/test-default.json-config.yml | 2 + .../pipeline/test-default.json-expected.json | 1412 +++++++++++++++++ .../_dev/test/system/test-default-config.yml | 5 + .../ipa_api/agent/stream/stream.yml.hbs | 20 + .../elasticsearch/ingest_pipeline/default.yml | 344 ++++ .../ipa_api/fields/base-fields.yml | 20 + .../data_stream/ipa_api/fields/ecs.yml | 132 ++ .../data_stream/ipa_api/fields/fields.yml | 19 + .../freeipa/data_stream/ipa_api/manifest.yml | 37 + .../data_stream/ipa_api/sample_event.json | 112 ++ .../kdc/_dev/test/pipeline/test-default.json | 37 + .../pipeline/test-default.json-config.yml | 2 + .../pipeline/test-default.json-expected.json | 731 +++++++++ .../_dev/test/pipeline/test-real-logs.json | 64 + .../pipeline/test-real-logs.json-config.yml | 5 + .../test-real-logs.json-expected.json | 600 +++++++ .../_dev/test/system/test-default-config.yml | 5 + .../kdc/agent/stream/stream.yml.hbs | 20 + .../elasticsearch/ingest_pipeline/default.yml | 349 ++++ .../data_stream/kdc/fields/base-fields.yml | 20 + .../freeipa/data_stream/kdc/fields/ecs.yml | 120 ++ .../freeipa/data_stream/kdc/fields/fields.yml | 31 + packages/freeipa/data_stream/kdc/manifest.yml | 37 + .../freeipa/data_stream/kdc/sample_event.json | 98 ++ packages/freeipa/docs/README.md | 974 ++++++++++++ .../transform/latest_auth/fields/ecs.yml | 15 + .../transform/latest_auth/fields/fields.yml | 15 + .../transform/latest_auth/manifest.yml | 19 + .../transform/latest_auth/transform.yml | 46 + .../transform/latest_bind/fields/ecs.yml | 15 + .../transform/latest_bind/fields/fields.yml | 15 + .../transform/latest_bind/manifest.yml | 19 + .../transform/latest_bind/transform.yml | 44 + .../latest_connection/fields/ecs.yml | 15 + .../latest_connection/fields/fields.yml | 9 + .../transform/latest_connection/manifest.yml | 19 + .../transform/latest_connection/transform.yml | 44 + packages/freeipa/img/logo.svg | 1 + .../freeipa-api-error-spike.json | 28 + .../freeipa-ca-connection-failures.json | 28 + .../freeipa-ldap-high-latency.json | 28 + .../freeipa-replication-errors.json | 28 + .../freeipa-unindexed-searches.json | 28 + packages/freeipa/manifest.yml | 38 + 96 files changed, 14184 insertions(+) create mode 100644 packages/freeipa/_dev/build/build.yml create mode 100644 packages/freeipa/_dev/build/docs/README.md create mode 100644 packages/freeipa/_dev/deploy/docker/docker-compose.yml create mode 100644 packages/freeipa/_dev/deploy/docker/sample_logs/access create mode 100644 packages/freeipa/_dev/deploy/docker/sample_logs/ca_audit create mode 100644 packages/freeipa/_dev/deploy/docker/sample_logs/error_log create mode 100644 packages/freeipa/_dev/deploy/docker/sample_logs/errors create mode 100644 packages/freeipa/_dev/deploy/docker/sample_logs/krb5kdc.log create mode 100644 packages/freeipa/changelog.yml create mode 100644 packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json create mode 100644 packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-config.yml create mode 100644 packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-expected.json create mode 100644 packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json create mode 100644 packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-config.yml create mode 100644 packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-expected.json create mode 100644 packages/freeipa/data_stream/ca_audit/_dev/test/system/test-default-config.yml create mode 100644 packages/freeipa/data_stream/ca_audit/agent/stream/stream.yml.hbs create mode 100644 packages/freeipa/data_stream/ca_audit/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/freeipa/data_stream/ca_audit/fields/base-fields.yml create mode 100644 packages/freeipa/data_stream/ca_audit/fields/ecs.yml create mode 100644 packages/freeipa/data_stream/ca_audit/fields/fields.yml create mode 100644 packages/freeipa/data_stream/ca_audit/manifest.yml create mode 100644 packages/freeipa/data_stream/ca_audit/sample_event.json create mode 100644 packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json create mode 100644 packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-config.yml create mode 100644 packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-expected.json create mode 100644 packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json create mode 100644 packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-config.yml create mode 100644 packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-expected.json create mode 100644 packages/freeipa/data_stream/directory_access/_dev/test/system/test-default-config.yml create mode 100644 packages/freeipa/data_stream/directory_access/agent/stream/stream.yml.hbs create mode 100644 packages/freeipa/data_stream/directory_access/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/freeipa/data_stream/directory_access/fields/base-fields.yml create mode 100644 packages/freeipa/data_stream/directory_access/fields/ecs.yml create mode 100644 packages/freeipa/data_stream/directory_access/fields/fields.yml create mode 100644 packages/freeipa/data_stream/directory_access/manifest.yml create mode 100644 packages/freeipa/data_stream/directory_access/sample_event.json create mode 100644 packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json create mode 100644 packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-config.yml create mode 100644 packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-expected.json create mode 100644 packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json create mode 100644 packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-config.yml create mode 100644 packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-expected.json create mode 100644 packages/freeipa/data_stream/directory_errors/_dev/test/system/test-default-config.yml create mode 100644 packages/freeipa/data_stream/directory_errors/agent/stream/stream.yml.hbs create mode 100644 packages/freeipa/data_stream/directory_errors/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/freeipa/data_stream/directory_errors/fields/base-fields.yml create mode 100644 packages/freeipa/data_stream/directory_errors/fields/ecs.yml create mode 100644 packages/freeipa/data_stream/directory_errors/fields/fields.yml create mode 100644 packages/freeipa/data_stream/directory_errors/manifest.yml create mode 100644 packages/freeipa/data_stream/directory_errors/sample_event.json create mode 100644 packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json create mode 100644 packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-config.yml create mode 100644 packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-expected.json create mode 100644 packages/freeipa/data_stream/ipa_api/_dev/test/system/test-default-config.yml create mode 100644 packages/freeipa/data_stream/ipa_api/agent/stream/stream.yml.hbs create mode 100644 packages/freeipa/data_stream/ipa_api/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/freeipa/data_stream/ipa_api/fields/base-fields.yml create mode 100644 packages/freeipa/data_stream/ipa_api/fields/ecs.yml create mode 100644 packages/freeipa/data_stream/ipa_api/fields/fields.yml create mode 100644 packages/freeipa/data_stream/ipa_api/manifest.yml create mode 100644 packages/freeipa/data_stream/ipa_api/sample_event.json create mode 100644 packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json create mode 100644 packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-config.yml create mode 100644 packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-expected.json create mode 100644 packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json create mode 100644 packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-config.yml create mode 100644 packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-expected.json create mode 100644 packages/freeipa/data_stream/kdc/_dev/test/system/test-default-config.yml create mode 100644 packages/freeipa/data_stream/kdc/agent/stream/stream.yml.hbs create mode 100644 packages/freeipa/data_stream/kdc/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/freeipa/data_stream/kdc/fields/base-fields.yml create mode 100644 packages/freeipa/data_stream/kdc/fields/ecs.yml create mode 100644 packages/freeipa/data_stream/kdc/fields/fields.yml create mode 100644 packages/freeipa/data_stream/kdc/manifest.yml create mode 100644 packages/freeipa/data_stream/kdc/sample_event.json create mode 100644 packages/freeipa/docs/README.md create mode 100644 packages/freeipa/elasticsearch/transform/latest_auth/fields/ecs.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_auth/fields/fields.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_auth/manifest.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_auth/transform.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_bind/fields/ecs.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_bind/fields/fields.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_bind/manifest.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_bind/transform.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_connection/fields/ecs.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_connection/fields/fields.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_connection/manifest.yml create mode 100644 packages/freeipa/elasticsearch/transform/latest_connection/transform.yml create mode 100644 packages/freeipa/img/logo.svg create mode 100644 packages/freeipa/kibana/alerting_rule_template/freeipa-api-error-spike.json create mode 100644 packages/freeipa/kibana/alerting_rule_template/freeipa-ca-connection-failures.json create mode 100644 packages/freeipa/kibana/alerting_rule_template/freeipa-ldap-high-latency.json create mode 100644 packages/freeipa/kibana/alerting_rule_template/freeipa-replication-errors.json create mode 100644 packages/freeipa/kibana/alerting_rule_template/freeipa-unindexed-searches.json create mode 100644 packages/freeipa/manifest.yml diff --git a/packages/freeipa/_dev/build/build.yml b/packages/freeipa/_dev/build/build.yml new file mode 100644 index 00000000000..c093387ce07 --- /dev/null +++ b/packages/freeipa/_dev/build/build.yml @@ -0,0 +1 @@ +dependencies: {} diff --git a/packages/freeipa/_dev/build/docs/README.md b/packages/freeipa/_dev/build/docs/README.md new file mode 100644 index 00000000000..a66083cd8a3 --- /dev/null +++ b/packages/freeipa/_dev/build/docs/README.md @@ -0,0 +1,221 @@ +# FreeIPA Integration + +This integration collects security-relevant logs from FreeIPA (Red Hat IdM) identity management servers. It parses authentication events from the Kerberos KDC, LDAP operations from 389 Directory Server, PKI certificate lifecycle events from Dogtag CA, and high-level IAM operations from the FreeIPA JSON API. All data streams use filestream input to read log files directly from the server. + +## Compatibility + +Tested with FreeIPA 4.11 on Rocky Linux 9 and RHEL 9. Should work with FreeIPA 4.6 and later on any supported platform (RHEL 7+, CentOS, Rocky, Alma, Fedora). Red Hat IdM is the same software and produces the same log formats. + +## Setup + +Deploy one Elastic Agent per FreeIPA server. The agent reads log files directly, so it needs to run on the same host (or have the log directories mounted). + +### File permissions + +The Elastic Agent process needs read access to these log files: + +| Log file | Default owner | Notes | +|----------|---------------|-------| +| `/var/log/krb5kdc.log` | root:root | Readable by root only by default | +| `/var/log/dirsrv/slapd-*/access` | dirsrv:dirsrv | | +| `/var/log/dirsrv/slapd-*/errors` | dirsrv:dirsrv | | +| `/var/log/pki/pki-tomcat/ca/signedAudit/ca_audit` | pkiuser:pkiuser | Only on CA replicas | +| `/var/log/httpd/error_log` | root:root | | + + +Add the `elastic-agent` user to the `dirsrv` and `pkiuser` groups, or use ACLs: + +```bash +setfacl -m u:elastic-agent:r /var/log/krb5kdc.log +setfacl -m u:elastic-agent:rx /var/log/dirsrv/slapd-* +setfacl -m u:elastic-agent:r /var/log/dirsrv/slapd-*/access +setfacl -m u:elastic-agent:r /var/log/dirsrv/slapd-*/errors +setfacl -m u:elastic-agent:rx /var/log/pki/pki-tomcat/ca/signedAudit +setfacl -m u:elastic-agent:r /var/log/pki/pki-tomcat/ca/signedAudit/ca_audit +setfacl -m u:elastic-agent:r /var/log/httpd/error_log +``` + +### Logging configuration + +FreeIPA enables most logging by default. Verify these settings are in place: + + +**KDC logging** (krb5.conf): +```ini +[logging] + kdc = FILE:/var/log/krb5kdc.log + admin_server = FILE:/var/log/kadmind.log +``` + +**389ds access logging** (enabled by default, verify with the following command): +```bash +dsconf slapd-YOUR-REALM config get nsslapd-accesslog-logging-enabled +``` + +**IPA API logging** (default.conf): + +No configuration required. API operations are logged at INFO level regardless of the `debug` setting. The `debug = True` option adds startup DEBUG messages (~700 lines per httpd restart) but does not affect API operation logging. + + +### Elastic Agent configuration + +1. In Kibana, go to **Integrations** and search for "FreeIPA". +2. Add the integration and review the default log file paths for each data stream. +3. If your FreeIPA instance name differs from the default, update the 389ds log paths (replace `LAB-LOCAL` with your realm name, dots replaced by dashes). +4. Enable **Preserve Original Event** if you want the raw log line stored in `event.original`. +5. Deploy the policy to an Elastic Agent running on each FreeIPA server. + +## Transforms + +The integration includes optional transforms that enable cross-event correlation for advanced detection rules. + +### latest_bind + +Maintains a real-time lookup table mapping each LDAP `connection_id` to the authenticated `bind_dn` and `bind_method` from the corresponding BIND event. This enables detection rules to identify WHO performed an LDAP operation by joining RESULT or SRCH events with the bind context. + +**Enables:** Anonymous LDAP enumeration detection, credential attribute search attribution, non-service account enumeration detection, sensitive DN modification attribution, LDAP configuration change attribution. + +**Destination index:** `logs-freeipa_latest.dest_bind-1` (lookup mode, compatible with ES|QL LOOKUP JOIN). + +**Refresh:** Every 30 seconds. **Retention:** 7 days. + +### latest_connection + +Maintains a lookup of connection metadata mapping each `connection_id` to `source.ip`, `destination.ip`, and SSL status. Enables correlation of LDAP operations with their network origin. + +**Destination index:** `logs-freeipa_latest.dest_connection-1` (lookup mode). + +**Refresh:** Every 30 seconds. **Retention:** 7 days. + +### latest_auth + +Tracks the most recent Kerberos authentication (TGT grant or failure) per `(client_principal, source_ip)` pair. Used by detection rules to identify authentication from new or unusual source IPs for known principals. + +**Destination index:** `logs-freeipa_latest.dest_auth-1` (lookup mode). + +**Refresh:** Every 30 seconds. **Retention:** 30 days. + +### Activating transforms + +Transforms are installed in a stopped state. The `kibana_system` user that Fleet uses to manage transforms does not have privileges on custom integration indices, so the transforms need to be started by a user with the right access. + +The simplest approach is to run the update and start calls as a superuser (the `elastic` admin account or equivalent): + +``` +POST /_transform/logs-freeipa.latest_bind-default-/_update +{} + +POST /_transform/logs-freeipa.latest_bind-default-/_start +``` + +The empty `_update` call reassigns the transform's stored credentials to the calling user. Repeat for `latest_connection` and `latest_auth`. Replace `` with the installed package version (for example, `0.1.0`). + +For environments where using the admin account is not appropriate, create a dedicated role with read access to the source indices and write access to the destination indices: + +``` +PUT /_security/role/freeipa_transform +{ + "indices": [ + { + "names": ["logs-freeipa.directory_access-*", "logs-freeipa.kdc-*"], + "privileges": ["read", "view_index_metadata"] + }, + { + "names": ["logs-freeipa_latest.*"], + "privileges": ["create_index", "delete", "index", "manage", "read"] + } + ] +} +``` + +Assign this role to a service account or API key, then run the `_update` and `_start` calls as that identity. + +## Data Streams + +### KDC + +The `kdc` data stream collects Kerberos KDC authentication events from `/var/log/krb5kdc.log`. Each event represents a ticket request (AS_REQ for TGT, TGS_REQ for service ticket) with its outcome, client principal, service principal, source IP, and encryption types. + +{{event "kdc"}} + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +{{fields "kdc"}} + +### Directory Access + +The `directory_access` data stream collects LDAP operation logs from 389 Directory Server (`/var/log/dirsrv/slapd-*/access`). Each line is one event — either an operation (BIND, SRCH, MOD, ADD, DEL) or a RESULT line with the outcome. Operations and results share `conn=N op=N` identifiers for correlation. + +{{event "directory_access"}} + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +{{fields "directory_access"}} + +### Directory Errors + +The `directory_errors` data stream collects error and warning logs from 389 Directory Server (`/var/log/dirsrv/slapd-*/errors`). This includes replication failures, plugin errors, unindexed search warnings, and server lifecycle events. + +{{event "directory_errors"}} + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +{{fields "directory_errors"}} + +### CA Audit + +The `ca_audit` data stream collects signed audit events from the Dogtag PKI Certificate Authority (`/var/log/pki/pki-tomcat/ca/signedAudit/ca_audit`). This includes certificate requests, issuances, revocations, CA authentication events, and session tracking. This data stream is only active on FreeIPA servers that run the CA role. + +{{event "ca_audit"}} + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +{{fields "ca_audit"}} + +### IPA API + +The `ipa_api` data stream collects FreeIPA JSON API operation logs from the Apache error log (`/var/log/httpd/error_log`). Each event represents a high-level IPA command (user_add, group_add_member, cert_request, and others) with the acting principal, parameters, and result. + +{{event "ipa_api"}} + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +{{fields "ipa_api"}} + +## Alert rule templates + +Alert rule templates provide pre-defined configurations for creating alert rules in Kibana. They are not enabled by default — navigate to **Stack Management > Rules** to review and activate them. Each template ships a sensible default threshold that you can adjust after activation. + +Alert rule templates require Elastic Stack version 9.2.0 or later. On earlier versions the ES|QL queries can be used manually in **Stack Management > Rules** with the "Elasticsearch query" rule type. + +For more information, refer to the [Elastic documentation](https://www.elastic.co/docs/reference/fleet/alerting-rule-templates). + +**[FreeIPA] Replication Errors** + +Fires when replication agreement errors appear in the directory server error log. Replication failures between FreeIPA servers can cause split-brain conditions and data inconsistency across replicas. Groups alerts by agreement name and remote host. + +**[FreeIPA] Unindexed LDAP Searches** + +Fires when 5 or more unindexed LDAP searches are detected in a 15-minute window. Unindexed searches cause full table scans in the directory database, degrading performance for all LDAP clients including SSH logins, sudo rule evaluation, and HBAC checks. + +**[FreeIPA] LDAP High Operation Latency** + +Fires when the p95 LDAP operation latency exceeds 5 seconds (adjustable) across at least 10 operations in a 5-minute window. High LDAP latency directly impacts Kerberos authentication, sudo resolution, and HBAC evaluation on all enrolled clients. + +**[FreeIPA] IPA API Error Spike** + +Fires when 10 or more API errors occur in a 5-minute window. A spike in IPA API errors can indicate backend issues such as an unreachable LDAP server, a plugin failure, or a schema conflict after an upgrade. + +**[FreeIPA] CA Subsystem Connection Failures** + +Fires when the Dogtag CA cannot connect to its LDAP backend (connection refused errors). CA connection failures cause silent certificate renewal failures which can lead to expired IPA server certificates weeks later. Only relevant on servers running the CA role. diff --git a/packages/freeipa/_dev/deploy/docker/docker-compose.yml b/packages/freeipa/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..3472a12a152 --- /dev/null +++ b/packages/freeipa/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,14 @@ +version: '2.3' +services: + freeipa: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c " + cp /sample_logs/krb5kdc.log /var/log/krb5kdc.log && + cp /sample_logs/access /var/log/access && + cp /sample_logs/errors /var/log/errors && + cp /sample_logs/ca_audit /var/log/ca_audit && + cp /sample_logs/error_log /var/log/error_log && + tail -f /dev/null" diff --git a/packages/freeipa/_dev/deploy/docker/sample_logs/access b/packages/freeipa/_dev/deploy/docker/sample_logs/access new file mode 100644 index 00000000000..f22c8fdc42e --- /dev/null +++ b/packages/freeipa/_dev/deploy/docker/sample_logs/access @@ -0,0 +1,200 @@ + 389-Directory/2.7.0 B2026.064.0000 + ipa.example.test:636 (/etc/dirsrv/slapd-EXAMPLE-TEST) + +[29/Mar/2026:13:34:23.833275669 +0000] conn=1641 op=3607 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:23.833522669 +0000] conn=1641 op=3607 RESULT err=0 tag=101 nentries=1 wtime=0.000113818 optime=0.000250378 etime=0.000363274 +[29/Mar/2026:13:34:23.833583891 +0000] conn=1641 op=3608 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:23.833606436 +0000] conn=1641 op=3608 RESULT err=0 tag=101 nentries=1 wtime=0.000020030 optime=0.000023148 etime=0.000042857 +[29/Mar/2026:13:34:23.833668641 +0000] conn=1641 op=3609 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:23.833690501 +0000] conn=1641 op=3609 RESULT err=0 tag=101 nentries=1 wtime=0.000015190 optime=0.000022204 etime=0.000037156 +[29/Mar/2026:13:34:23.833749222 +0000] conn=1641 op=3610 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:23.833886735 +0000] conn=1641 op=3610 RESULT err=0 tag=101 nentries=1 wtime=0.000041175 optime=0.000138856 etime=0.000179332 +[29/Mar/2026:13:34:23.834037165 +0000] conn=1641 op=3611 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:23.834102235 +0000] conn=1641 op=3611 RESULT err=0 tag=101 nentries=1 wtime=0.000119306 optime=0.000066164 etime=0.000184281 +[29/Mar/2026:13:34:23.834387593 +0000] conn=1641 op=3612 SRCH base="cn=global_policy,cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" +[29/Mar/2026:13:34:23.834482849 +0000] conn=1641 op=3612 RESULT err=0 tag=101 nentries=1 wtime=0.000161253 optime=0.000096689 etime=0.000257093 +[29/Mar/2026:13:34:23.852204701 +0000] conn=1634 op=3550 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:23.852336510 +0000] conn=1634 op=3550 RESULT err=0 tag=101 nentries=1 wtime=0.000181854 optime=0.000133419 etime=0.000314640 +[29/Mar/2026:13:34:23.852467838 +0000] conn=1634 op=3551 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:23.852488654 +0000] conn=1634 op=3551 RESULT err=0 tag=101 nentries=1 wtime=0.000124514 optime=0.000021061 etime=0.000145299 +[29/Mar/2026:13:34:23.852598044 +0000] conn=1634 op=3552 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:23.852614101 +0000] conn=1634 op=3552 RESULT err=0 tag=101 nentries=1 wtime=0.000106871 optime=0.000016315 etime=0.000122992 +[29/Mar/2026:13:34:23.852639703 +0000] conn=1634 op=3553 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:23.852710588 +0000] conn=1634 op=3553 RESULT err=0 tag=101 nentries=1 wtime=0.000023237 optime=0.000071430 etime=0.000094426 +[29/Mar/2026:13:34:23.852739698 +0000] conn=1634 op=3554 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:23.852754341 +0000] conn=1634 op=3554 RESULT err=0 tag=101 nentries=1 wtime=0.000026423 optime=0.000014842 etime=0.000041087 +[29/Mar/2026:13:34:23.852798145 +0000] conn=1634 op=3555 SRCH base="cn=global_policy,cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" +[29/Mar/2026:13:34:23.852832929 +0000] conn=1634 op=3555 RESULT err=0 tag=101 nentries=1 wtime=0.000041825 optime=0.000035034 etime=0.000076674 +[29/Mar/2026:13:34:23.853042891 +0000] conn=1634 op=3556 SRCH base="cn=ad,cn=trusts,dc=example,dc=test" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs=ALL +[29/Mar/2026:13:34:23.853080148 +0000] conn=1634 op=3556 RESULT err=0 tag=101 nentries=0 wtime=0.000206626 optime=0.000038092 etime=0.000243989 +[29/Mar/2026:13:34:23.853094110 +0000] conn=1634 op=3557 SRCH base="dc=example,dc=test" scope=2 filter="(objectClass=ipaNTDomainAttrs)" attrs="ipaNTFlatName ipaNTFallbackPrimaryGroup ipaNTSecurityIdentifier" +[29/Mar/2026:13:34:23.853125729 +0000] conn=1634 op=3557 RESULT err=0 tag=101 nentries=1 wtime=0.000007747 optime=0.000031973 etime=0.000039372 +[29/Mar/2026:13:34:23.853136644 +0000] conn=1634 op=3558 SRCH base="cn=Default SMB Group,cn=groups,cn=accounts,dc=example,dc=test" scope=0 filter="(objectClass=posixGroup)" attrs="ipaNTSecurityIdentifier" +[29/Mar/2026:13:34:23.853202921 +0000] conn=1634 op=3558 RESULT err=0 tag=101 nentries=1 wtime=0.000008150 optime=0.000066355 etime=0.000074196 +[29/Mar/2026:13:34:23.853213690 +0000] conn=1634 op=3559 SRCH base="cn=ad,cn=trusts,dc=example,dc=test" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs="cn ipaNTTrustPartner ipaNTFlatName ipaNTTrustedDomainSID ipaNTSIDBlacklistIncoming ipaNTSIDBlacklistOutgoing ipaNTAdditionalSuffixes" +[29/Mar/2026:13:34:23.853249811 +0000] conn=1634 op=3559 RESULT err=0 tag=101 nentries=0 wtime=0.000007280 optime=0.000036452 etime=0.000043503 +[29/Mar/2026:13:34:23.853274469 +0000] conn=1634 op=3560 SRCH base="uid=admin,cn=users,cn=accounts,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" +[29/Mar/2026:13:34:23.853746796 +0000] conn=1634 op=3560 RESULT err=0 tag=101 nentries=1 wtime=0.000020739 optime=0.000473738 etime=0.000494022 +[29/Mar/2026:13:34:24.086262446 +0000] conn=1642 op=4766 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.086577811 +0000] conn=1642 op=4766 RESULT err=0 tag=101 nentries=1 wtime=0.000101795 optime=0.000318155 etime=0.000418929 +[29/Mar/2026:13:34:24.086844592 +0000] conn=1642 op=4767 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:24.086882990 +0000] conn=1642 op=4767 RESULT err=0 tag=101 nentries=1 wtime=0.000253241 optime=0.000039446 etime=0.000292013 +[29/Mar/2026:13:34:24.086983079 +0000] conn=1642 op=4768 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.087025465 +0000] conn=1642 op=4768 RESULT err=0 tag=101 nentries=1 wtime=0.000093596 optime=0.000043396 etime=0.000136235 +[29/Mar/2026:13:34:24.087229776 +0000] conn=1642 op=4769 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.087357287 +0000] conn=1642 op=4769 RESULT err=0 tag=101 nentries=1 wtime=0.000196768 optime=0.000129163 etime=0.000325246 +[29/Mar/2026:13:34:24.087510179 +0000] conn=1642 op=4770 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.087547396 +0000] conn=1642 op=4770 RESULT err=0 tag=101 nentries=1 wtime=0.000145874 optime=0.000038191 etime=0.000183353 +[29/Mar/2026:13:34:24.087737799 +0000] conn=1642 op=4771 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.087873462 +0000] conn=1642 op=4771 RESULT err=0 tag=101 nentries=1 wtime=0.000183263 optime=0.000137285 etime=0.000319879 +[29/Mar/2026:13:34:24.087975977 +0000] conn=1642 op=4772 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.088013141 +0000] conn=1642 op=4772 RESULT err=0 tag=101 nentries=1 wtime=0.000095435 optime=0.000038139 etime=0.000132905 +[29/Mar/2026:13:34:24.102035953 +0000] conn=4412 fd=253 slot=253 connection from 172.28.0.10 to 172.28.0.10 +[29/Mar/2026:13:34:24.103589843 +0000] conn=1644 op=10935 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.103801462 +0000] conn=1644 op=10935 RESULT err=0 tag=101 nentries=1 wtime=0.000066545 optime=0.000213246 etime=0.000278475 +[29/Mar/2026:13:34:24.103986283 +0000] conn=1644 op=10936 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:24.104034324 +0000] conn=1644 op=10936 RESULT err=0 tag=101 nentries=1 wtime=0.000096190 optime=0.000049565 etime=0.000144839 +[29/Mar/2026:13:34:24.104252185 +0000] conn=1644 op=10937 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.104296969 +0000] conn=1644 op=10937 RESULT err=0 tag=101 nentries=1 wtime=0.000139889 optime=0.000045930 etime=0.000185083 +[29/Mar/2026:13:34:24.104646611 +0000] conn=1644 op=10938 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.104800750 +0000] conn=1644 op=10938 RESULT err=0 tag=101 nentries=1 wtime=0.000046613 optime=0.000155234 etime=0.000200851 +[29/Mar/2026:13:34:24.104979282 +0000] conn=1644 op=10939 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.105042822 +0000] conn=1644 op=10939 RESULT err=0 tag=101 nentries=1 wtime=0.000127645 optime=0.000064375 etime=0.000190758 +[29/Mar/2026:13:34:24.105189905 +0000] conn=1644 op=10940 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.105303477 +0000] conn=1644 op=10940 RESULT err=0 tag=101 nentries=1 wtime=0.000121023 optime=0.000115194 etime=0.000235574 +[29/Mar/2026:13:34:24.105530534 +0000] conn=1644 op=10941 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.105598227 +0000] conn=1644 op=10941 RESULT err=0 tag=101 nentries=1 wtime=0.000033185 optime=0.000068636 etime=0.000100385 +[29/Mar/2026:13:34:24.105974044 +0000] conn=1644 op=10942 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.106107841 +0000] conn=1644 op=10942 RESULT err=0 tag=101 nentries=1 wtime=0.000161568 optime=0.000135482 etime=0.000296308 +[29/Mar/2026:13:34:24.106420755 +0000] conn=1644 op=10943 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.106487435 +0000] conn=1644 op=10943 RESULT err=0 tag=101 nentries=1 wtime=0.000150612 optime=0.000067648 etime=0.000217026 +[29/Mar/2026:13:34:24.106570089 +0000] conn=1644 op=10944 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.106713249 +0000] conn=1644 op=10944 RESULT err=0 tag=101 nentries=1 wtime=0.000056844 optime=0.000144800 etime=0.000200701 +[29/Mar/2026:13:34:24.106853230 +0000] conn=1644 op=10945 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.106894857 +0000] conn=1644 op=10945 RESULT err=0 tag=101 nentries=1 wtime=0.000028700 optime=0.000042750 etime=0.000070769 +[29/Mar/2026:13:34:24.107142475 +0000] conn=1644 op=10946 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:24.107261779 +0000] conn=1644 op=10946 RESULT err=0 tag=101 nentries=1 wtime=0.000167260 optime=0.000120970 etime=0.000287555 +[29/Mar/2026:13:34:24.107550098 +0000] conn=1644 op=10947 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:24.107590449 +0000] conn=1644 op=10947 RESULT err=0 tag=101 nentries=1 wtime=0.000086482 optime=0.000041424 etime=0.000127104 +[29/Mar/2026:13:34:24.107728141 +0000] conn=1644 op=10948 SRCH base="cn=s4u2proxy,cn=etc,dc=example,dc=test" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/ipa.example.test@EXAMPLE.TEST))" attrs="objectClass memberPrincipal" +[29/Mar/2026:13:34:24.107849823 +0000] conn=1644 op=10948 RESULT err=0 tag=101 nentries=1 wtime=0.000070107 optime=0.000122710 etime=0.000192033 +[29/Mar/2026:13:34:24.108971662 +0000] conn=4412 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO +[29/Mar/2026:13:34:24.109991808 +0000] conn=4412 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000091480 optime=0.001021507 etime=0.001112656 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=test" +[29/Mar/2026:13:34:24.110766546 +0000] conn=4412 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs=ALL +[29/Mar/2026:13:34:24.111008164 +0000] conn=4412 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000107287 optime=0.000242589 etime=0.000349073 +[29/Mar/2026:13:34:24.111716668 +0000] conn=4412 op=2 SRCH base="cn=users,cn=accounts,dc=example,dc=test" scope=1 filter="(objectClass=posixaccount)" attrs="givenName telephoneNumber mail krbPrincipalName sn uid gidNumber sshpubkeyfp krbCanonicalName homeDirectory nsAccountLock loginShell ipaSshPubKey title uidNumber" +[29/Mar/2026:13:34:24.112373784 +0000] conn=4412 op=2 RESULT err=4 tag=101 nentries=1 wtime=0.000178931 optime=0.000658552 etime=0.000835633 +[29/Mar/2026:13:34:24.114069457 +0000] conn=4412 op=3 UNBIND +[29/Mar/2026:13:34:24.114082341 +0000] conn=4412 op=3 fd=253 Disconnect - Cleanly Closed Connection - U1 +[29/Mar/2026:13:34:54.830068526 +0000] conn=1646 op=16663 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:54.830374719 +0000] conn=1646 op=16663 RESULT err=0 tag=101 nentries=1 wtime=0.000285153 optime=0.000309665 etime=0.000593907 +[29/Mar/2026:13:34:54.830533949 +0000] conn=1646 op=16664 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:54.830558156 +0000] conn=1646 op=16664 RESULT err=0 tag=101 nentries=1 wtime=0.000149955 optime=0.000024444 etime=0.000174071 +[29/Mar/2026:13:34:54.830620972 +0000] conn=1646 op=16665 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:54.830641290 +0000] conn=1646 op=16665 RESULT err=0 tag=101 nentries=1 wtime=0.000059812 optime=0.000020687 etime=0.000080228 +[29/Mar/2026:13:34:54.830675066 +0000] conn=1646 op=16666 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:54.830779720 +0000] conn=1646 op=16666 RESULT err=0 tag=101 nentries=1 wtime=0.000030922 optime=0.000105318 etime=0.000135920 +[29/Mar/2026:13:34:54.830815129 +0000] conn=1646 op=16667 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:54.830832094 +0000] conn=1646 op=16667 RESULT err=0 tag=101 nentries=1 wtime=0.000032058 optime=0.000017211 etime=0.000049031 +[29/Mar/2026:13:34:54.830992130 +0000] conn=1646 op=16668 SRCH base="cn=global_policy,cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" +[29/Mar/2026:13:34:54.831131995 +0000] conn=1646 op=16668 RESULT err=0 tag=101 nentries=1 wtime=0.000155484 optime=0.000141634 etime=0.000296116 +[29/Mar/2026:13:34:54.845938259 +0000] conn=1627 op=2123 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:54.846198316 +0000] conn=1627 op=2123 RESULT err=0 tag=101 nentries=1 wtime=0.000144416 optime=0.000262123 etime=0.000405107 +[29/Mar/2026:13:34:54.846301051 +0000] conn=1627 op=2124 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:54.846345142 +0000] conn=1627 op=2124 RESULT err=0 tag=101 nentries=1 wtime=0.000072051 optime=0.000045087 etime=0.000116203 +[29/Mar/2026:13:34:54.846485829 +0000] conn=1627 op=2125 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:54.846535035 +0000] conn=1627 op=2125 RESULT err=0 tag=101 nentries=1 wtime=0.000075702 optime=0.000050326 etime=0.000125253 +[29/Mar/2026:13:34:54.846879867 +0000] conn=1627 op=2126 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:54.847006499 +0000] conn=1627 op=2126 RESULT err=0 tag=101 nentries=1 wtime=0.000092300 optime=0.000128142 etime=0.000219779 +[29/Mar/2026:13:34:54.847410998 +0000] conn=1627 op=2127 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:54.847475363 +0000] conn=1627 op=2127 RESULT err=0 tag=101 nentries=1 wtime=0.000199562 optime=0.000065611 etime=0.000263948 +[29/Mar/2026:13:34:54.847579444 +0000] conn=1627 op=2128 SRCH base="cn=global_policy,cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" +[29/Mar/2026:13:34:54.847644384 +0000] conn=1627 op=2128 RESULT err=0 tag=101 nentries=1 wtime=0.000026123 optime=0.000066051 etime=0.000091518 +[29/Mar/2026:13:34:54.847959627 +0000] conn=1627 op=2129 SRCH base="cn=ad,cn=trusts,dc=example,dc=test" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs=ALL +[29/Mar/2026:13:34:54.848008346 +0000] conn=1627 op=2129 RESULT err=0 tag=101 nentries=0 wtime=0.000089518 optime=0.000049514 etime=0.000137868 +[29/Mar/2026:13:34:54.848045834 +0000] conn=1627 op=2130 SRCH base="dc=example,dc=test" scope=2 filter="(objectClass=ipaNTDomainAttrs)" attrs="ipaNTFlatName ipaNTFallbackPrimaryGroup ipaNTSecurityIdentifier" +[29/Mar/2026:13:34:54.848073423 +0000] conn=1627 op=2130 RESULT err=0 tag=101 nentries=1 wtime=0.000015395 optime=0.000027935 etime=0.000043089 +[29/Mar/2026:13:34:54.848216681 +0000] conn=1627 op=2131 SRCH base="cn=Default SMB Group,cn=groups,cn=accounts,dc=example,dc=test" scope=0 filter="(objectClass=posixGroup)" attrs="ipaNTSecurityIdentifier" +[29/Mar/2026:13:34:54.848342769 +0000] conn=1627 op=2131 RESULT err=0 tag=101 nentries=1 wtime=0.000069466 optime=0.000126871 etime=0.000194999 +[29/Mar/2026:13:34:54.848512004 +0000] conn=1627 op=2132 SRCH base="cn=ad,cn=trusts,dc=example,dc=test" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs="cn ipaNTTrustPartner ipaNTFlatName ipaNTTrustedDomainSID ipaNTSIDBlacklistIncoming ipaNTSIDBlacklistOutgoing ipaNTAdditionalSuffixes" +[29/Mar/2026:13:34:54.848548093 +0000] conn=1627 op=2132 RESULT err=0 tag=101 nentries=0 wtime=0.000147201 optime=0.000037130 etime=0.000183623 +[29/Mar/2026:13:34:54.848764634 +0000] conn=1627 op=2133 SRCH base="uid=admin,cn=users,cn=accounts,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" +[29/Mar/2026:13:34:54.849261151 +0000] conn=1627 op=2133 RESULT err=0 tag=101 nentries=1 wtime=0.000083415 optime=0.000497837 etime=0.000580347 +[29/Mar/2026:13:34:55.083083860 +0000] conn=1629 op=2112 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.083286266 +0000] conn=1629 op=2112 RESULT err=0 tag=101 nentries=1 wtime=0.000109330 optime=0.000205529 etime=0.000314154 +[29/Mar/2026:13:34:55.083447446 +0000] conn=1629 op=2113 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:55.083486666 +0000] conn=1629 op=2113 RESULT err=0 tag=101 nentries=1 wtime=0.000150999 optime=0.000040349 etime=0.000190671 +[29/Mar/2026:13:34:55.083583086 +0000] conn=1629 op=2114 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.083604887 +0000] conn=1629 op=2114 RESULT err=0 tag=101 nentries=1 wtime=0.000090680 optime=0.000022142 etime=0.000112481 +[29/Mar/2026:13:34:55.083806706 +0000] conn=1629 op=2115 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.083894465 +0000] conn=1629 op=2115 RESULT err=0 tag=101 nentries=1 wtime=0.000198734 optime=0.000088320 etime=0.000286732 +[29/Mar/2026:13:34:55.084052249 +0000] conn=1629 op=2116 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.084088416 +0000] conn=1629 op=2116 RESULT err=0 tag=101 nentries=1 wtime=0.000153302 optime=0.000037097 etime=0.000189713 +[29/Mar/2026:13:34:55.084280542 +0000] conn=1629 op=2117 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.084405669 +0000] conn=1629 op=2117 RESULT err=0 tag=101 nentries=1 wtime=0.000185113 optime=0.000126754 etime=0.000311201 +[29/Mar/2026:13:34:55.084450247 +0000] conn=1629 op=2118 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.084468049 +0000] conn=1629 op=2118 RESULT err=0 tag=101 nentries=1 wtime=0.000038122 optime=0.000018103 etime=0.000055930 +[29/Mar/2026:13:34:55.108641841 +0000] conn=4413 fd=253 slot=253 connection from 172.28.0.10 to 172.28.0.10 +[29/Mar/2026:13:34:55.110165019 +0000] conn=1631 op=4810 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.110353425 +0000] conn=1631 op=4810 RESULT err=0 tag=101 nentries=1 wtime=0.000175666 optime=0.000190595 etime=0.000365520 +[29/Mar/2026:13:34:55.110406097 +0000] conn=1631 op=4811 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:34:55.110450796 +0000] conn=1631 op=4811 RESULT err=0 tag=101 nentries=1 wtime=0.000033316 optime=0.000045923 etime=0.000078447 +[29/Mar/2026:13:34:55.110575974 +0000] conn=1631 op=4812 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.110625733 +0000] conn=1631 op=4812 RESULT err=0 tag=101 nentries=1 wtime=0.000029109 optime=0.000051010 etime=0.000079283 +[29/Mar/2026:13:34:55.110891671 +0000] conn=1631 op=4813 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.111026697 +0000] conn=1631 op=4813 RESULT err=0 tag=101 nentries=1 wtime=0.000047976 optime=0.000136517 etime=0.000183758 +[29/Mar/2026:13:34:55.111249201 +0000] conn=1631 op=4814 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.111326323 +0000] conn=1631 op=4814 RESULT err=0 tag=101 nentries=1 wtime=0.000179900 optime=0.000078582 etime=0.000257055 +[29/Mar/2026:13:34:55.111668619 +0000] conn=1631 op=4815 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.111848133 +0000] conn=1631 op=4815 RESULT err=0 tag=101 nentries=1 wtime=0.000207037 optime=0.000181349 etime=0.000387659 +[29/Mar/2026:13:34:55.112212471 +0000] conn=1631 op=4816 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.112260194 +0000] conn=1631 op=4816 RESULT err=0 tag=101 nentries=1 wtime=0.000144227 optime=0.000048976 etime=0.000192300 +[29/Mar/2026:13:34:55.112655166 +0000] conn=1631 op=4817 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.112925303 +0000] conn=1631 op=4817 RESULT err=0 tag=101 nentries=1 wtime=0.000157265 optime=0.000272709 etime=0.000428228 +[29/Mar/2026:13:34:55.113200528 +0000] conn=1631 op=4818 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.113295125 +0000] conn=1631 op=4818 RESULT err=0 tag=101 nentries=1 wtime=0.000148525 optime=0.000095017 etime=0.000241690 +[29/Mar/2026:13:34:55.113378086 +0000] conn=1631 op=4819 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.113527822 +0000] conn=1631 op=4819 RESULT err=0 tag=101 nentries=1 wtime=0.000055766 optime=0.000151760 etime=0.000206619 +[29/Mar/2026:13:34:55.113675168 +0000] conn=1631 op=4820 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.113704244 +0000] conn=1631 op=4820 RESULT err=0 tag=101 nentries=1 wtime=0.000043740 optime=0.000030200 etime=0.000073457 +[29/Mar/2026:13:34:55.113986020 +0000] conn=1631 op=4821 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ipa.example.test@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ipa.example.test@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:34:55.114252298 +0000] conn=1631 op=4821 RESULT err=0 tag=101 nentries=1 wtime=0.000196769 optime=0.000268823 etime=0.000463829 +[29/Mar/2026:13:34:55.114502757 +0000] conn=1631 op=4822 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:34:55.114533480 +0000] conn=1631 op=4822 RESULT err=0 tag=101 nentries=1 wtime=0.000096597 optime=0.000031415 etime=0.000127486 +[29/Mar/2026:13:34:55.114752517 +0000] conn=1631 op=4823 SRCH base="cn=s4u2proxy,cn=etc,dc=example,dc=test" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/ipa.example.test@EXAMPLE.TEST))" attrs="objectClass memberPrincipal" +[29/Mar/2026:13:34:55.115050872 +0000] conn=1631 op=4823 RESULT err=0 tag=101 nentries=1 wtime=0.000123735 optime=0.000299982 etime=0.000421643 +[29/Mar/2026:13:34:55.117146757 +0000] conn=4413 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO +[29/Mar/2026:13:34:55.118435596 +0000] conn=4413 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000119594 optime=0.001290216 etime=0.001409356 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=test" +[29/Mar/2026:13:34:55.185790792 +0000] conn=4413 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs=ALL +[29/Mar/2026:13:34:55.188012971 +0000] conn=4413 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000808260 optime=0.002240715 etime=0.003038547 +[29/Mar/2026:13:34:55.190650653 +0000] conn=4413 op=2 SRCH base="cn=users,cn=accounts,dc=example,dc=test" scope=1 filter="(objectClass=posixaccount)" attrs="krbPrincipalName title krbCanonicalName sn uidNumber nsAccountLock uid ipaSshPubKey homeDirectory givenName mail telephoneNumber sshpubkeyfp gidNumber loginShell" +[29/Mar/2026:13:34:55.191948181 +0000] conn=4413 op=2 RESULT err=4 tag=101 nentries=1 wtime=0.000358558 optime=0.001303772 etime=0.001659149 +[29/Mar/2026:13:34:55.194611276 +0000] conn=4413 op=3 UNBIND +[29/Mar/2026:13:34:55.194639147 +0000] conn=4413 op=3 fd=253 Disconnect - Cleanly Closed Connection - U1 +[29/Mar/2026:13:35:25.831203201 +0000] conn=1641 op=3613 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:35:25.831578214 +0000] conn=1641 op=3613 RESULT err=0 tag=101 nentries=1 wtime=0.000152415 optime=0.000377754 etime=0.000529251 +[29/Mar/2026:13:35:25.831763953 +0000] conn=1641 op=3614 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:35:25.831819480 +0000] conn=1641 op=3614 RESULT err=0 tag=101 nentries=1 wtime=0.000038552 optime=0.000056807 etime=0.000094443 +[29/Mar/2026:13:35:25.832108653 +0000] conn=1641 op=3615 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:35:25.832182173 +0000] conn=1641 op=3615 RESULT err=0 tag=101 nentries=1 wtime=0.000097891 optime=0.000073934 etime=0.000168631 +[29/Mar/2026:13:35:25.832332960 +0000] conn=1641 op=3616 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:35:25.832502751 +0000] conn=1641 op=3616 RESULT err=0 tag=101 nentries=1 wtime=0.000128185 optime=0.000171569 etime=0.000298929 +[29/Mar/2026:13:35:25.832763489 +0000] conn=1641 op=3617 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:35:25.832814048 +0000] conn=1641 op=3617 RESULT err=0 tag=101 nentries=1 wtime=0.000037645 optime=0.000051798 etime=0.000088462 +[29/Mar/2026:13:35:25.832937410 +0000] conn=1641 op=3618 SRCH base="cn=global_policy,cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" +[29/Mar/2026:13:35:25.833128532 +0000] conn=1641 op=3618 RESULT err=0 tag=101 nentries=1 wtime=0.000043024 optime=0.000193007 etime=0.000234208 +[29/Mar/2026:13:35:25.850875270 +0000] conn=1645 op=13657 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=admin@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:35:25.851013270 +0000] conn=1645 op=13657 RESULT err=0 tag=101 nentries=1 wtime=0.000147085 optime=0.000140131 etime=0.000286540 +[29/Mar/2026:13:35:25.851028744 +0000] conn=1645 op=13658 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" +[29/Mar/2026:13:35:25.851046952 +0000] conn=1645 op=13658 RESULT err=0 tag=101 nentries=1 wtime=0.000008529 optime=0.000018647 etime=0.000026855 +[29/Mar/2026:13:35:25.851155336 +0000] conn=1645 op=13659 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:35:25.851195006 +0000] conn=1645 op=13659 RESULT err=0 tag=101 nentries=1 wtime=0.000104692 optime=0.000040590 etime=0.000144589 +[29/Mar/2026:13:35:25.851221950 +0000] conn=1645 op=13660 SRCH base="dc=example,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/EXAMPLE.TEST@EXAMPLE.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi..." +[29/Mar/2026:13:35:25.851318329 +0000] conn=1645 op=13660 RESULT err=0 tag=101 nentries=1 wtime=0.000020736 optime=0.000097087 etime=0.000117445 +[29/Mar/2026:13:35:25.851423874 +0000] conn=1645 op=13661 SRCH base="cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" +[29/Mar/2026:13:35:25.851463317 +0000] conn=1645 op=13661 RESULT err=0 tag=101 nentries=1 wtime=0.000100455 optime=0.000040528 etime=0.000140227 +[29/Mar/2026:13:35:25.851569693 +0000] conn=1645 op=13662 SRCH base="cn=global_policy,cn=EXAMPLE.TEST,cn=kerberos,dc=example,dc=test" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" +[29/Mar/2026:13:35:25.851632151 +0000] conn=1645 op=13662 RESULT err=0 tag=101 nentries=1 wtime=0.000099509 optime=0.000063666 etime=0.000162416 +[29/Mar/2026:13:35:25.851783912 +0000] conn=1645 op=13663 SRCH base="cn=ad,cn=trusts,dc=example,dc=test" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs=ALL +[29/Mar/2026:13:35:25.851800032 +0000] conn=1645 op=13663 RESULT err=0 tag=101 nentries=0 wtime=0.000145999 optime=0.000016352 etime=0.000162055 +[29/Mar/2026:13:35:25.851810636 +0000] conn=1645 op=13664 SRCH base="dc=example,dc=test" scope=2 filter="(objectClass=ipaNTDomainAttrs)" attrs="ipaNTFlatName ipaNTFallbackPrimaryGroup ipaNTSecurityIdentifier" diff --git a/packages/freeipa/_dev/deploy/docker/sample_logs/ca_audit b/packages/freeipa/_dev/deploy/docker/sample_logs/ca_audit new file mode 100644 index 00000000000..d50495d7228 --- /dev/null +++ b/packages/freeipa/_dev/deploy/docker/sample_logs/ca_audit @@ -0,0 +1,50 @@ +0.https-jsse-jss-nio-8443-exec-1 - [28/Mar/2026:13:35:44 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-2 - [28/Mar/2026:13:35:44 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:35:45 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:35:45 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated +0.https-jsse-jss-nio-8443-exec-4 - [28/Mar/2026:13:35:46 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-4 - [28/Mar/2026:13:35:46 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createRequestID] authorization success +0.https-jsse-jss-nio-8443-exec-5 - [28/Mar/2026:13:35:48 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createCertID] authorization success +0.https-jsse-jss-nio-8443-exec-6 - [28/Mar/2026:13:35:53 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createRequestID] authorization success +0.https-jsse-jss-nio-8443-exec-7 - [28/Mar/2026:13:35:54 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createCertID] authorization success +0.https-jsse-jss-nio-8443-exec-8 - [28/Mar/2026:13:36:00 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createRequestID] authorization success +0.https-jsse-jss-nio-8443-exec-9 - [28/Mar/2026:13:36:01 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createCertID] authorization success +0.https-jsse-jss-nio-8443-exec-10 - [28/Mar/2026:13:36:07 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createRequestID] authorization success +0.https-jsse-jss-nio-8443-exec-11 - [28/Mar/2026:13:36:08 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createCertID] authorization success +0.https-jsse-jss-nio-8443-exec-12 - [28/Mar/2026:13:36:14 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createRequestID] authorization success +0.https-jsse-jss-nio-8443-exec-13 - [28/Mar/2026:13:36:15 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createCertID] authorization success +0.https-jsse-jss-nio-8443-exec-14 - [28/Mar/2026:13:36:28 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createRequestID] authorization success +0.https-jsse-jss-nio-8443-exec-15 - [28/Mar/2026:13:36:29 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CAInstallerService.createCertID] authorization success +0.main - [28/Mar/2026:13:37:09 UTC] [14] [6] [AuditEvent=CERT_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=1C:DF:E4:A4:09:0C:27:ED:14:76:75:6C:29:1D:F2:53:7C:06:EC:92] certificate signing info +0.main - [28/Mar/2026:13:37:09 UTC] [14] [6] [AuditEvent=CRL_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=1C:DF:E4:A4:09:0C:27:ED:14:76:75:6C:29:1D:F2:53:7C:06:EC:92] CRL signing info +0.main - [28/Mar/2026:13:37:09 UTC] [14] [6] [AuditEvent=OCSP_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=93:85:4D:93:93:18:EC:A5:26:79:9B:49:BB:C8:DC:1B:83:F9:CF:39] OCSP signing info +0.main - [28/Mar/2026:13:37:09 UTC] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Success] self tests execution (see selftests.log for details) +0.https-jsse-jss-nio-8443-exec-1 - [28/Mar/2026:13:37:10 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-2 - [28/Mar/2026:13:37:10 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:37:11 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:37:11 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated +0.main - [28/Mar/2026:13:37:19 UTC] [14] [6] [AuditEvent=CERT_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=1C:DF:E4:A4:09:0C:27:ED:14:76:75:6C:29:1D:F2:53:7C:06:EC:92] certificate signing info +0.main - [28/Mar/2026:13:37:19 UTC] [14] [6] [AuditEvent=CRL_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=1C:DF:E4:A4:09:0C:27:ED:14:76:75:6C:29:1D:F2:53:7C:06:EC:92] CRL signing info +0.main - [28/Mar/2026:13:37:19 UTC] [14] [6] [AuditEvent=OCSP_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=93:85:4D:93:93:18:EC:A5:26:79:9B:49:BB:C8:DC:1B:83:F9:CF:39] OCSP signing info +0.main - [28/Mar/2026:13:37:20 UTC] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Success] self tests execution (see selftests.log for details) +0.http-nio-8080-exec-8 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$NonRoleUser$][Outcome=Success][aclResource=certServer.ee.profiles][Op=list] authorization success +0.http-nio-8080-exec-10 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=PROFILE_CERT_REQUEST][SubjectID=$NonRoleUser$][Outcome=Success][ReqID=0x7][ProfileID=caSubsystemCert][CertSubject=CN=IPA RA,O=EXAMPLE.TEST] certificate request made with certificate profiles +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=CN=ipa-ca-agent,O=EXAMPLE.TEST][CertSerialNum=6][IssuerDN=CN=Certificate Authority,O=EXAMPLE.TEST][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=AUTH][SubjectID=admin][Outcome=Success][AuthMgr=certUserDBAuthMgr] authentication success +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=admin][Outcome=Success][aclResource=certServer.ca.request.profile][Op=read] authorization success +0.https-jsse-jss-nio-8443-exec-3 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=admin][Outcome=Success][Role=Certificate Manager Agents, Administrators, Security Domain Administrators, Enterprise CA Administrators, Enterprise KRA Administrators, Enterprise OCSP Administrators, Enterprise TKS Administrators, Enterprise RA Administrators, Enterprise TPS Administrators] assume privileged role +0.https-jsse-jss-nio-8443-exec-4 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=CN=ipa-ca-agent,O=EXAMPLE.TEST][CertSerialNum=6][IssuerDN=CN=Certificate Authority,O=EXAMPLE.TEST][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-4 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=AUTH][SubjectID=admin][Outcome=Success][AuthMgr=certUserDBAuthMgr] authentication success +0.https-jsse-jss-nio-8443-exec-4 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=admin][Outcome=Success][aclResource=certServer.ca.request.profile][Op=approve] authorization success +0.https-jsse-jss-nio-8443-exec-4 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=admin][Outcome=Success][Role=Certificate Manager Agents, Administrators, Security Domain Administrators, Enterprise CA Administrators, Enterprise KRA Administrators, Enterprise OCSP Administrators, Enterprise TKS Administrators, Enterprise RA Administrators, Enterprise TPS Administrators] assume privileged role +0.https-jsse-jss-nio-8443-exec-4 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=admin][Outcome=Success][ReqID=0x7][CertSerialNum=0x7] certificate request processed +0.https-jsse-jss-nio-8443-exec-6 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=CN=ipa-ca-agent,O=EXAMPLE.TEST][CertSerialNum=6][IssuerDN=CN=Certificate Authority,O=EXAMPLE.TEST][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated +0.https-jsse-jss-nio-8443-exec-5 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=CN=ipa-ca-agent,O=EXAMPLE.TEST][CertSerialNum=6][IssuerDN=CN=Certificate Authority,O=EXAMPLE.TEST][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated +0.http-nio-8080-exec-12 - [28/Mar/2026:13:37:23 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$NonRoleUser$][Outcome=Success][aclResource=certServer.ee.certificate][Op=read] authorization success +0.https-jsse-jss-nio-8443-exec-7 - [28/Mar/2026:13:37:29 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=CN=IPA RA,O=EXAMPLE.TEST][CertSerialNum=7][IssuerDN=CN=Certificate Authority,O=EXAMPLE.TEST][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-7 - [28/Mar/2026:13:37:29 UTC] [14] [6] [AuditEvent=AUTH][SubjectID=ipara][Outcome=Success][AuthMgr=certUserDBAuthMgr] authentication success +0.https-jsse-jss-nio-8443-exec-7 - [28/Mar/2026:13:37:29 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=ipara][Outcome=Success][aclResource=certServer.ca.account][Op=login][Info=AccountService.login] authorization success +0.https-jsse-jss-nio-8443-exec-7 - [28/Mar/2026:13:37:29 UTC] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=ipara][Outcome=Success][Role=Certificate Manager Agents,Registration Manager Agents,Security Domain Administrators] assume privileged role +0.https-jsse-jss-nio-8443-exec-8 - [28/Mar/2026:13:37:29 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=CN=IPA RA,O=EXAMPLE.TEST][CertSerialNum=7][IssuerDN=CN=Certificate Authority,O=EXAMPLE.TEST][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated +0.https-jsse-jss-nio-8443-exec-9 - [28/Mar/2026:13:37:29 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.28.0.10][ServerIP=172.28.0.10][SubjectID=CN=IPA RA,O=EXAMPLE.TEST][CertSerialNum=7][IssuerDN=CN=Certificate Authority,O=EXAMPLE.TEST][Outcome=Success] access session establish success +0.https-jsse-jss-nio-8443-exec-9 - [28/Mar/2026:13:37:29 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=ipara][Outcome=Success][aclResource=certServer.profile.configuration][Op=modify][Info=ProfileResource.createProfileRaw] authorization success diff --git a/packages/freeipa/_dev/deploy/docker/sample_logs/error_log b/packages/freeipa/_dev/deploy/docker/sample_logs/error_log new file mode 100644 index 00000000000..e87210b5ea6 --- /dev/null +++ b/packages/freeipa/_dev/deploy/docker/sample_logs/error_log @@ -0,0 +1,50 @@ +[Sat Mar 28 13:38:36.486845 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:38396] ipa: INFO: [jsonserver_kerb] host/ipa.example.test@EXAMPLE.TEST: schema(version='2.170'): SUCCESS +[Sat Mar 28 13:38:36.926455 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:38410] ipa: INFO: [jsonserver_session] host/ipa.example.test@EXAMPLE.TEST: ping(): SUCCESS +[Sat Mar 28 13:38:36.940039 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:38410] ipa: INFO: [jsonserver_session] host/ipa.example.test@EXAMPLE.TEST: ca_is_enabled(version='2.107'): SUCCESS +[Sat Mar 28 13:38:37.207226 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:38410] ipa: INFO: [jsonserver_session] host/ipa.example.test@EXAMPLE.TEST: config_show(raw=True, version='2.0'): SUCCESS +[Sat Mar 28 13:39:10.991995 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:42754] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_find/1(None, sizelimit=1, version='2.254'): SUCCESS +[Sat Mar 28 13:39:42.605668 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:50068] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_find/1(None, sizelimit=1, version='2.254'): SUCCESS +[Sat Mar 28 13:40:14.643438 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:39430] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_find/1(None, sizelimit=1, version='2.254'): SUCCESS +[Sat Mar 28 13:40:44.918417 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:55168] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_find/1(None, sizelimit=1, version='2.254'): SUCCESS +[Sat Mar 28 13:40:45.551872 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:55170] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_find/1(None, sizelimit=1, version='2.254'): SUCCESS +[Sat Mar 28 13:41:08.820079 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:52930] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User1'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:09.182432 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:52930] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_add/1('testuser1', givenname='Test', sn='User1', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:09.478133 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:52934] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User2'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:09.675842 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:52934] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser2', givenname='Test', sn='User2', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:09.980738 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:52948] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User3'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:10.151838 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:52948] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser3', givenname='Test', sn='User3', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:10.452492 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41540] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User4'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:10.630225 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41540] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser4', givenname='Test', sn='User4', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:10.940661 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41548] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User5'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:11.352207 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41548] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser5', givenname='Test', sn='User5', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:11.641352 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41564] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User6'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:12.084486 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41564] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser6', givenname='Test', sn='User6', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:12.376087 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41574] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User7'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:12.555288 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41574] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser7', givenname='Test', sn='User7', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:12.853747 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41578] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User8'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:13.298237 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41578] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser8', givenname='Test', sn='User8', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:13.591466 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41586] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User9'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:13.764552 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41586] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser9', givenname='Test', sn='User9', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:14.056803 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41602] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User10'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:14.493364 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41602] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser10', givenname='Test', sn='User10', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:14.796702 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41616] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User11'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:15.241556 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41616] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser11', givenname='Test', sn='User11', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:15.536643 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41626] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User12'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:15.951287 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41626] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser12', givenname='Test', sn='User12', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:16.246961 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41628] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_find/1(None, sizelimit=1, version='2.254'): SUCCESS +[Sat Mar 28 13:41:16.249446 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41644] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User13'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:16.484846 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41644] ipa: INFO: [jsonserver_kerb] admin@EXAMPLE.TEST: user_add/1('testuser13', givenname='Test', sn='User13', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:16.785499 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41654] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User14'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:16.974677 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41654] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser14', givenname='Test', sn='User14', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:17.281054 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41658] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User15'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:17.726116 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41658] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser15', givenname='Test', sn='User15', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:18.016514 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41662] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User16'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:18.455200 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41662] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser16', givenname='Test', sn='User16', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:18.747900 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41672] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User17'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:19.194763 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41672] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser17', givenname='Test', sn='User17', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:19.492564 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:41678] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User18'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:19.661251 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:41678] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser18', givenname='Test', sn='User18', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:19.946638 2026] [wsgi:error] [pid 6866:tid 7119] [remote 172.28.0.10:41688] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User19'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:20.370233 2026] [wsgi:error] [pid 6865:tid 7122] [remote 172.28.0.10:41688] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser19', givenname='Test', sn='User19', userpassword='********', version='2.254'): SUCCESS +[Sat Mar 28 13:41:20.661792 2026] [wsgi:error] [pid 6864:tid 7113] [remote 172.28.0.10:44014] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: command_defaults/1('user_add/1', params=('cn',), kw={'givenname': 'Test', 'sn': 'User20'}, version='2.254'): SUCCESS +[Sat Mar 28 13:41:20.838646 2026] [wsgi:error] [pid 6867:tid 7116] [remote 172.28.0.10:44014] ipa: INFO: [jsonserver_session] admin@EXAMPLE.TEST: user_add/1('testuser20', givenname='Test', sn='User20', userpassword='********', version='2.254'): SUCCESS diff --git a/packages/freeipa/_dev/deploy/docker/sample_logs/errors b/packages/freeipa/_dev/deploy/docker/sample_logs/errors new file mode 100644 index 00000000000..d6f792b3f81 --- /dev/null +++ b/packages/freeipa/_dev/deploy/docker/sample_logs/errors @@ -0,0 +1,50 @@ + 389-Directory/2.7.0 B2026.064.0000 + ipa.example.test:389 (/etc/dirsrv/slapd-EXAMPLE-TEST) + +[28/Mar/2026:13:34:37.548158748 +0000] - NOTICE - slapd_system_isFIPS - Can not access /proc/sys/crypto/fips_enabled - assuming FIPS is OFF +[28/Mar/2026:13:34:37.571424068 +0000] - INFO - main - 389-Directory/2.7.0 B2026.064.0000 starting up +[28/Mar/2026:13:34:37.577627455 +0000] - INFO - main - Setting the maximum file descriptor limit to: 524288 +[28/Mar/2026:13:34:37.721602940 +0000] - INFO - PBKDF2_SHA256 - Based on CPU performance, chose 2048 rounds +[28/Mar/2026:13:34:37.728080186 +0000] - INFO - PBKDF2-SHA1 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:37.734455961 +0000] - INFO - PBKDF2-SHA1 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:37.740849800 +0000] - INFO - PBKDF2-SHA256 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:37.747132884 +0000] - INFO - PBKDF2-SHA512 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:37.756382982 +0000] - INFO - bdb_config_upgrade_dse_info - create config entry from old config +[28/Mar/2026:13:34:37.766976079 +0000] - NOTICE - bdb_start_autotune - found 32622192k physical memory +[28/Mar/2026:13:34:37.773047562 +0000] - NOTICE - bdb_start_autotune - found 15546724k available +[28/Mar/2026:13:34:37.779254083 +0000] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 1572864k +[28/Mar/2026:13:34:37.785559324 +0000] - NOTICE - bdb_start_autotune - total cache size: 1610612736 B; +[28/Mar/2026:13:34:39.280807787 +0000] - INFO - connection_table_new - Number of connection sub-tables 1, each containing 63937 slots. +[28/Mar/2026:13:34:39.303534111 +0000] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests +[28/Mar/2026:13:34:39.309960592 +0000] - INFO - slapd_daemon - Listening on /run/slapd-EXAMPLE-TEST.socket for LDAPI requests +[28/Mar/2026:13:34:39.629744747 +0000] - INFO - postop_modify_config_dse - The change of nsslapd-securePort will not take effect until the server is restarted +[28/Mar/2026:13:34:39.891173940 +0000] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 +[28/Mar/2026:13:34:39.906408533 +0000] - NOTICE - bdb_start_autotune - found 32622192k physical memory +[28/Mar/2026:13:34:39.912579898 +0000] - NOTICE - bdb_start_autotune - found 15581524k available +[28/Mar/2026:13:34:39.918819214 +0000] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 1572864k +[28/Mar/2026:13:34:39.925304012 +0000] - NOTICE - bdb_start_autotune - cache autosizing: userRoot entry cache (1 total): 5963776k +[28/Mar/2026:13:34:39.931756855 +0000] - NOTICE - bdb_start_autotune - cache autosizing: userRoot dn cache (1 total): 720896k +[28/Mar/2026:13:34:39.938273008 +0000] - NOTICE - bdb_start_autotune - total cache size: 7734296576 B; +[28/Mar/2026:13:34:40.263439214 +0000] - INFO - ct_thread_cleanup - slapd shutting down - signaling connection table threads +[28/Mar/2026:13:34:40.269685267 +0000] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 1 max work q size 1 max work q stack size 1 +[28/Mar/2026:13:34:40.278200960 +0000] - INFO - slapd_daemon - slapd shutting down - waiting for 2 threads to terminate +[28/Mar/2026:13:34:40.373959175 +0000] - INFO - slapd_daemon - slapd shutting down - accept_thread +[28/Mar/2026:13:34:40.416943022 +0000] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins +[28/Mar/2026:13:34:40.425398145 +0000] - INFO - bdb_pre_close - Waiting for 5 database threads to stop +[28/Mar/2026:13:34:41.728282681 +0000] - INFO - bdb_pre_close - All database threads now stopped +[28/Mar/2026:13:34:41.802142915 +0000] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed +[28/Mar/2026:13:34:41.808583206 +0000] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 1 work q stack objects - freed 1 op stack objects +[28/Mar/2026:13:34:41.814916197 +0000] - INFO - main - slapd stopped. +[28/Mar/2026:13:34:43.530101400 +0000] - NOTICE - slapd_system_isFIPS - Can not access /proc/sys/crypto/fips_enabled - assuming FIPS is OFF +[28/Mar/2026:13:34:43.554254843 +0000] - INFO - main - 389-Directory/2.7.0 B2026.064.0000 starting up +[28/Mar/2026:13:34:43.563250152 +0000] - INFO - main - Setting the maximum file descriptor limit to: 524288 +[28/Mar/2026:13:34:43.576416207 +0000] - INFO - PBKDF2-SHA1 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:43.585312437 +0000] - INFO - PBKDF2-SHA1 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:43.594498008 +0000] - INFO - PBKDF2-SHA256 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:43.603623119 +0000] - INFO - PBKDF2-SHA512 - Number of iterations set to 100000 from default +[28/Mar/2026:13:34:43.725867905 +0000] - INFO - PBKDF2_SHA256 - Based on CPU performance, chose 2048 rounds +[28/Mar/2026:13:34:43.735852483 +0000] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 +[28/Mar/2026:13:34:43.746621687 +0000] - NOTICE - bdb_start_autotune - found 32622192k physical memory +[28/Mar/2026:13:34:43.763925211 +0000] - NOTICE - bdb_start_autotune - found 15584132k available +[28/Mar/2026:13:34:43.784517403 +0000] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 1572864k +[28/Mar/2026:13:34:43.804870452 +0000] - NOTICE - bdb_start_autotune - cache autosizing: userRoot entry cache (1 total): 5963776k diff --git a/packages/freeipa/_dev/deploy/docker/sample_logs/krb5kdc.log b/packages/freeipa/_dev/deploy/docker/sample_logs/krb5kdc.log new file mode 100644 index 00000000000..400227fe59e --- /dev/null +++ b/packages/freeipa/_dev/deploy/docker/sample_logs/krb5kdc.log @@ -0,0 +1,50 @@ +Mar 28 15:22:16 ipa.example.test krb5kdc[74662](info): SSSD IdP plugin loaded +Mar 28 15:22:16 ipa.example.test krb5kdc[74662](info): Loaded +Mar 28 15:22:16 ipa.example.test krb5kdc[74662](info): setting up network... +Mar 28 15:22:16 ipa.example.test krb5kdc[74662](info): setsockopt(8,IPV6_V6ONLY,1) worked +Mar 28 15:22:16 ipa.example.test krb5kdc[74662](info): setsockopt(10,IPV6_V6ONLY,1) worked +Mar 28 15:22:16 ipa.example.test krb5kdc[74662](info): set up 4 sockets +Mar 28 15:22:16 ipa.example.test krb5kdc[74663](info): creating 20 worker processes +Mar 28 15:22:16 ipa.example.test krb5kdc[74665](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74664](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74667](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74668](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74669](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74670](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74672](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74673](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74674](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74675](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74677](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74676](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74679](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74680](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74681](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74683](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74663](info): closing down fd 10 +Mar 28 15:22:16 ipa.example.test krb5kdc[74663](info): closing down fd 9 +Mar 28 15:22:16 ipa.example.test krb5kdc[74663](info): closing down fd 8 +Mar 28 15:22:16 ipa.example.test krb5kdc[74663](info): closing down fd 7 +Mar 28 15:22:16 ipa.example.test krb5kdc[74684](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74685](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74686](info): commencing operation +Mar 28 15:22:16 ipa.example.test krb5kdc[74687](info): commencing operation +Mar 28 15:22:35 ipa.example.test krb5kdc[74665](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: NEEDED_PREAUTH: admin@EXAMPLE.TEST for krbtgt/EXAMPLE.TEST@EXAMPLE.TEST, Additional pre-authentication required +Mar 28 15:22:35 ipa.example.test krb5kdc[74665](info): closing down fd 11 +Mar 28 15:22:35 ipa.example.test krb5kdc[74685](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: ISSUE: authtime 1774711355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, admin@EXAMPLE.TEST for krbtgt/EXAMPLE.TEST@EXAMPLE.TEST +Mar 28 15:22:35 ipa.example.test krb5kdc[74685](info): closing down fd 11 +Mar 28 15:22:36 ipa.example.test krb5kdc[74674](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: ISSUE: authtime 1774711355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, admin@EXAMPLE.TEST for HTTP/ipa.example.test@EXAMPLE.TEST +Mar 28 15:22:36 ipa.example.test krb5kdc[74674](info): closing down fd 11 +Mar 28 15:22:36 ipa.example.test krb5kdc[74687](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: ISSUE: authtime 1774711355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, HTTP/ipa.example.test@EXAMPLE.TEST for ldap/ipa.example.test@EXAMPLE.TEST +Mar 28 15:22:36 ipa.example.test krb5kdc[74687](info): ... CONSTRAINED-DELEGATION s4u-client=admin@EXAMPLE.TEST +Mar 28 15:22:36 ipa.example.test krb5kdc[74687](info): closing down fd 11 +Mar 28 15:22:41 ipa.example.test krb5kdc[74687](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: NEEDED_PREAUTH: admin@EXAMPLE.TEST for krbtgt/EXAMPLE.TEST@EXAMPLE.TEST, Additional pre-authentication required +Mar 28 15:22:41 ipa.example.test krb5kdc[74687](info): closing down fd 11 +Mar 28 15:22:41 ipa.example.test krb5kdc[74676](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: ISSUE: authtime 1774711361, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, admin@EXAMPLE.TEST for krbtgt/EXAMPLE.TEST@EXAMPLE.TEST +Mar 28 15:22:41 ipa.example.test krb5kdc[74676](info): closing down fd 11 +Mar 28 15:22:41 ipa.example.test krb5kdc[74681](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: CLIENT KEY EXPIRED: testuser1@EXAMPLE.TEST for krbtgt/EXAMPLE.TEST@EXAMPLE.TEST, Password has expired +Mar 28 15:22:41 ipa.example.test krb5kdc[74681](info): closing down fd 11 +Mar 28 15:22:41 ipa.example.test krb5kdc[74687](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: NEEDED_PREAUTH: testuser1@EXAMPLE.TEST for kadmin/changepw@EXAMPLE.TEST, Additional pre-authentication required +Mar 28 15:22:41 ipa.example.test krb5kdc[74687](info): closing down fd 11 +Mar 28 15:22:41 ipa.example.test krb5kdc[74670](info): preauth (spake) verify failure: Preauthentication failed +Mar 28 15:22:41 ipa.example.test krb5kdc[74670](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.28.0.10: PREAUTH_FAILED: testuser1@EXAMPLE.TEST for kadmin/changepw@EXAMPLE.TEST, Preauthentication failed diff --git a/packages/freeipa/changelog.yml b/packages/freeipa/changelog.yml new file mode 100644 index 00000000000..5abd06a34a2 --- /dev/null +++ b/packages/freeipa/changelog.yml @@ -0,0 +1,5 @@ +- version: "0.1.0" + changes: + - description: "Initial release of FreeIPA integration with 5 data streams, 5 alerting rule templates, and 3 transforms for cross-event enrichment." + type: enhancement + link: https://github.com/elastic/integrations/pull/17812 diff --git a/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json new file mode 100644 index 00000000000..9899f3c3847 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json @@ -0,0 +1,82 @@ +{ + "events": [ + { + "message": "0.RetrieveModificationsTask - [12/Mar/2026:21:27:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success] access session establish successfully when Certificate System acts as client" + }, + { + "message": "0.AuthorityMonitor - [12/Mar/2026:21:27:05 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=172.30.0.60][ServerHost=ipa1.lab.local][ServerPort=636][SubjectID=SYSTEM][Outcome=Failure][Info=connect:java.net.ConnectException: Connection refused] access session failed to establish when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-9 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:27:31 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.featureThread-42 - [12/Mar/2026:22:00:15 UTC] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][ClientHost=172.30.0.60][Outcome=Success][ReqID=23][CertSerialNum=15][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][SubjectDN=CN=client.lab.local,O=LAB.LOCAL] certificate request processed" + }, + { + "message": "0.featureThread-7 - [12/Mar/2026:22:05:30 UTC] [14] [6] [AuditEvent=AUDIT_LOG_SIGNING] signing audit log" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-4 - [12/Mar/2026:21:26:41 UTC] [14] [6] [AuditEvent=PROFILE_CERT_REQUEST][SubjectID=ipara][Outcome=Success][ReqID=0x9][ProfileID=caIPAserviceCert][CertSubject=CN=ipa1.lab.local,O=LAB.LOCAL] certificate request made with certificate profiles" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-4 - [12/Mar/2026:21:26:41 UTC] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=ipara][Outcome=Success][ReqID=0x9][CertSerialNum=0x9] certificate request processed" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-7 - [12/Mar/2026:21:26:46 UTC] [14] [6] [AuditEvent=AUTH][SubjectID=$NonRoleUser$ : ipara][Outcome=Success][AuthMgr=raCertAuth] authentication success" + }, + { + "message": "0.main - [12/Mar/2026:21:26:38 UTC] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Success] self tests execution (see selftests.log for details)" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-3 - [12/Mar/2026:21:26:41 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=172.30.0.60][ServerIP=172.30.0.60][SubjectID=CN=IPA RA,O=LAB.LOCAL][CertSerialNum=7][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success] access session establish success" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-3 - [12/Mar/2026:21:26:41 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$NonRoleUser$][Outcome=Success][aclResource=certServer.ee.profiles][Op=list] authorization success" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-3 - [12/Mar/2026:21:26:41 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.30.0.60][ServerIP=172.30.0.60][SubjectID=CN=IPA RA,O=LAB.LOCAL][CertSerialNum=7][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated" + }, + { + "message": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1 - [13/Mar/2026:08:26:35 UTC] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=ipara][Outcome=Success][Role=Certificate Manager Agents,Enterprise ACME Administrators,Registration Manager Agents,Security Domain Administrators] assume privileged role" + }, + { + "message": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-4 - [13/Mar/2026:08:26:35 UTC] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=][Op=][Info=ACL mapping not found; OK:CertRequestResource.enrollCert] authorization success" + }, + { + "message": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1 - [13/Mar/2026:08:40:43 UTC] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST][SubjectID=ipara][Outcome=Success][ReqID=12][CertSerialNum=0xb][RequestType=on-hold] certificate revocation/unrevocation request made" + }, + { + "message": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1 - [13/Mar/2026:08:40:43 UTC] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=ipara][Outcome=Success][ReqID=12][CertSerialNum=0xb][RequestType=on-hold][RevokeReasonNum=6][Approval=complete] certificate status change request processed" + }, + { + "message": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1 - [13/Mar/2026:08:41:10 UTC] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=ipara][Outcome=Success][ReqID=13][CertSerialNum=0xc][RequestType=revoke][RevocationReason=Key_Compromise][RevokeReasonNum=1][Approval=complete] certificate status change request processed" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-5 - [13/Mar/2026:09:00:01 UTC] [14] [6] [AuditEvent=CONFIG_CERT_PROFILE][SubjectID=ipara][Outcome=Success][Scope=certProfileRule][ParamNameValPairs=profileId;;caIPAserviceCert] cert profile config change" + }, + { + "message": "0.CRLIssuingPoint - [13/Mar/2026:10:00:00 UTC] [14] [6] [AuditEvent=FULL_CRL_GENERATION][SubjectID=ipara][Outcome=Success][CRLNum=42][CRLSize=15] full CRL generation" + }, + { + "message": "0.CRLIssuingPoint - [13/Mar/2026:10:00:02 UTC] [14] [6] [AuditEvent=DELTA_CRL_GENERATION][SubjectID=ipara][Outcome=Success][CRLNum=43][CRLSize=3] delta CRL generation" + }, + { + "message": "0.CryptoManager - [13/Mar/2026:10:00:05 UTC] [14] [6] [AuditEvent=CERT_SIGNING_INFO][SubjectID=$System$][Outcome=Success][Info=signingAlgorithm: SHA256withRSA] cert signing info" + }, + { + "message": "0.ProfileSubsystem - [13/Mar/2026:10:00:10 UTC] [14] [6] [AuditEvent=CERT_PROFILE_APPROVAL][SubjectID=admin][Outcome=Success][ProfileID=caIPAserviceCert][Op=approve] cert profile approval" + }, + { + "message": "0.OCSPService - [13/Mar/2026:10:00:15 UTC] [14] [6] [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=$System$][Outcome=Success] audit log startup" + }, + { + "message": "0.OCSPService - [13/Mar/2026:10:00:20 UTC] [14] [6] [AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit log shutdown" + }, + { + "message": "0.CRLService - [13/Mar/2026:10:00:25 UTC] [14] [6] [AuditEvent=CONFIG_CRL][SubjectID=admin][Outcome=Success][Scope=crlRule][ParamNameValPairs=enableCRLUpdates;;true] CRL configuration change" + }, + { + "message": "0.KRAService - [13/Mar/2026:10:00:30 UTC] [14] [6] [AuditEvent=KEY_RECOVERY_REQUEST][SubjectID=admin][Outcome=Success][ReqID=100] key recovery request" + } + ] +} diff --git a/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-config.yml b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-expected.json b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-expected.json new file mode 100644 index 00000000000..c2f3f4c3ea5 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-default.json-expected.json @@ -0,0 +1,1209 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-12T21:27:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_establish", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "start" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_ESTABLISH", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.RetrieveModificationsTask" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:27:05.000Z", + "destination": { + "port": 636 + }, + "event": { + "action": "ca_session_establish", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "type": [ + "start" + ] + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_ESTABLISH", + "info": "connect:java.net.ConnectException: Connection refused", + "server_host": "ipa1.lab.local", + "server_port": 636, + "thread": "0.AuthorityMonitor" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "hosts": [ + "ipa1.lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "SYSTEM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "SYSTEM", + "name": "SYSTEM" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-9 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T22:00:15.000Z", + "event": { + "action": "certificate_issue", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "15", + "subject": { + "distinguished_name": "CN=client.lab.local,O=LAB.LOCAL" + } + } + }, + "freeipa": { + "ca": { + "event_type": "CERT_REQUEST_PROCESSED", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "request_id": "23", + "serial_number": "15", + "subject_dn": "CN=client.lab.local,O=LAB.LOCAL", + "thread": "0.featureThread-42" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T22:05:30.000Z", + "event": { + "action": "audit_log_signing", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "event_type": "AUDIT_LOG_SIGNING", + "thread": "0.featureThread-7" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:26:41.000Z", + "event": { + "action": "certificate_request", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "file": { + "x509": { + "subject": { + "distinguished_name": "CN=ipa1.lab.local,O=LAB.LOCAL" + } + } + }, + "freeipa": { + "ca": { + "event_type": "PROFILE_CERT_REQUEST", + "profile": "caIPAserviceCert", + "request_id": "0x9", + "subject_dn": "CN=ipa1.lab.local,O=LAB.LOCAL", + "thread": "0.https-jsse-jss-nio-8443-exec-4" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-12T21:26:41.000Z", + "event": { + "action": "certificate_issue", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "x509": { + "serial_number": "0x9" + } + }, + "freeipa": { + "ca": { + "event_type": "CERT_REQUEST_PROCESSED", + "request_id": "0x9", + "serial_number": "0x9", + "thread": "0.https-jsse-jss-nio-8443-exec-4" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-12T21:26:46.000Z", + "event": { + "action": "ca_auth", + "category": [ + "authentication" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "auth_manager": "raCertAuth", + "event_type": "AUTH", + "thread": "0.https-jsse-jss-nio-8443-exec-7" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "$NonRoleUser$ : ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "$NonRoleUser$ : ipara", + "name": "$NonRoleUser$ : ipara" + } + }, + { + "@timestamp": "2026-03-12T21:26:38.000Z", + "event": { + "action": "selftests_execution", + "category": [ + "process" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "event_type": "SELFTESTS_EXECUTION", + "thread": "0.main" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "$System$" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "$System$", + "name": "$System$" + } + }, + { + "@timestamp": "2026-03-12T21:26:41.000Z", + "destination": { + "ip": "172.30.0.60" + }, + "event": { + "action": "ca_session_establish", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "start" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "7" + } + }, + "freeipa": { + "ca": { + "event_type": "ACCESS_SESSION_ESTABLISH", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "7", + "server_host": "172.30.0.60", + "thread": "0.https-jsse-jss-nio-8443-exec-3" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "IPA RA", + "CN=IPA RA,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=IPA RA,O=LAB.LOCAL", + "name": "IPA RA" + } + }, + { + "@timestamp": "2026-03-12T21:26:41.000Z", + "event": { + "action": "ca_auth", + "category": [ + "authentication" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "acl_op": "list", + "acl_resource": "certServer.ee.profiles", + "event_type": "AUTHZ", + "thread": "0.https-jsse-jss-nio-8443-exec-3" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "$NonRoleUser$" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "$NonRoleUser$", + "name": "$NonRoleUser$" + } + }, + { + "@timestamp": "2026-03-12T21:26:41.000Z", + "destination": { + "ip": "172.30.0.60" + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "7" + } + }, + "freeipa": { + "ca": { + "event_type": "ACCESS_SESSION_TERMINATED", + "info": "serverAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "7", + "server_host": "172.30.0.60", + "thread": "0.https-jsse-jss-nio-8443-exec-3" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "IPA RA", + "CN=IPA RA,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=IPA RA,O=LAB.LOCAL", + "name": "IPA RA" + } + }, + { + "@timestamp": "2026-03-13T08:26:35.000Z", + "event": { + "action": "ca_role_assume", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "event_type": "ROLE_ASSUME", + "role": "Certificate Manager Agents,Enterprise ACME Administrators,Registration Manager Agents,Security Domain Administrators", + "thread": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-13T08:26:35.000Z", + "event": { + "action": "ca_auth", + "category": [ + "authentication" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "acl_op": "", + "acl_resource": "", + "event_type": "AUTHZ", + "info": "ACL mapping not found; OK:CertRequestResource.enrollCert", + "thread": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-4" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "$Unidentified$" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "$Unidentified$", + "name": "$Unidentified$" + } + }, + { + "@timestamp": "2026-03-13T08:40:43.000Z", + "event": { + "action": "certificate_status_change_request", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "file": { + "x509": { + "serial_number": "0xb" + } + }, + "freeipa": { + "ca": { + "event_type": "CERT_STATUS_CHANGE_REQUEST", + "request_id": "12", + "request_type": "on-hold", + "serial_number": "0xb", + "thread": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-13T08:40:43.000Z", + "event": { + "action": "certificate_revoke", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "x509": { + "serial_number": "0xb" + } + }, + "freeipa": { + "ca": { + "approval": "complete", + "event_type": "CERT_STATUS_CHANGE_REQUEST_PROCESSED", + "request_id": "12", + "request_type": "on-hold", + "revocation_reason": "6", + "serial_number": "0xb", + "thread": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-13T08:41:10.000Z", + "event": { + "action": "certificate_revoke", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "x509": { + "serial_number": "0xc" + } + }, + "freeipa": { + "ca": { + "approval": "complete", + "event_type": "CERT_STATUS_CHANGE_REQUEST_PROCESSED", + "request_id": "13", + "request_type": "revoke", + "revocation_reason": "Key_Compromise", + "serial_number": "0xc", + "thread": "0.ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-13T09:00:01.000Z", + "event": { + "action": "cert_profile_config", + "category": [ + "configuration" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "change" + ] + }, + "freeipa": { + "ca": { + "event_type": "CONFIG_CERT_PROFILE", + "scope": "certProfileRule", + "thread": "0.https-jsse-jss-nio-8443-exec-5" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-13T10:00:00.000Z", + "event": { + "action": "crl_generation", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "crl_number": "42", + "crl_size": 15, + "event_type": "FULL_CRL_GENERATION", + "thread": "0.CRLIssuingPoint" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-13T10:00:02.000Z", + "event": { + "action": "crl_generation", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "crl_number": "43", + "crl_size": 3, + "event_type": "DELTA_CRL_GENERATION", + "thread": "0.CRLIssuingPoint" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-13T10:00:05.000Z", + "event": { + "action": "signing_info", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "event_type": "CERT_SIGNING_INFO", + "info": "signingAlgorithm: SHA256withRSA", + "thread": "0.CryptoManager" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "$System$" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "$System$", + "name": "$System$" + } + }, + { + "@timestamp": "2026-03-13T10:00:10.000Z", + "event": { + "action": "cert_profile_approval", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "acl_op": "approve", + "event_type": "CERT_PROFILE_APPROVAL", + "profile": "caIPAserviceCert", + "thread": "0.ProfileSubsystem" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "admin" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "admin", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T10:00:15.000Z", + "event": { + "action": "audit_log_startup", + "category": [ + "process" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "event_type": "AUDIT_LOG_STARTUP", + "thread": "0.OCSPService" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "$System$" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "$System$", + "name": "$System$" + } + }, + { + "@timestamp": "2026-03-13T10:00:20.000Z", + "event": { + "action": "audit_log_shutdown", + "category": [ + "process" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "event_type": "AUDIT_LOG_SHUTDOWN", + "thread": "0.OCSPService" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "$System$" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "$System$", + "name": "$System$" + } + }, + { + "@timestamp": "2026-03-13T10:00:25.000Z", + "event": { + "action": "config_crl", + "category": [ + "configuration" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "change" + ] + }, + "freeipa": { + "ca": { + "event_type": "CONFIG_CRL", + "scope": "crlRule", + "thread": "0.CRLService" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "admin" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "admin", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T10:00:30.000Z", + "event": { + "action": "key_recovery_request", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "ca": { + "event_type": "KEY_RECOVERY_REQUEST", + "request_id": "100", + "thread": "0.KRAService" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "admin" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "admin", + "name": "admin" + } + } + ] +} diff --git a/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json new file mode 100644 index 00000000000..b0f519848d3 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json @@ -0,0 +1,64 @@ +{ + "events": [ + { + "message": "0.https-jsse-jss-nio-8443-exec-7 - [12/Mar/2026:21:26:46 UTC] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=ipara][Outcome=Success][ReqID=0xa][CertSerialNum=0xa] certificate request processed" + }, + { + "message": "0.https-jsse-jss-nio-8443-exec-7 - [12/Mar/2026:21:26:46 UTC] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=172.30.0.60][ServerIP=172.30.0.60][SubjectID=CN=IPA RA,O=LAB.LOCAL][CertSerialNum=7][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated" + }, + { + "message": "0.LDAPConnThread-0 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-0 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.AuthorityMonitor - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=172.30.0.60][ServerHost=ipa1.lab.local][ServerPort=636][SubjectID=SYSTEM][Outcome=Failure][Info=connect:java.net.ConnectException: Connection refused] access session failed to establish when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-1 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-1 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-2 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-2 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-3 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-3 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-4 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-4 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.ProfileChangeMonitor - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=172.30.0.60][ServerHost=ipa1.lab.local][ServerPort=636][SubjectID=SYSTEM][Outcome=Failure][Info=connect:java.net.ConnectException: Connection refused] access session failed to establish when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-6 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-5 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertReceived: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-5 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.LDAPConnThread-6 ldaps://ipa1.lab.local:636 - [12/Mar/2026:21:26:48 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=172.30.0.60][ServerHost=172.30.0.60][ServerPort=636][SubjectID=CN=ipa1.lab.local,O=LAB.LOCAL][CertSerialNum=8][IssuerDN=CN=Certificate Authority,O=LAB.LOCAL][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client" + }, + { + "message": "0.AuthorityMonitor - [12/Mar/2026:21:26:49 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=172.30.0.60][ServerHost=ipa1.lab.local][ServerPort=636][SubjectID=SYSTEM][Outcome=Failure][Info=connect:java.net.ConnectException: Connection refused] access session failed to establish when Certificate System acts as client" + }, + { + "message": "0.ProfileChangeMonitor - [12/Mar/2026:21:26:49 UTC] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=172.30.0.60][ServerHost=ipa1.lab.local][ServerPort=636][SubjectID=SYSTEM][Outcome=Failure][Info=connect:java.net.ConnectException: Connection refused] access session failed to establish when Certificate System acts as client" + } + ] +} diff --git a/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-config.yml b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-expected.json b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-expected.json new file mode 100644 index 00000000000..cab66535335 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/_dev/test/pipeline/test-real-logs.json-expected.json @@ -0,0 +1,1254 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-12T21:26:46.000Z", + "event": { + "action": "certificate_issue", + "category": [ + "iam" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "x509": { + "serial_number": "0xa" + } + }, + "freeipa": { + "ca": { + "event_type": "CERT_REQUEST_PROCESSED", + "request_id": "0xa", + "serial_number": "0xa", + "thread": "0.https-jsse-jss-nio-8443-exec-7" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "ipara" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "ipara", + "name": "ipara" + } + }, + { + "@timestamp": "2026-03-12T21:26:46.000Z", + "destination": { + "ip": "172.30.0.60" + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "7" + } + }, + "freeipa": { + "ca": { + "event_type": "ACCESS_SESSION_TERMINATED", + "info": "serverAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "7", + "server_host": "172.30.0.60", + "thread": "0.https-jsse-jss-nio-8443-exec-7" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "IPA RA", + "CN=IPA RA,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=IPA RA,O=LAB.LOCAL", + "name": "IPA RA" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-0 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-0 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "port": 636 + }, + "event": { + "action": "ca_session_establish", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "type": [ + "start" + ] + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_ESTABLISH", + "info": "connect:java.net.ConnectException: Connection refused", + "server_host": "ipa1.lab.local", + "server_port": 636, + "thread": "0.AuthorityMonitor" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "hosts": [ + "ipa1.lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "SYSTEM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "SYSTEM", + "name": "SYSTEM" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-1 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-1 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-2 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-2 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-3 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-3 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-4 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-4 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "port": 636 + }, + "event": { + "action": "ca_session_establish", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "type": [ + "start" + ] + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_ESTABLISH", + "info": "connect:java.net.ConnectException: Connection refused", + "server_host": "ipa1.lab.local", + "server_port": 636, + "thread": "0.ProfileChangeMonitor" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "hosts": [ + "ipa1.lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "SYSTEM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "SYSTEM", + "name": "SYSTEM" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-6 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertReceived: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-5 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-5 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:48.000Z", + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ca_session_terminate", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "x509": { + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=LAB.LOCAL" + }, + "serial_number": "8" + } + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "info": "clientAlertSent: CLOSE_NOTIFY", + "issuer_dn": "CN=Certificate Authority,O=LAB.LOCAL", + "serial_number": "8", + "server_host": "172.30.0.60", + "server_port": 636, + "thread": "0.LDAPConnThread-6 ldaps://ipa1.lab.local:636" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "ipa1.lab.local", + "CN=ipa1.lab.local,O=LAB.LOCAL" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "CN=ipa1.lab.local,O=LAB.LOCAL", + "name": "ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-12T21:26:49.000Z", + "destination": { + "port": 636 + }, + "event": { + "action": "ca_session_establish", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "type": [ + "start" + ] + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_ESTABLISH", + "info": "connect:java.net.ConnectException: Connection refused", + "server_host": "ipa1.lab.local", + "server_port": 636, + "thread": "0.AuthorityMonitor" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "hosts": [ + "ipa1.lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "SYSTEM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "SYSTEM", + "name": "SYSTEM" + } + }, + { + "@timestamp": "2026-03-12T21:26:49.000Z", + "destination": { + "port": 636 + }, + "event": { + "action": "ca_session_establish", + "category": [ + "session" + ], + "dataset": "freeipa.ca_audit", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "type": [ + "start" + ] + }, + "freeipa": { + "ca": { + "event_type": "CLIENT_ACCESS_SESSION_ESTABLISH", + "info": "connect:java.net.ConnectException: Connection refused", + "server_host": "ipa1.lab.local", + "server_port": 636, + "thread": "0.ProfileChangeMonitor" + } + }, + "observer": { + "product": "FreeIPA", + "type": "ca", + "vendor": "Red Hat" + }, + "related": { + "hosts": [ + "ipa1.lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "SYSTEM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "id": "SYSTEM", + "name": "SYSTEM" + } + } + ] +} diff --git a/packages/freeipa/data_stream/ca_audit/_dev/test/system/test-default-config.yml b/packages/freeipa/data_stream/ca_audit/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..c7648d68f7d --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/_dev/test/system/test-default-config.yml @@ -0,0 +1,5 @@ +vars: ~ +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/ca_audit" diff --git a/packages/freeipa/data_stream/ca_audit/agent/stream/stream.yml.hbs b/packages/freeipa/data_stream/ca_audit/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..795d2c9fc82 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/agent/stream/stream.yml.hbs @@ -0,0 +1,16 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +prospector.scanner.symlinks: true +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} diff --git a/packages/freeipa/data_stream/ca_audit/elasticsearch/ingest_pipeline/default.yml b/packages/freeipa/data_stream/ca_audit/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..d2331607993 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,445 @@ +--- +description: Pipeline for FreeIPA Dogtag CA signed audit events. +processors: + # Static metadata + - set: + tag: set_event_kind + field: event.kind + value: event + - set: + tag: set_event_module + field: event.module + value: freeipa + - set: + tag: set_event_dataset + field: event.dataset + value: freeipa.ca_audit + + # Parse thread prefix, timestamp, and bracket section + - grok: + tag: grok_ca_audit_line + field: message + patterns: + - "^%{DATA:freeipa.ca.thread} - \\[%{DATA:_temp.raw_ts}\\] \\[%{INT:_temp.level1}\\] \\[%{INT:_temp.level2}\\] \\[%{GREEDYDATA:_temp.kv_section}\\]%{GREEDYDATA:_temp.description}" + + # Parse timestamp + - date: + tag: date_parse + field: _temp.raw_ts + target_field: "@timestamp" + formats: + - dd/MMM/yyyy:HH:mm:ss zzz + - dd/MMM/yyyy:HH:mm:ss Z + + # Extract key-value pairs from bracketed section using script + - script: + tag: script_parse_kv + lang: painless + ignore_failure: true + source: | + def section = ctx._temp?.kv_section; + if (section == null) return; + def kv = new HashMap(); + // section looks like: AuditEvent=VALUE][Key=Value][Key2=Value2 + // (the outer brackets were consumed by grok) + def parts = /\]\[/.split(section); + for (def part : parts) { + int eq = part.indexOf('='); + if (eq > 0) { + def key = part.substring(0, eq); + def val = part.substring(eq + 1); + kv.put(key, val); + } + } + ctx._temp.put('kv', kv); + + # Map parsed fields + - set: + tag: set_event_type + if: ctx._temp?.kv?.AuditEvent != null + field: freeipa.ca.event_type + copy_from: _temp.kv.AuditEvent + - set: + tag: set_subject_id + if: "ctx._temp?.kv?.SubjectID != null && ctx._temp.kv.SubjectID != '--'" + field: user.id + copy_from: _temp.kv.SubjectID + # Extract short name from SubjectID: prefer CN= component from DN, + # fall back to the raw SubjectID for simple names like "ipara" + - grok: + tag: grok_subject_cn + if: "ctx._temp?.kv?.SubjectID != null && ctx._temp.kv.SubjectID != '--'" + field: _temp.kv.SubjectID + ignore_failure: true + patterns: + - "CN=%{DATA:user.name}," + - "cn=%{DATA:user.name}," + - set: + tag: set_user_name_fallback + if: "ctx._temp?.kv?.SubjectID != null && ctx._temp.kv.SubjectID != '--' && ctx.user?.name == null" + field: user.name + copy_from: _temp.kv.SubjectID + - set: + tag: set_client_host + if: ctx._temp?.kv?.ClientHost != null + field: source.ip + copy_from: _temp.kv.ClientHost + - set: + tag: set_client_ip + if: ctx._temp?.kv?.ClientIP != null && ctx.source?.ip == null + field: source.ip + copy_from: _temp.kv.ClientIP + - set: + tag: set_server_host + if: ctx._temp?.kv?.ServerHost != null + field: freeipa.ca.server_host + copy_from: _temp.kv.ServerHost + - set: + tag: set_server_ip + if: ctx._temp?.kv?.ServerIP != null && ctx.freeipa?.ca?.server_host == null + field: freeipa.ca.server_host + copy_from: _temp.kv.ServerIP + - convert: + tag: convert_server_port + if: ctx._temp?.kv?.ServerPort != null + field: _temp.kv.ServerPort + target_field: freeipa.ca.server_port + type: integer + - set: + tag: set_info + if: ctx._temp?.kv?.Info != null + field: freeipa.ca.info + copy_from: _temp.kv.Info + - set: + tag: set_cert_serial + if: ctx._temp?.kv?.CertSerialNum != null + field: freeipa.ca.serial_number + copy_from: _temp.kv.CertSerialNum + - set: + tag: set_issuer_dn + if: ctx._temp?.kv?.IssuerDN != null + field: freeipa.ca.issuer_dn + copy_from: _temp.kv.IssuerDN + - set: + tag: set_request_id + if: ctx._temp?.kv?.ReqID != null + field: freeipa.ca.request_id + copy_from: _temp.kv.ReqID + - set: + tag: set_profile + if: ctx._temp?.kv?.ProfileID != null + field: freeipa.ca.profile + copy_from: _temp.kv.ProfileID + - set: + tag: set_request_type + if: ctx._temp?.kv?.RequestType != null + field: freeipa.ca.request_type + copy_from: _temp.kv.RequestType + - set: + tag: set_subject_dn + if: ctx._temp?.kv?.SubjectDN != null + field: freeipa.ca.subject_dn + copy_from: _temp.kv.SubjectDN + - set: + tag: set_revocation_reason + if: ctx._temp?.kv?.RevocationReason != null + field: freeipa.ca.revocation_reason + copy_from: _temp.kv.RevocationReason + - set: + tag: set_auth_manager + if: ctx._temp?.kv?.AuthMgr != null + field: freeipa.ca.auth_manager + copy_from: _temp.kv.AuthMgr + - set: + tag: set_acl_resource + if: ctx._temp?.kv?.aclResource != null + field: freeipa.ca.acl_resource + copy_from: _temp.kv.aclResource + - set: + tag: set_acl_op + if: ctx._temp?.kv?.Op != null + field: freeipa.ca.acl_op + copy_from: _temp.kv.Op + - set: + tag: set_role + if: ctx._temp?.kv?.Role != null + field: freeipa.ca.role + copy_from: _temp.kv.Role + - set: + tag: set_cert_subject + if: ctx._temp?.kv?.CertSubject != null + field: freeipa.ca.subject_dn + copy_from: _temp.kv.CertSubject + - set: + tag: set_scope + if: ctx._temp?.kv?.Scope != null + field: freeipa.ca.scope + copy_from: _temp.kv.Scope + - set: + tag: set_revoke_reason_num + if: ctx._temp?.kv?.RevokeReasonNum != null && ctx.freeipa?.ca?.revocation_reason == null + field: freeipa.ca.revocation_reason + copy_from: _temp.kv.RevokeReasonNum + - set: + tag: set_approval + if: ctx._temp?.kv?.Approval != null + field: freeipa.ca.approval + copy_from: _temp.kv.Approval + - set: + tag: set_crl_number + if: ctx._temp?.kv?.CRLNum != null + field: freeipa.ca.crl_number + copy_from: _temp.kv.CRLNum + - convert: + tag: convert_crl_size + if: ctx._temp?.kv?.CRLSize != null + field: _temp.kv.CRLSize + target_field: freeipa.ca.crl_size + type: long + + # Map certificate fields to ECS x509 + - set: + tag: set_x509_serial + if: ctx.freeipa?.ca?.serial_number != null + field: file.x509.serial_number + copy_from: freeipa.ca.serial_number + - set: + tag: set_x509_subject + if: ctx.freeipa?.ca?.subject_dn != null + field: file.x509.subject.distinguished_name + copy_from: freeipa.ca.subject_dn + - set: + tag: set_x509_issuer + if: ctx.freeipa?.ca?.issuer_dn != null + field: file.x509.issuer.distinguished_name + copy_from: freeipa.ca.issuer_dn + + # Map Outcome to event.outcome + - script: + tag: script_event_outcome + lang: painless + ignore_failure: true + source: | + def outcome = ctx._temp?.kv?.Outcome; + if (outcome == null) return; + if (outcome.equalsIgnoreCase("Success")) { + ctx.event.put("outcome", "success"); + } else if (outcome.equalsIgnoreCase("Failure")) { + ctx.event.put("outcome", "failure"); + } else { + ctx.event.put("outcome", "unknown"); + } + + # Map AuditEvent to event.action, event.category, event.type + - script: + tag: script_event_action + lang: painless + ignore_failure: true + source: | + def eventType = ctx.freeipa?.ca?.event_type; + if (eventType == null) return; + def action = ""; + def category = new ArrayList(); + def type = new ArrayList(); + if (eventType.equals("PROFILE_CERT_REQUEST")) { + action = "certificate_request"; + category.add("iam"); + type.add("info"); + } else if (eventType.equals("CERT_REQUEST_PROCESSED")) { + action = "certificate_issue"; + category.add("iam"); + type.add("creation"); + } else if (eventType.equals("CERT_STATUS_CHANGE_REQUEST")) { + action = "certificate_status_change_request"; + category.add("iam"); + type.add("info"); + } else if (eventType.equals("CERT_STATUS_CHANGE_REQUEST_PROCESSED")) { + action = "certificate_revoke"; + category.add("iam"); + type.add("change"); + } else if (eventType.equals("AUTH") || eventType.equals("AUTHZ")) { + action = "ca_auth"; + category.add("authentication"); + type.add("info"); + } else if (eventType.equals("ACCESS_SESSION_ESTABLISH") || eventType.equals("CLIENT_ACCESS_SESSION_ESTABLISH")) { + action = "ca_session_establish"; + category.add("session"); + type.add("start"); + } else if (eventType.equals("ACCESS_SESSION_TERMINATED") || eventType.equals("CLIENT_ACCESS_SESSION_TERMINATED")) { + action = "ca_session_terminate"; + category.add("session"); + type.add("end"); + } else if (eventType.equals("FULL_CRL_GENERATION") || eventType.equals("DELTA_CRL_GENERATION")) { + action = "crl_generation"; + category.add("iam"); + type.add("info"); + } else if (eventType.equals("AUDIT_LOG_SIGNING")) { + action = "audit_log_signing"; + category.add("iam"); + type.add("info"); + } else if (eventType.equals("SELFTESTS_EXECUTION")) { + action = "selftests_execution"; + category.add("process"); + type.add("info"); + } else if (eventType.equals("ROLE_ASSUME")) { + action = "ca_role_assume"; + category.add("iam"); + type.add("info"); + } else if (eventType.equals("CONFIG_CERT_PROFILE")) { + action = "cert_profile_config"; + category.add("configuration"); + type.add("change"); + } else if (eventType.equals("CERT_PROFILE_APPROVAL")) { + action = "cert_profile_approval"; + category.add("iam"); + type.add("info"); + } else if (eventType.equals("CERT_SIGNING_INFO") || eventType.equals("CRL_SIGNING_INFO") || eventType.equals("OCSP_SIGNING_INFO")) { + action = "signing_info"; + category.add("iam"); + type.add("info"); + } else if (eventType.startsWith("CONFIG_")) { + action = eventType.toLowerCase(); + category.add("configuration"); + type.add("change"); + } else if (eventType.equals("AUDIT_LOG_STARTUP") || eventType.equals("AUDIT_LOG_SHUTDOWN") || eventType.equals("LOG_PATH_CHANGE")) { + action = eventType.toLowerCase(); + category.add("process"); + type.add("info"); + } else if (eventType.startsWith("KEY_RECOVERY_") || eventType.startsWith("KEY_GEN_") || eventType.startsWith("SERVER_SIDE_KEYGEN_")) { + action = eventType.toLowerCase(); + category.add("iam"); + type.add("info"); + } else if (eventType.startsWith("OCSP_")) { + action = eventType.toLowerCase(); + category.add("iam"); + type.add("info"); + } else { + action = eventType.toLowerCase(); + category.add("iam"); + type.add("info"); + } + ctx.event.put("action", action); + ctx.event.put("category", category); + ctx.event.put("type", type); + + # Map server_host/server_port to ECS destination fields + - set: + tag: set_destination_ip + if: "ctx.freeipa?.ca?.server_host != null && ctx.freeipa.ca.server_host ==~ /^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$/" + field: destination.ip + copy_from: freeipa.ca.server_host + - set: + tag: set_server_ip + if: ctx.destination?.ip != null + field: server.ip + copy_from: destination.ip + - set: + tag: set_destination_port + if: ctx.freeipa?.ca?.server_port != null + field: destination.port + copy_from: freeipa.ca.server_port + + # Service metadata + - set: + tag: set_service_type + field: service.type + value: freeipa + + # Related fields + - append: + tag: append_related_user + field: related.user + value: "{{user.name}}" + if: ctx.user?.name != null + allow_duplicates: false + - append: + tag: append_related_user_id + field: related.user + value: "{{user.id}}" + if: ctx.user?.id != null + allow_duplicates: false + - append: + tag: append_related_ip + field: related.ip + value: "{{source.ip}}" + if: ctx.source?.ip != null + allow_duplicates: false + - append: + tag: append_related_ip_server + field: related.ip + value: "{{freeipa.ca.server_host}}" + if: "ctx.freeipa?.ca?.server_host != null && ctx.freeipa.ca.server_host ==~ /^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$/" + allow_duplicates: false + - append: + tag: append_related_hosts_server + field: related.hosts + value: "{{freeipa.ca.server_host}}" + if: "ctx.freeipa?.ca?.server_host != null && !(ctx.freeipa.ca.server_host ==~ /^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$/)" + allow_duplicates: false + + # GeoIP enrichment + - geoip: + tag: geoip_source + field: source.ip + target_field: source.geo + ignore_missing: true + ignore_failure: true + - geoip: + tag: geoip_source_asn + field: source.ip + target_field: source.as + database_file: GeoLite2-ASN.mmdb + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_asn + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + tag: rename_as_org + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + + # Observer metadata + - set: + tag: set_observer_vendor + field: observer.vendor + value: Red Hat + - set: + tag: set_observer_product + field: observer.product + value: FreeIPA + - set: + tag: set_observer_type + field: observer.type + value: ca + - set: + tag: set_observer_hostname + field: observer.hostname + copy_from: host.hostname + ignore_failure: true + + # Clean up + - remove: + tag: remove_temp + field: _temp + ignore_missing: true + - remove: + tag: remove_message + field: message + ignore_missing: true + - remove: + tag: remove_event_original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + field: event.original + ignore_missing: true + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} failed with message: {{ _ingest.on_failure_message }}" diff --git a/packages/freeipa/data_stream/ca_audit/fields/base-fields.yml b/packages/freeipa/data_stream/ca_audit/fields/base-fields.yml new file mode 100644 index 00000000000..cd45f8e426d --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: "@timestamp" + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + value: freeipa + description: Event module. +- name: event.dataset + type: constant_keyword + value: freeipa.ca_audit + description: Event dataset. diff --git a/packages/freeipa/data_stream/ca_audit/fields/ecs.yml b/packages/freeipa/data_stream/ca_audit/fields/ecs.yml new file mode 100644 index 00000000000..f7b26a3f11f --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/fields/ecs.yml @@ -0,0 +1,102 @@ +- name: ecs.version + type: keyword + description: ECS version this event conforms to. +- name: error.message + type: match_only_text + description: Error message. +- name: event.kind + type: keyword + description: The kind of event. +- name: event.category + type: keyword + description: Event category for ECS compatibility. +- name: event.type + type: keyword + description: Event type for ECS compatibility. +- name: event.action + type: keyword + description: The action captured by the event. +- name: event.outcome + type: keyword + description: The outcome of the event (success or failure). +- name: observer.vendor + type: keyword + description: Vendor of the observer. +- name: observer.product + type: keyword + description: Product name of the observer. +- name: observer.type + type: keyword + description: Type of the observer component. +- name: observer.hostname + type: keyword + description: Hostname of the observer. +- name: service.type + type: keyword + description: Service type identifier. +- name: source.ip + type: ip + description: IP address of the client. +- name: destination.ip + type: ip + description: IP address of the server (from ServerHost). +- name: destination.port + type: long + description: Port of the server (from ServerPort). +- name: server.ip + type: ip + description: IP address of the server. +- name: user.name + type: keyword + description: Subject identity from the audit event. +- name: user.id + type: keyword + description: Subject ID from the audit event. +- name: file.x509.serial_number + type: keyword + description: Certificate serial number. +- name: file.x509.subject.distinguished_name + type: keyword + description: Certificate subject distinguished name. +- name: file.x509.issuer.distinguished_name + type: keyword + description: Certificate issuer distinguished name. +- name: related.user + type: keyword + description: All user identifiers seen in this event. +- name: related.ip + type: ip + description: All IP addresses seen in this event. +- name: related.hosts + type: keyword + description: All hostnames seen in this event. +- name: source.geo.city_name + type: keyword + description: City name from GeoIP lookup. +- name: source.geo.continent_name + type: keyword + description: Continent name from GeoIP lookup. +- name: source.geo.country_iso_code + type: keyword + description: Country ISO code from GeoIP lookup. +- name: source.geo.country_name + type: keyword + description: Country name from GeoIP lookup. +- name: source.geo.location + type: geo_point + description: Longitude and latitude from GeoIP lookup. +- name: source.geo.region_iso_code + type: keyword + description: Region ISO code from GeoIP lookup. +- name: source.geo.region_name + type: keyword + description: Region name from GeoIP lookup. +- name: source.as.number + type: long + description: Autonomous System Number from GeoIP ASN lookup. +- name: source.as.organization.name + type: keyword + description: Organization name from GeoIP ASN lookup. +- name: tags + type: keyword + description: List of keywords used to tag each event. diff --git a/packages/freeipa/data_stream/ca_audit/fields/fields.yml b/packages/freeipa/data_stream/ca_audit/fields/fields.yml new file mode 100644 index 00000000000..4cc8b54c859 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/fields/fields.yml @@ -0,0 +1,64 @@ +- name: freeipa.ca + type: group + description: Dogtag CA signed audit event fields. + fields: + - name: event_type + type: keyword + description: CA audit event type (for example, CLIENT_ACCESS_SESSION_ESTABLISH, CERT_REQUEST_PROCESSED). + - name: request_id + type: keyword + description: Certificate request ID. + - name: serial_number + type: keyword + description: Certificate serial number. + - name: subject_dn + type: keyword + description: Certificate subject distinguished name. + - name: profile + type: keyword + description: Certificate profile ID used for the request. + - name: request_type + type: keyword + description: Certificate request type (for example, enrollment, renewal). + - name: revocation_reason + type: keyword + description: Reason code for certificate revocation. + - name: auth_manager + type: keyword + description: Authentication manager used for the request. + - name: thread + type: keyword + description: Thread name from the CA audit log. + - name: server_host + type: keyword + description: Server hostname or IP from the audit event. + - name: server_port + type: integer + description: Server port from the audit event. + - name: info + type: match_only_text + description: Additional information from the audit event (can contain stack traces or long error messages). + - name: issuer_dn + type: keyword + description: Certificate issuer distinguished name. + - name: acl_resource + type: keyword + description: ACL resource name from authorization events. + - name: acl_op + type: keyword + description: ACL operation from authorization events. + - name: role + type: keyword + description: Role assumed in ROLE_ASSUME events. + - name: scope + type: keyword + description: Scope of the configuration change. + - name: approval + type: keyword + description: Approval status of certificate status change requests. + - name: crl_number + type: keyword + description: CRL sequence number from CRL generation events. + - name: crl_size + type: long + description: Number of entries in the generated CRL. diff --git a/packages/freeipa/data_stream/ca_audit/manifest.yml b/packages/freeipa/data_stream/ca_audit/manifest.yml new file mode 100644 index 00000000000..62abb21d2a8 --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/manifest.yml @@ -0,0 +1,37 @@ +title: CA Signed Audit Log +type: logs +streams: + - input: filestream + title: CA Signed Audit Log + description: Collect Dogtag CA signed audit events from pki-tomcat. + vars: + - name: paths + type: text + title: Log File Paths + multi: true + required: true + show_user: true + default: + - /var/log/pki/pki-tomcat/ca/signedAudit/ca_audit + - name: tags + type: text + title: Tags + multi: true + required: false + show_user: false + default: + - freeipa-ca-audit + - name: ignore_older + type: text + title: Ignore Older + description: Ignore log lines older than this duration. + required: false + show_user: false + default: 72h + - name: preserve_original_event + type: bool + title: Preserve Original Event + description: Preserve the raw log line in event.original. + required: false + show_user: true + default: false diff --git a/packages/freeipa/data_stream/ca_audit/sample_event.json b/packages/freeipa/data_stream/ca_audit/sample_event.json new file mode 100644 index 00000000000..87a5d8b9f9c --- /dev/null +++ b/packages/freeipa/data_stream/ca_audit/sample_event.json @@ -0,0 +1,102 @@ +{ + "server": { + "ip": "10.89.0.2" + }, + "log": { + "file": { + "inode": "14070368", + "path": "/var/log/pki/pki-tomcat/ca/signedAudit/ca_audit", + "device_id": "66306", + "fingerprint": "a04bc75ae3e18025de3dc6f0dc36c4e09a8db3f0c1ddafc3f5e33fe3f1554870" + }, + "offset": 252717 + }, + "destination": { + "port": 636, + "ip": "10.89.0.2" + }, + "source": { + "ip": "10.89.0.2" + }, + "freeipa": { + "ca": { + "issuer_dn": "CN=Certificate Authority,O=EXAMPLE.TEST", + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "server_host": "10.89.0.2", + "server_port": 636, + "serial_number": "8", + "thread": "0.LDAPConnThread-5 ldaps://ipa.example.test:636", + "info": "clientAlertReceived: CLOSE_NOTIFY" + } + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "ca" + }, + "@timestamp": "2026-04-01T10:19:23.000Z", + "file": { + "x509": { + "serial_number": "8", + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=EXAMPLE.TEST" + } + } + }, + "ecs": { + "version": "8.0.0" + }, + "related": { + "ip": [ + "10.89.0.2" + ], + "user": [ + "ipa.example.test", + "CN=ipa.example.test,O=EXAMPLE.TEST" + ] + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "family": "redhat", + "type": "linux", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2026-04-01T10:19:41Z", + "kind": "event", + "action": "ca_session_terminate", + "category": [ + "session" + ], + "type": [ + "end" + ], + "outcome": "success" + }, + "user": { + "name": "ipa.example.test", + "id": "CN=ipa.example.test,O=EXAMPLE.TEST" + } +} diff --git a/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json new file mode 100644 index 00000000000..6c2d080d10b --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json @@ -0,0 +1,88 @@ +{ + "events": [ + { + "message": "[15/Apr/2024:09:23:01.123456789 +0000] conn=62 fd=65 slot=65 connection from 192.168.1.50 to 192.168.1.10" + }, + { + "message": "[15/Apr/2024:09:23:01.234567890 +0000] conn=62 op=0 BIND dn=\"uid=admin,cn=users,cn=accounts,dc=example,dc=com\" method=128 version=3" + }, + { + "message": "[15/Apr/2024:09:23:01.345678901 +0000] conn=64 op=0 BIND dn=\"\" method=sasl version=3 mech=GSSAPI" + }, + { + "message": "[13/Mar/2026:07:57:42.203423658 +0000] conn=109 op=7 SRCH base=\"cn=sudo,dc=lab,dc=local\" scope=2 filter=\"(&(objectClass=ipasudorule)(ipaEnabledFlag=TRUE))\" attrs=\"objectClass cn\"" + }, + { + "message": "[13/Mar/2026:07:57:42.206196115 +0000] conn=109 op=7 RESULT err=0 tag=101 nentries=0 wtime=0.000356679 optime=0.002775282 etime=0.003128975 notes=P details=\"Paged Search\" pr_idx=0 pr_cookie=-1" + }, + { + "message": "[15/Apr/2024:09:23:03.456789012 +0000] conn=65 op=1 RESULT err=49 tag=97 nentries=0 wtime=0.000100000 optime=0.001200000 etime=0.001300000" + }, + { + "message": "[15/Apr/2024:09:23:05.012345678 +0000] conn=62 op=5 fd=65 closed - U1" + }, + { + "message": "[15/Apr/2024:09:23:01.567890123 +0000] conn=63 fd=66 slot=66 SSL connection from 192.168.1.51 to 192.168.1.10" + }, + { + "message": "[13/Mar/2026:08:41:08.298531008 +0000] conn=154 op=3 CMP dn=\"uid=admin,cn=users,cn=accounts,dc=lab,dc=local\" attr=\"uid\"" + }, + { + "message": "[13/Mar/2026:08:41:08.583725407 +0000] conn=155 op=3 EXT oid=\"1.3.6.1.4.1.4203.1.11.1\" name=\"IPA Password Manager\"" + }, + { + "message": "[13/Mar/2026:08:41:17.026772059 +0000] conn=157 op=3 RESULT err=49 tag=120 nentries=0 wtime=0.000276456 optime=0.005010135 etime=0.005282103" + }, + { + "message": "[13/Mar/2026:08:41:17.190224937 +0000] conn=158 op=0 RESULT err=49 tag=97 nentries=0 wtime=0.000264064 optime=0.151244853 etime=0.151503747 - Invalid credentials" + }, + { + "message": "[15/Apr/2024:09:23:04.678901234 +0000] conn=62 op=3 MOD dn=\"uid=testuser1,cn=users,cn=accounts,dc=example,dc=com\"" + }, + { + "message": "[15/Apr/2024:09:23:04.789012345 +0000] conn=62 op=4 DEL dn=\"cn=oldgroup,cn=groups,cn=accounts,dc=example,dc=com\"" + }, + { + "message": "[13/Mar/2026:08:41:38.465493511 +0000] conn=65 op=268 RESULT err=32 tag=101 nentries=0 wtime=0.000248993 optime=0.001741825 etime=0.001986250" + }, + { + "message": "[13/Mar/2026:08:42:01.123456789 +0000] conn=70 op=5 MODRDN dn=\"cn=oldname,cn=groups,cn=accounts,dc=lab,dc=local\" newSuperior=\"cn=groups,cn=accounts,dc=lab,dc=local\" newrdn=\"cn=newname\"" + }, + { + "message": "[15/Apr/2024:09:23:04.234567890 +0000] conn=62 op=2 ADD dn=\"cn=newgroup,cn=groups,cn=accounts,dc=example,dc=com\"" + }, + { + "message": "[15/Apr/2024:09:23:06.123456789 +0000] conn=62 op=6 ABANDON targetop=5 msgid=5 nentries=0 etime=0" + }, + { + "message": "[15/Apr/2024:09:23:07.234567890 +0000] conn=63 op=12 RESULT err=0 tag=101 nentries=234 etime=5.234000000 notes=U details=\"Partially Unindexed Filter\"" + }, + { + "message": "[15/Apr/2024:09:23:01.890123456 +0000] conn=66 op=0 BIND dn=\"\" method=sasl version=3 mech=EXTERNAL" + }, + { + "message": "[15/Apr/2024:09:23:08.345678901 +0000] conn=67 fd=68 closed - B1" + }, + { + "message": "[15/Mar/2026:14:01:25.377994588 +0000] conn=450 op=2 fd=239 Disconnect - Cleanly Closed Connection - U1" + }, + { + "message": "[15/Mar/2026:20:33:40.394870599 +0000] conn=485 fd=237 slot=237 connection from local to /run/slapd-LAB-LOCAL.socket" + }, + { + "message": "[15/Mar/2026:20:33:40.397890467 +0000] conn=485 AUTOBIND dn=\"cn=Directory Manager\"" + }, + { + "message": "[15/Apr/2024:09:24:01.123456789 +0000] conn=68 fd=69 closed - A1" + }, + { + "message": "[15/Apr/2024:09:24:02.234567890 +0000] conn=69 op=0 fd=70 Disconnect - T1" + }, + { + "message": "[13/Mar/2026:07:57:42.203423658 +0000] conn=Internal(0) op=0(internal) SRCH base=\"cn=config\" scope=0 filter=\"(objectclass=*)\" attrs=\"nsslapd-security nsslapd-ssl-check-hostname\"" + }, + { + "message": "[13/Mar/2026:07:57:42.203523658 +0000] conn=Internal(0) op=0(internal) RESULT err=0 tag=48 nentries=1 wtime=0.000050000 optime=0.000100000 etime=0.000150000" + } + ] +} diff --git a/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-config.yml b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-expected.json b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-expected.json new file mode 100644 index 00000000000..3d6609b03bd --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-default.json-expected.json @@ -0,0 +1,997 @@ +{ + "expected": [ + { + "@timestamp": "2024-04-15T09:23:01.123Z", + "client": { + "ip": "192.168.1.50" + }, + "destination": { + "ip": "192.168.1.10", + "port": 389 + }, + "event": { + "action": "ldap_connect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "start" + ] + }, + "freeipa": { + "directory": { + "connection_id": 62, + "operation": "CONNECTION", + "ssl": false + } + }, + "network": { + "protocol": "ldap", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "192.168.1.50", + "192.168.1.10" + ] + }, + "server": { + "ip": "192.168.1.10" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "192.168.1.50" + } + }, + { + "@timestamp": "2024-04-15T09:23:01.234Z", + "event": { + "action": "ldap_bind", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "start" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "uid=admin,cn=users,cn=accounts,dc=example,dc=com", + "bind_method": "SIMPLE", + "connection_id": 62, + "operation": "BIND", + "operation_id": 0 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "admin", + "uid=admin,cn=users,cn=accounts,dc=example,dc=com" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "uid=admin,cn=users,cn=accounts,dc=example,dc=com", + "name": "admin" + } + }, + { + "@timestamp": "2024-04-15T09:23:01.345Z", + "event": { + "action": "ldap_bind", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "start" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "", + "bind_method": "SASL/GSSAPI", + "connection_id": 64, + "operation": "BIND", + "operation_id": 0 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T07:57:42.203Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=sudo,dc=lab,dc=local", + "connection_id": 109, + "filter": "(&(objectClass=ipasudorule)(ipaEnabledFlag=TRUE))", + "operation": "SRCH", + "operation_id": 7, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T07:57:42.206Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 3128974, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 109, + "elapsed_time": 0.003128975, + "entries_returned": 0, + "notes": "P", + "operation": "RESULT", + "operation_id": 7, + "optime": 0.002775282, + "result_code": 0, + "tag_number": 101, + "unindexed": false, + "wtime": 0.000356679 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:03.456Z", + "event": { + "action": "ldap_bind_result", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "duration": 1300000, + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "LDAP error code 49", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 65, + "elapsed_time": 0.0013, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 1, + "optime": 0.0012, + "result_code": 49, + "tag_number": 97, + "wtime": 0.0001 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:05.012Z", + "event": { + "action": "ldap_disconnect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "end" + ] + }, + "freeipa": { + "directory": { + "connection_id": 62, + "operation": "DISCONNECT", + "operation_id": 5 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:01.567Z", + "client": { + "ip": "192.168.1.51" + }, + "destination": { + "ip": "192.168.1.10", + "port": 636 + }, + "event": { + "action": "ldap_connect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "start" + ] + }, + "freeipa": { + "directory": { + "connection_id": 63, + "operation": "CONNECTION", + "ssl": true + } + }, + "network": { + "protocol": "ldaps", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "192.168.1.51", + "192.168.1.10" + ] + }, + "server": { + "ip": "192.168.1.10" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "192.168.1.51" + } + }, + { + "@timestamp": "2026-03-13T08:41:08.298Z", + "event": { + "action": "ldap_compare", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "connection_id": 154, + "operation": "CMP", + "operation_id": 3, + "target_dn": "uid=admin,cn=users,cn=accounts,dc=lab,dc=local" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T08:41:08.583Z", + "event": { + "action": "ldap_extended", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "connection_id": 155, + "ext_name": "IPA Password Manager", + "ext_oid": "1.3.6.1.4.1.4203.1.11.1", + "operation": "EXT", + "operation_id": 3 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T08:41:17.026Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 5282103, + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "LDAP error code 49", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 157, + "elapsed_time": 0.005282103, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 3, + "optime": 0.005010135, + "result_code": 49, + "tag_number": 120, + "wtime": 0.000276456 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T08:41:17.190Z", + "event": { + "action": "ldap_bind_result", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "duration": 151503741, + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "LDAP error code 49", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 158, + "elapsed_time": 0.15150374, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 0, + "optime": 0.15124485, + "result_code": 49, + "tag_number": 97, + "wtime": 0.000264064 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:04.678Z", + "event": { + "action": "ldap_modify", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "change" + ] + }, + "freeipa": { + "directory": { + "connection_id": 62, + "operation": "MOD", + "operation_id": 3, + "target_dn": "uid=testuser1,cn=users,cn=accounts,dc=example,dc=com" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:04.789Z", + "event": { + "action": "ldap_delete", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "deletion" + ] + }, + "freeipa": { + "directory": { + "connection_id": 62, + "operation": "DEL", + "operation_id": 4, + "target_dn": "cn=oldgroup,cn=groups,cn=accounts,dc=example,dc=com" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T08:41:38.465Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 1986250, + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "LDAP error code 32", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 65, + "elapsed_time": 0.00198625, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 268, + "optime": 0.001741825, + "result_code": 32, + "tag_number": 101, + "wtime": 0.000248993 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T08:42:01.123Z", + "event": { + "action": "ldap_modrdn", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "change" + ] + }, + "freeipa": { + "directory": { + "connection_id": 70, + "new_rdn": "cn=newname", + "new_superior": "cn=groups,cn=accounts,dc=lab,dc=local", + "operation": "MODRDN", + "operation_id": 5, + "target_dn": "cn=oldname,cn=groups,cn=accounts,dc=lab,dc=local" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:04.234Z", + "event": { + "action": "ldap_add", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "creation" + ] + }, + "freeipa": { + "directory": { + "connection_id": 62, + "operation": "ADD", + "operation_id": 2, + "target_dn": "cn=newgroup,cn=groups,cn=accounts,dc=example,dc=com" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:06.123Z", + "event": { + "action": "ldap_abandon", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 62, + "operation": "ABANDON", + "operation_id": 6, + "target_op": 5 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:07.234Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 5234000205, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 63, + "elapsed_time": 5.234, + "entries_returned": 234, + "notes": "U", + "operation": "RESULT", + "operation_id": 12, + "result_code": 0, + "tag_number": 101, + "unindexed": true + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:01.890Z", + "event": { + "action": "ldap_bind", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "start" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "", + "bind_method": "SASL/EXTERNAL", + "connection_id": 66, + "operation": "BIND", + "operation_id": 0 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:23:08.345Z", + "event": { + "action": "ldap_disconnect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "end" + ] + }, + "freeipa": { + "directory": { + "connection_id": 67, + "operation": "DISCONNECT" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T14:01:25.377Z", + "event": { + "action": "ldap_disconnect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "end" + ] + }, + "freeipa": { + "directory": { + "connection_id": 450, + "operation": "DISCONNECT", + "operation_id": 2 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.394Z", + "event": { + "action": "ldap_connect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "start" + ] + }, + "freeipa": { + "directory": { + "connection_id": 485, + "operation": "CONNECTION" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.397Z", + "event": { + "action": "ldap_autobind", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "start" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "cn=Directory Manager", + "bind_method": "AUTOBIND", + "connection_id": 485, + "operation": "AUTOBIND" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "cn=Directory Manager" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "cn=Directory Manager", + "name": "cn=Directory Manager" + } + }, + { + "@timestamp": "2024-04-15T09:24:01.123Z", + "event": { + "action": "ldap_disconnect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "end" + ] + }, + "freeipa": { + "directory": { + "connection_id": 68, + "operation": "DISCONNECT" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2024-04-15T09:24:02.234Z", + "event": { + "action": "ldap_disconnect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "end" + ] + }, + "freeipa": { + "directory": { + "connection_id": 69, + "operation": "DISCONNECT", + "operation_id": 0 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T07:57:42.203Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=config", + "filter": "(objectclass=*)", + "operation": "SRCH", + "operation_id": 0, + "scope": "base" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-13T07:57:42.203Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 150000, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "elapsed_time": 0.00015, + "entries_returned": 1, + "operation": "RESULT", + "operation_id": 0, + "optime": 0.0001, + "result_code": 0, + "tag_number": 48, + "wtime": 5e-05 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + } + ] +} diff --git a/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json new file mode 100644 index 00000000000..ef86923cd62 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json @@ -0,0 +1,94 @@ +{ + "events": [ + { + "message": "[15/Mar/2026:20:12:42.025034423 +0000] conn=9 op=4268 SRCH base=\"dc=lab,dc=local\" scope=2 filter=\"(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ipa1.lab.local@LAB.LOCAL)(krbPrincipalName:caseIgnoreIA5Match:=host/ipa1.lab.local@LAB.LOCAL)))\" attrs=\"krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink ipaIdpConfigLi...\"" + }, + { + "message": "[15/Mar/2026:20:12:42.026882732 +0000] conn=9 op=4268 RESULT err=0 tag=101 nentries=1 wtime=0.000158982 optime=0.001850903 etime=0.002008202" + }, + { + "message": "[15/Mar/2026:20:12:42.103582145 +0000] conn=481 op=1 BIND dn=\"\" method=sasl version=3 mech=GSSAPI" + }, + { + "message": "[15/Mar/2026:20:12:42.121578818 +0000] conn=481 op=3 RESULT err=0 tag=97 nentries=0 wtime=0.000048281 optime=0.003715642 etime=0.003762560 dn=\"fqdn=ipa1.lab.local,cn=computers,cn=accounts,dc=lab,dc=local\"" + }, + { + "message": "[15/Mar/2026:20:16:38.585413122 +0000] conn=65 op=1698 RESULT err=32 tag=101 nentries=0 wtime=0.000180504 optime=0.002278799 etime=0.002454513" + }, + { + "message": "[15/Mar/2026:20:26:38.081037430 +0000] conn=23 op=2616 MOD dn=\"cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca\"" + }, + { + "message": "[15/Mar/2026:20:27:42.008027121 +0000] conn=482 fd=233 slot=233 connection from 172.30.0.60 to 172.30.0.60" + }, + { + "message": "[15/Mar/2026:20:31:41.176408372 +0000] conn=483 fd=237 slot=237 SSL connection from 172.30.0.60 to 172.30.0.60" + }, + { + "message": "[15/Mar/2026:20:31:41.210538245 +0000] conn=484 op=0 RESULT err=49 tag=97 nentries=0 wtime=0.000341570 optime=0.002463450 etime=0.002803406 - No such entry" + }, + { + "message": "[15/Mar/2026:20:31:48.218368823 +0000] conn=66 op=3410 SRCH base=\"ou=certificates,ou=acme,o=ipaca\" scope=2 filter=\"(acmeExpires<=20260315203148+0000)\" attrs=\"1.1\"" + }, + { + "message": "[15/Mar/2026:20:31:48.220429857 +0000] conn=66 op=3410 RESULT err=0 tag=101 nentries=0 wtime=0.000034726 optime=0.002060152 etime=0.002091051" + }, + { + "message": "[15/Mar/2026:20:33:40.394870599 +0000] conn=485 fd=237 slot=237 connection from local to /run/slapd-LAB-LOCAL.socket" + }, + { + "message": "[15/Mar/2026:20:33:40.397890467 +0000] conn=485 AUTOBIND dn=\"cn=Directory Manager\"" + }, + { + "message": "[15/Mar/2026:20:33:40.399358201 +0000] conn=485 op=0 BIND dn=\"cn=Directory Manager\" method=sasl version=3 mech=EXTERNAL" + }, + { + "message": "[15/Mar/2026:20:33:40.400914373 +0000] conn=485 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000332253 optime=0.003212093 etime=0.003539928 dn=\"cn=Directory Manager\"" + }, + { + "message": "[15/Mar/2026:20:33:40.648287656 +0000] conn=485 op=1 SRCH base=\"cn=KDC,cn=ipa1.lab.local,cn=masters,cn=ipa,cn=etc,dc=lab,dc=local\" scope=0 filter=\"(ipaConfigString=kdcProxyEnabled)\" attrs=\"cn\"" + }, + { + "message": "[15/Mar/2026:20:33:40.650288323 +0000] conn=485 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000218966 optime=0.002008243 etime=0.002224964" + }, + { + "message": "[15/Mar/2026:20:33:40.650830545 +0000] conn=485 op=2 SRCH base=\"cn=schema\" scope=0 filter=\"(objectClass=*)\" attrs=\"attributeTypes objectClasses\"" + }, + { + "message": "[15/Mar/2026:20:33:40.745621367 +0000] conn=485 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000124758 optime=0.094796572 etime=0.094917152" + }, + { + "message": "[15/Mar/2026:20:33:40.827848836 +0000] conn=485 op=3 UNBIND" + }, + { + "message": "[15/Mar/2026:20:33:40.829820779 +0000] conn=485 op=3 fd=237 Disconnect - Cleanly Closed Connection - U1" + }, + { + "message": "[15/Mar/2026:20:33:40.925401515 +0000] conn=482 op=11 SRCH base=\"cn=accounts,dc=lab,dc=local\" scope=2 filter=\"(&(cn=apache)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))\" attrs=\"objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember\"" + }, + { + "message": "[15/Mar/2026:20:33:40.927333523 +0000] conn=482 op=11 RESULT err=0 tag=101 nentries=0 wtime=0.000289060 optime=0.001935744 etime=0.002221729" + }, + { + "message": "[15/Mar/2026:20:33:40.930907695 +0000] conn=482 op=12 SRCH base=\"cn=accounts,dc=lab,dc=local\" scope=2 filter=\"(&(cn=kdcproxy)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))\" attrs=\"objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember\"" + }, + { + "message": "[15/Mar/2026:20:33:40.932415084 +0000] conn=482 op=12 RESULT err=0 tag=101 nentries=0 wtime=0.002360252 optime=0.001509593 etime=0.003868082" + }, + { + "message": "[15/Mar/2026:20:33:40.934605413 +0000] conn=482 op=13 SRCH base=\"cn=accounts,dc=lab,dc=local\" scope=2 filter=\"(&(cn=ipaapi)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))\" attrs=\"objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember\"" + }, + { + "message": "[15/Mar/2026:20:33:40.937745239 +0000] conn=482 op=13 RESULT err=0 tag=101 nentries=0 wtime=0.000912036 optime=0.003139806 etime=0.004048956" + }, + { + "message": "[15/Mar/2026:20:33:41.031362928 +0000] conn=482 op=14 SRCH base=\"cn=accounts,dc=lab,dc=local\" scope=2 filter=\"(&(uid=kdcproxy)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))\" attrs=\"objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host logindisabled loginexpirationtime loginallowedtimemap ipaSshPubKey ipaUserAuthType usercertificate;binary mail ipapasskey\"" + }, + { + "message": "[15/Mar/2026:20:33:41.032940311 +0000] conn=482 op=14 RESULT err=0 tag=101 nentries=0 wtime=0.091995662 optime=0.001579857 etime=0.093574006" + }, + { + "message": "[15/Mar/2026:20:33:41.034495461 +0000] conn=482 op=15 SRCH base=\"cn=accounts,dc=lab,dc=local\" scope=2 filter=\"(&(uid=apache)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))\" attrs=\"objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host logindisabled loginexpirationtime loginallowedtimemap ipaSshPubKey ipaUserAuthType usercertificate;binary mail ipapasskey\"" + } + ] +} diff --git a/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-config.yml b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-expected.json b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-expected.json new file mode 100644 index 00000000000..41973a0f683 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/_dev/test/pipeline/test-real-logs.json-expected.json @@ -0,0 +1,1111 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-15T20:12:42.025Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "dc=lab,dc=local", + "connection_id": 9, + "filter": "(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ipa1.lab.local@LAB.LOCAL)(krbPrincipalName:caseIgnoreIA5Match:=host/ipa1.lab.local@LAB.LOCAL)))", + "operation": "SRCH", + "operation_id": 4268, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:12:42.026Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 2008202, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 9, + "elapsed_time": 0.002008202, + "entries_returned": 1, + "operation": "RESULT", + "operation_id": 4268, + "optime": 0.001850903, + "result_code": 0, + "tag_number": 101, + "wtime": 0.000158982 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:12:42.103Z", + "event": { + "action": "ldap_bind", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "start" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "", + "bind_method": "SASL/GSSAPI", + "connection_id": 481, + "operation": "BIND", + "operation_id": 1 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:12:42.121Z", + "event": { + "action": "ldap_bind_result", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "duration": 3762559, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "fqdn=ipa1.lab.local,cn=computers,cn=accounts,dc=lab,dc=local", + "connection_id": 481, + "elapsed_time": 0.00376256, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 3, + "optime": 0.003715642, + "result_code": 0, + "tag_number": 97, + "wtime": 4.8281e-05 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "fqdn=ipa1.lab.local,cn=computers,cn=accounts,dc=lab,dc=local" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "fqdn=ipa1.lab.local,cn=computers,cn=accounts,dc=lab,dc=local" + } + }, + { + "@timestamp": "2026-03-15T20:16:38.585Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 2454512, + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "LDAP error code 32", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 65, + "elapsed_time": 0.002454513, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 1698, + "optime": 0.002278799, + "result_code": 32, + "tag_number": 101, + "wtime": 0.000180504 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:26:38.081Z", + "event": { + "action": "ldap_modify", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "change" + ] + }, + "freeipa": { + "directory": { + "connection_id": 23, + "operation": "MOD", + "operation_id": 2616, + "target_dn": "cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:27:42.008Z", + "client": { + "ip": "172.30.0.60" + }, + "destination": { + "ip": "172.30.0.60", + "port": 389 + }, + "event": { + "action": "ldap_connect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "start" + ] + }, + "freeipa": { + "directory": { + "connection_id": 482, + "operation": "CONNECTION", + "ssl": false + } + }, + "network": { + "protocol": "ldap", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + } + }, + { + "@timestamp": "2026-03-15T20:31:41.176Z", + "client": { + "ip": "172.30.0.60" + }, + "destination": { + "ip": "172.30.0.60", + "port": 636 + }, + "event": { + "action": "ldap_connect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "start" + ] + }, + "freeipa": { + "directory": { + "connection_id": 483, + "operation": "CONNECTION", + "ssl": true + } + }, + "network": { + "protocol": "ldaps", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "ip": [ + "172.30.0.60" + ] + }, + "server": { + "ip": "172.30.0.60" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + } + }, + { + "@timestamp": "2026-03-15T20:31:41.210Z", + "event": { + "action": "ldap_bind_result", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "duration": 2803405, + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "LDAP error code 49", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 484, + "elapsed_time": 0.002803406, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 0, + "optime": 0.00246345, + "result_code": 49, + "tag_number": 97, + "wtime": 0.00034157 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:31:48.218Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "ou=certificates,ou=acme,o=ipaca", + "connection_id": 66, + "filter": "(acmeExpires<=20260315203148+0000)", + "operation": "SRCH", + "operation_id": 3410, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:31:48.220Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 2091051, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 66, + "elapsed_time": 0.002091051, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 3410, + "optime": 0.002060152, + "result_code": 0, + "tag_number": 101, + "wtime": 3.4726e-05 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.394Z", + "event": { + "action": "ldap_connect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "start" + ] + }, + "freeipa": { + "directory": { + "connection_id": 485, + "operation": "CONNECTION" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.397Z", + "event": { + "action": "ldap_autobind", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "start" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "cn=Directory Manager", + "bind_method": "AUTOBIND", + "connection_id": 485, + "operation": "AUTOBIND" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "cn=Directory Manager" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "cn=Directory Manager", + "name": "cn=Directory Manager" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.399Z", + "event": { + "action": "ldap_bind", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "start" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "cn=Directory Manager", + "bind_method": "SASL/EXTERNAL", + "connection_id": 485, + "operation": "BIND", + "operation_id": 0 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "cn=Directory Manager" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "cn=Directory Manager", + "name": "cn=Directory Manager" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.400Z", + "event": { + "action": "ldap_bind_result", + "category": [ + "authentication" + ], + "dataset": "freeipa.directory_access", + "duration": 3539928, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "bind_dn": "cn=Directory Manager", + "connection_id": 485, + "elapsed_time": 0.003539928, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 0, + "optime": 0.003212093, + "result_code": 0, + "tag_number": 97, + "wtime": 0.000332253 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "user": [ + "cn=Directory Manager" + ] + }, + "service": { + "type": "freeipa" + }, + "user": { + "id": "cn=Directory Manager" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.648Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=KDC,cn=ipa1.lab.local,cn=masters,cn=ipa,cn=etc,dc=lab,dc=local", + "connection_id": 485, + "filter": "(ipaConfigString=kdcProxyEnabled)", + "operation": "SRCH", + "operation_id": 1, + "scope": "base" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.650Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 2224964, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 485, + "elapsed_time": 0.002224964, + "entries_returned": 1, + "operation": "RESULT", + "operation_id": 1, + "optime": 0.002008243, + "result_code": 0, + "tag_number": 101, + "wtime": 0.000218966 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.650Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=schema", + "connection_id": 485, + "filter": "(objectClass=*)", + "operation": "SRCH", + "operation_id": 2, + "scope": "base" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.745Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 94917148, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 485, + "elapsed_time": 0.09491715, + "entries_returned": 1, + "operation": "RESULT", + "operation_id": 2, + "optime": 0.094796576, + "result_code": 0, + "tag_number": 101, + "wtime": 0.000124758 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.827Z", + "event": { + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa" + }, + "freeipa": { + "directory": { + "connection_id": 485, + "operation": "UNBIND", + "operation_id": 3 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.829Z", + "event": { + "action": "ldap_disconnect", + "category": [ + "network" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "connection", + "end" + ] + }, + "freeipa": { + "directory": { + "connection_id": 485, + "operation": "DISCONNECT", + "operation_id": 3 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.925Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=accounts,dc=lab,dc=local", + "connection_id": 482, + "filter": "(&(cn=apache)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))", + "operation": "SRCH", + "operation_id": 11, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.927Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 2221728, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 482, + "elapsed_time": 0.002221729, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 11, + "optime": 0.001935744, + "result_code": 0, + "tag_number": 101, + "wtime": 0.00028906 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.930Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=accounts,dc=lab,dc=local", + "connection_id": 482, + "filter": "(&(cn=kdcproxy)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))", + "operation": "SRCH", + "operation_id": 12, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.932Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 3868082, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 482, + "elapsed_time": 0.003868082, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 12, + "optime": 0.001509593, + "result_code": 0, + "tag_number": 101, + "wtime": 0.002360252 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.934Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=accounts,dc=lab,dc=local", + "connection_id": 482, + "filter": "(&(cn=ipaapi)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))", + "operation": "SRCH", + "operation_id": 13, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:40.937Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 4048956, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 482, + "elapsed_time": 0.004048956, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 13, + "optime": 0.003139806, + "result_code": 0, + "tag_number": 101, + "wtime": 0.000912036 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:41.031Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=accounts,dc=lab,dc=local", + "connection_id": 482, + "filter": "(&(uid=kdcproxy)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))", + "operation": "SRCH", + "operation_id": 14, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:41.032Z", + "event": { + "action": "ldap_result", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "duration": 93574002, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory": { + "connection_id": 482, + "elapsed_time": 0.093574, + "entries_returned": 0, + "operation": "RESULT", + "operation_id": 14, + "optime": 0.001579857, + "result_code": 0, + "tag_number": 101, + "wtime": 0.091995664 + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-15T20:33:41.034Z", + "event": { + "action": "ldap_search", + "category": [ + "database" + ], + "dataset": "freeipa.directory_access", + "kind": "event", + "module": "freeipa", + "type": [ + "access" + ] + }, + "freeipa": { + "directory": { + "base_dn": "cn=accounts,dc=lab,dc=local", + "connection_id": 482, + "filter": "(&(uid=apache)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))", + "operation": "SRCH", + "operation_id": 15, + "scope": "sub" + } + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + } + ] +} diff --git a/packages/freeipa/data_stream/directory_access/_dev/test/system/test-default-config.yml b/packages/freeipa/data_stream/directory_access/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..09cce19e9de --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/_dev/test/system/test-default-config.yml @@ -0,0 +1,5 @@ +vars: ~ +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/access" diff --git a/packages/freeipa/data_stream/directory_access/agent/stream/stream.yml.hbs b/packages/freeipa/data_stream/directory_access/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..795d2c9fc82 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/agent/stream/stream.yml.hbs @@ -0,0 +1,16 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +prospector.scanner.symlinks: true +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} diff --git a/packages/freeipa/data_stream/directory_access/elasticsearch/ingest_pipeline/default.yml b/packages/freeipa/data_stream/directory_access/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..8494d827af8 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,516 @@ +--- +description: Pipeline for FreeIPA 389DS directory server access log events. +processors: + # Static metadata + - set: + tag: set_event_kind + field: event.kind + value: event + - set: + tag: set_event_module + field: event.module + value: freeipa + - set: + tag: set_event_dataset + field: event.dataset + value: freeipa.directory_access + + # Parse timestamp and connection/operation prefix + - grok: + tag: grok_access_line + field: message + patterns: + # Connection open (plain or SSL) — network + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} fd=%{INT} slot=%{INT} (?:%{WORD:_temp.conn_type} )?connection from %{IP:source.ip} to %{IP:_temp.dest_ip}" + # Connection open — local (Unix socket / LDAPI) + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} fd=%{INT} slot=%{INT} connection from %{WORD:_temp.local_source} to %{GREEDYDATA:_temp.socket_path}" + # AUTOBIND (local socket authentication, no op=) + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} AUTOBIND dn=\"%{DATA:freeipa.directory.bind_dn}\"" + # Disconnect (with op=) — matches both "fd=N closed" and "fd=N Disconnect" + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} op=%{INT:freeipa.directory.operation_id:long} fd=%{INT} (?:closed|Disconnect) - %{GREEDYDATA:_temp.close_reason}" + # Disconnect (without op=, fd-closed lines) + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} fd=%{INT} (?:closed|Disconnect)%{GREEDYDATA:_temp.close_reason}" + # Internal operation lines (conn=Internal) + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=Internal\\(%{INT}\\) op=%{INT:freeipa.directory.operation_id:long}(?:\\(internal\\))? %{WORD:freeipa.directory.operation}%{SPACE}%{GREEDYDATA:_temp.op_detail}" + # TLS cipher + client certificate info + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} TLS%{DATA:_temp.tls_version} %{INT:_temp.tls_bits:int}-bit %{DATA:_temp.tls_cipher}; client %{DATA:_temp.tls_client_dn}; issuer %{GREEDYDATA:_temp.tls_issuer_dn}" + # TLS client bound (certificate-based authentication) + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} TLS%{DATA:_temp.tls_version} client bound as %{GREEDYDATA:freeipa.directory.bind_dn}" + # Operation lines (BIND, SRCH, MOD, ADD, DEL, CMP, RESULT, etc.) + - "\\[%{DATA:_temp.raw_timestamp}\\] conn=%{INT:freeipa.directory.connection_id:long} op=%{INT:freeipa.directory.operation_id:long} %{WORD:freeipa.directory.operation}%{SPACE}%{GREEDYDATA:_temp.op_detail}" + + # Parse the 389DS timestamp: DD/Mon/YYYY:HH:mm:ss.nnnnnnnnn +ZZZZ + # Trim sub-second precision to microseconds (Java can handle 6 digits, not 9) + - gsub: + tag: gsub_timestamp_precision + field: _temp.raw_timestamp + pattern: "(\\.\\d{6})\\d{3}" + replacement: "$1" + - date: + tag: date_parse + field: _temp.raw_timestamp + target_field: "@timestamp" + formats: + - dd/MMM/yyyy:HH:mm:ss.SSSSSS Z + - dd/MMM/yyyy:HH:mm:ss Z + + # Map TLS fields to ECS + - set: + tag: set_tls_version + if: ctx._temp?.tls_version != null + field: tls.version + value: "{{_temp.tls_version}}" + - set: + tag: set_tls_version_protocol + if: ctx._temp?.tls_version != null + field: tls.version_protocol + value: tls + - set: + tag: set_tls_cipher + if: ctx._temp?.tls_cipher != null + field: tls.cipher + value: "{{_temp.tls_cipher}}" + - set: + tag: set_tls_client_dn + if: ctx._temp?.tls_client_dn != null + field: tls.client.x509.subject.distinguished_name + value: "{{_temp.tls_client_dn}}" + - set: + tag: set_tls_issuer_dn + if: ctx._temp?.tls_issuer_dn != null + field: tls.client.x509.issuer.distinguished_name + value: "{{_temp.tls_issuer_dn}}" + - set: + tag: set_tls_event_action + if: ctx._temp?.tls_version != null && ctx.freeipa?.directory?.operation == null + field: freeipa.directory.operation + value: TLS + - set: + tag: set_tls_ssl + if: ctx._temp?.tls_version != null + field: freeipa.directory.ssl + value: true + + # Detect SSL on connection open + - set: + tag: set_ssl_true + if: ctx._temp?.conn_type == 'SSL' + field: freeipa.directory.ssl + value: true + - set: + tag: set_ssl_false + if: ctx.source?.ip != null && ctx._temp?.conn_type == null + field: freeipa.directory.ssl + value: false + + # Map destination IP from connection open lines + - set: + tag: set_destination_ip + if: ctx._temp?.dest_ip != null + field: destination.ip + copy_from: _temp.dest_ip + + # Mark connection events (network or local socket) + - set: + tag: set_op_connection + if: (ctx._temp?.dest_ip != null || ctx._temp?.socket_path != null) && ctx.freeipa?.directory?.operation == null + field: freeipa.directory.operation + value: CONNECTION + + # Mark AUTOBIND as BIND operation + - set: + tag: set_autobind_op + if: ctx.freeipa?.directory?.bind_dn != null && ctx.freeipa?.directory?.operation == null + field: freeipa.directory.operation + value: AUTOBIND + + # Mark disconnect events + - set: + tag: set_op_disconnect + if: ctx._temp?.close_reason != null && ctx.freeipa?.directory?.operation == null + field: freeipa.directory.operation + value: DISCONNECT + + # Parse BIND details: dn="..." method=128|sasl version=3 [mech=GSSAPI] + - grok: + tag: grok_bind + if: ctx.freeipa?.directory?.operation == 'BIND' + field: _temp.op_detail + ignore_failure: true + patterns: + - "dn=\"%{DATA:freeipa.directory.bind_dn}\" method=%{WORD:_temp.bind_method} version=%{INT}(?: mech=%{WORD:_temp.sasl_mech})?" + - set: + tag: set_bind_method_simple + if: ctx._temp?.bind_method == '128' + field: freeipa.directory.bind_method + value: SIMPLE + - set: + tag: set_bind_method_sasl + if: ctx._temp?.bind_method == 'sasl' + field: freeipa.directory.bind_method + value: "SASL/{{_temp.sasl_mech}}" + - set: + tag: set_bind_method_autobind + if: ctx.freeipa?.directory?.operation == 'AUTOBIND' && ctx.freeipa?.directory?.bind_method == null + field: freeipa.directory.bind_method + value: AUTOBIND + + # Extract user.name from bind DN (uid=XXX,...) + - grok: + tag: grok_bind_user + if: ctx.freeipa?.directory?.bind_dn != null && ctx.freeipa.directory.bind_dn != '' + field: freeipa.directory.bind_dn + ignore_failure: true + patterns: + - "uid=%{DATA:user.name}," + - "%{GREEDYDATA:user.name}" + - set: + tag: set_user_id_bind + if: ctx.freeipa?.directory?.bind_dn != null && ctx.freeipa.directory.bind_dn != '' + field: user.id + copy_from: freeipa.directory.bind_dn + + # Parse SRCH details: base="..." scope=N filter="..." [attrs="..."] + - grok: + tag: grok_srch + if: ctx.freeipa?.directory?.operation == 'SRCH' + field: _temp.op_detail + ignore_failure: true + patterns: + - "base=\"%{DATA:freeipa.directory.base_dn}\" scope=%{INT:_temp.scope_num} filter=\"%{DATA:freeipa.directory.filter}\"%{GREEDYDATA}" + - script: + tag: script_scope + if: ctx._temp?.scope_num != null + lang: painless + ignore_failure: true + source: | + def s = ctx._temp.scope_num.toString(); + if (s.equals("0")) ctx.freeipa.directory.put("scope", "base"); + else if (s.equals("1")) ctx.freeipa.directory.put("scope", "one"); + else if (s.equals("2")) ctx.freeipa.directory.put("scope", "sub"); + else ctx.freeipa.directory.put("scope", s); + + # Parse EXT (extended operation) details + - grok: + tag: grok_ext + if: ctx.freeipa?.directory?.operation == 'EXT' + field: _temp.op_detail + ignore_failure: true + patterns: + - "oid=\"%{DATA:freeipa.directory.ext_oid}\" name=\"%{DATA:freeipa.directory.ext_name}\"" + - "oid=\"%{DATA:freeipa.directory.ext_oid}\"" + + # Parse MODRDN details + - grok: + tag: grok_modrdn + if: ctx.freeipa?.directory?.operation == 'MODRDN' + field: _temp.op_detail + ignore_failure: true + patterns: + - "dn=\"%{DATA:freeipa.directory.target_dn}\" newSuperior=\"%{DATA:freeipa.directory.new_superior}\" newrdn=\"%{DATA:freeipa.directory.new_rdn}\"" + - "dn=\"%{DATA:freeipa.directory.target_dn}\"%{GREEDYDATA}" + + # Parse ABANDON details: targetop=N msgid=N + - grok: + tag: grok_abandon + if: ctx.freeipa?.directory?.operation == 'ABANDON' + field: _temp.op_detail + ignore_failure: true + patterns: + - "targetop=%{INT:freeipa.directory.target_op:long}%{GREEDYDATA}" + + # Parse MOD/ADD/DEL/CMP target DN + - grok: + tag: grok_mod_dn + if: "ctx.freeipa?.directory?.operation != null && (ctx.freeipa.directory.operation == 'MOD' || ctx.freeipa.directory.operation == 'ADD' || ctx.freeipa.directory.operation == 'DEL' || ctx.freeipa.directory.operation == 'CMP')" + field: _temp.op_detail + ignore_failure: true + patterns: + - "dn=\"%{DATA:freeipa.directory.target_dn}\"%{GREEDYDATA}" + + # Parse RESULT details + - grok: + tag: grok_result + if: ctx.freeipa?.directory?.operation == 'RESULT' + field: _temp.op_detail + ignore_failure: true + patterns: + - "err=%{INT:freeipa.directory.result_code:int} tag=%{INT:freeipa.directory.tag_number:long} nentries=%{INT:freeipa.directory.entries_returned:long}%{GREEDYDATA:_temp.result_rest}" + - grok: + tag: grok_result_etime + if: ctx._temp?.result_rest != null + field: _temp.result_rest + ignore_failure: true + patterns: + - "%{SPACE}(?:wtime=%{NUMBER:freeipa.directory.wtime:float}%{SPACE})?(?:optime=%{NUMBER:freeipa.directory.optime:float}%{SPACE})?etime=%{NUMBER:freeipa.directory.elapsed_time:float}%{GREEDYDATA:_temp.result_notes}" + - grok: + tag: grok_result_notes + if: ctx._temp?.result_notes != null + field: _temp.result_notes + ignore_failure: true + patterns: + - "notes=%{WORD:freeipa.directory.notes}%{GREEDYDATA:_temp.notes_rest}" + + # Extract bind DN from bind RESULT lines (tag=97). + # Successful SASL/GSSAPI binds include dn="uid=..." in the RESULT line. + # Failed simple binds do not include the dn= field. + - grok: + tag: grok_result_bind_dn + if: ctx.freeipa?.directory?.operation == 'RESULT' && ctx.freeipa?.directory?.tag_number != null && ctx.freeipa.directory.tag_number == 97 + field: _temp.op_detail + ignore_failure: true + patterns: + - 'dn="%{DATA:freeipa.directory.bind_dn}"' + - grok: + tag: grok_result_bind_user + if: ctx.freeipa?.directory?.operation == 'RESULT' && ctx.freeipa?.directory?.bind_dn != null + field: freeipa.directory.bind_dn + ignore_failure: true + patterns: + - "uid=%{DATA:user.name}," + - set: + tag: set_result_user_id + if: ctx.freeipa?.directory?.operation == 'RESULT' && ctx.freeipa?.directory?.bind_dn != null + field: user.id + copy_from: freeipa.directory.bind_dn + + # Convert etime (seconds) to nanoseconds for event.duration + - script: + tag: script_event_duration + if: ctx.freeipa?.directory?.elapsed_time != null + lang: painless + ignore_failure: true + source: | + ctx.event.put("duration", (long)(ctx.freeipa.directory.elapsed_time * 1e9)); + + # Detect unindexed searches from notes + - set: + tag: set_unindexed_true + if: ctx.freeipa?.directory?.notes != null && (ctx.freeipa.directory.notes == 'U' || ctx.freeipa.directory.notes == 'A') + field: freeipa.directory.unindexed + value: true + - set: + tag: set_unindexed_false + if: ctx.freeipa?.directory?.notes != null && ctx.freeipa.directory.notes != 'U' && ctx.freeipa.directory.notes != 'A' + field: freeipa.directory.unindexed + value: false + + # Set event.outcome from RESULT err code + - set: + tag: set_outcome_success + if: ctx.freeipa?.directory?.operation == 'RESULT' && ctx.freeipa?.directory?.result_code != null && ctx.freeipa.directory.result_code == 0 + field: event.outcome + value: success + - set: + tag: set_outcome_failure + if: ctx.freeipa?.directory?.operation == 'RESULT' && ctx.freeipa?.directory?.result_code != null && ctx.freeipa.directory.result_code != 0 + field: event.outcome + value: failure + - set: + tag: set_event_reason + if: ctx.freeipa?.directory?.operation == 'RESULT' && ctx.freeipa?.directory?.result_code != null && ctx.freeipa.directory.result_code != 0 + field: event.reason + value: "LDAP error code {{freeipa.directory.result_code}}" + + # Set event.category and event.type + - script: + tag: script_event_fields + lang: painless + ignore_failure: true + source: | + def op = ctx.freeipa?.directory?.operation; + if (op == null) return; + if (op.equals("BIND") || op.equals("AUTOBIND")) { + ctx.event.put("category", ["authentication"]); + ctx.event.put("type", ["start"]); + ctx.event.put("action", op.equals("AUTOBIND") ? "ldap_autobind" : "ldap_bind"); + } else if (op.equals("SRCH")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["access"]); + ctx.event.put("action", "ldap_search"); + } else if (op.equals("MOD")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["change"]); + ctx.event.put("action", "ldap_modify"); + } else if (op.equals("ADD")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["creation"]); + ctx.event.put("action", "ldap_add"); + } else if (op.equals("DEL")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["deletion"]); + ctx.event.put("action", "ldap_delete"); + } else if (op.equals("MODRDN")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["change"]); + ctx.event.put("action", "ldap_modrdn"); + } else if (op.equals("CMP")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["access"]); + ctx.event.put("action", "ldap_compare"); + } else if (op.equals("EXT")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["access"]); + ctx.event.put("action", "ldap_extended"); + } else if (op.equals("ABANDON")) { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["info"]); + ctx.event.put("action", "ldap_abandon"); + } else if (op.equals("RESULT")) { + def tag = ctx.freeipa?.directory?.tag_number; + if (tag != null && tag == 97L) { + ctx.event.put("category", ["authentication"]); + ctx.event.put("type", ["info"]); + ctx.event.put("action", "ldap_bind_result"); + } else { + ctx.event.put("category", ["database"]); + ctx.event.put("type", ["info"]); + ctx.event.put("action", "ldap_result"); + } + } else if (op.equals("CONNECTION")) { + ctx.event.put("category", ["network"]); + ctx.event.put("type", ["connection", "start"]); + ctx.event.put("action", "ldap_connect"); + } else if (op.equals("DISCONNECT")) { + ctx.event.put("category", ["network"]); + ctx.event.put("type", ["connection", "end"]); + ctx.event.put("action", "ldap_disconnect"); + } else if (op.equals("TLS")) { + ctx.event.put("category", ["network"]); + ctx.event.put("type", ["protocol", "info"]); + ctx.event.put("action", "ldap_tls_info"); + } + + # Related fields + - append: + tag: append_related_user + field: related.user + value: "{{user.name}}" + if: ctx.user?.name != null + allow_duplicates: false + - append: + tag: append_related_user_id + field: related.user + value: "{{user.id}}" + if: ctx.user?.id != null + allow_duplicates: false + - append: + tag: append_related_ip + field: related.ip + value: "{{source.ip}}" + if: ctx.source?.ip != null + allow_duplicates: false + - append: + tag: append_related_ip_dest + field: related.ip + value: "{{destination.ip}}" + if: ctx.destination?.ip != null + allow_duplicates: false + + # GeoIP enrichment + - geoip: + tag: geoip_source + field: source.ip + target_field: source.geo + ignore_missing: true + ignore_failure: true + - geoip: + tag: geoip_source_asn + field: source.ip + target_field: source.as + database_file: GeoLite2-ASN.mmdb + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_asn + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + tag: rename_as_org + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + + # Network and service metadata + - set: + tag: set_service_type + field: service.type + value: freeipa + - set: + tag: set_network_transport + if: ctx.source?.ip != null + field: network.transport + value: tcp + - set: + tag: set_network_protocol_ldaps + if: ctx.freeipa?.directory?.ssl == true + field: network.protocol + value: ldaps + - set: + tag: set_network_protocol_ldap + if: ctx.source?.ip != null && ctx.network?.protocol == null + field: network.protocol + value: ldap + - set: + tag: set_client_ip + if: ctx.source?.ip != null + field: client.ip + copy_from: source.ip + - set: + tag: set_server_ip + if: ctx.destination?.ip != null + field: server.ip + copy_from: destination.ip + - set: + tag: set_destination_port_ldaps + if: ctx.freeipa?.directory?.ssl == true && ctx.destination?.ip != null + field: destination.port + value: 636 + - set: + tag: set_destination_port_ldap + if: ctx.freeipa?.directory?.ssl != true && ctx.destination?.ip != null + field: destination.port + value: 389 + + # Observer metadata + - set: + tag: set_observer_vendor + field: observer.vendor + value: Red Hat + - set: + tag: set_observer_product + field: observer.product + value: FreeIPA + - set: + tag: set_observer_type + field: observer.type + value: directory-server + - set: + tag: set_observer_hostname + field: observer.hostname + copy_from: host.hostname + ignore_failure: true + + # Clean up + - remove: + tag: remove_temp + field: _temp + ignore_missing: true + - remove: + tag: remove_message + field: message + ignore_missing: true + - remove: + tag: remove_event_original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + field: event.original + ignore_missing: true + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} failed with message: {{ _ingest.on_failure_message }}" diff --git a/packages/freeipa/data_stream/directory_access/fields/base-fields.yml b/packages/freeipa/data_stream/directory_access/fields/base-fields.yml new file mode 100644 index 00000000000..f4bd7f84b71 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: "@timestamp" + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + value: freeipa + description: Event module. +- name: event.dataset + type: constant_keyword + value: freeipa.directory_access + description: Event dataset. diff --git a/packages/freeipa/data_stream/directory_access/fields/ecs.yml b/packages/freeipa/data_stream/directory_access/fields/ecs.yml new file mode 100644 index 00000000000..1ed858d8513 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/fields/ecs.yml @@ -0,0 +1,120 @@ +- name: ecs.version + type: keyword + description: ECS version this event conforms to. +- name: error.message + type: match_only_text + description: Error message. +- name: event.kind + type: keyword + description: The kind of event. +- name: event.category + type: keyword + description: Event category for ECS compatibility. +- name: event.type + type: keyword + description: Event type for ECS compatibility. +- name: event.action + type: keyword + description: The action captured by the event. +- name: event.outcome + type: keyword + description: The outcome of the event (success or failure). +- name: event.reason + type: keyword + description: Reason for the event outcome, typically an LDAP error description. +- name: event.duration + type: long + description: Duration of the LDAP operation in nanoseconds. +- name: service.type + type: keyword + description: Service type identifier. +- name: network.protocol + type: keyword + description: Application protocol (ldap or ldaps). +- name: network.transport + type: keyword + description: Transport protocol (tcp). +- name: client.ip + type: ip + description: IP address of the LDAP client. +- name: server.ip + type: ip + description: IP address of the directory server. +- name: source.ip + type: ip + description: IP address of the LDAP client. +- name: destination.ip + type: ip + description: IP address of the directory server. +- name: destination.port + type: long + description: Listening port of the directory server (389 or 636). +- name: tls.version_protocol + type: keyword + description: TLS version protocol component (tls). +- name: observer.vendor + type: keyword + description: Vendor of the observer. +- name: observer.product + type: keyword + description: Product name of the observer. +- name: observer.type + type: keyword + description: Type of the observer component. +- name: observer.hostname + type: keyword + description: Hostname of the observer. +- name: user.name + type: keyword + description: Username extracted from the bind DN. +- name: user.id + type: keyword + description: Full bind DN. +- name: related.user + type: keyword + description: All user identifiers seen in this event. +- name: related.ip + type: ip + description: All IP addresses seen in this event. +- name: tls.version + type: keyword + description: TLS version negotiated. +- name: tls.cipher + type: keyword + description: TLS cipher suite used. +- name: tls.client.x509.subject.distinguished_name + type: keyword + description: Subject DN of the client certificate. +- name: tls.client.x509.issuer.distinguished_name + type: keyword + description: Issuer DN of the client certificate. +- name: source.geo.city_name + type: keyword + description: City name from GeoIP lookup. +- name: source.geo.continent_name + type: keyword + description: Continent name from GeoIP lookup. +- name: source.geo.country_iso_code + type: keyword + description: Country ISO code from GeoIP lookup. +- name: source.geo.country_name + type: keyword + description: Country name from GeoIP lookup. +- name: source.geo.location + type: geo_point + description: Longitude and latitude from GeoIP lookup. +- name: source.geo.region_iso_code + type: keyword + description: Region ISO code from GeoIP lookup. +- name: source.geo.region_name + type: keyword + description: Region name from GeoIP lookup. +- name: source.as.number + type: long + description: Autonomous System Number from GeoIP ASN lookup. +- name: source.as.organization.name + type: keyword + description: Organization name from GeoIP ASN lookup. +- name: tags + type: keyword + description: List of keywords used to tag each event. diff --git a/packages/freeipa/data_stream/directory_access/fields/fields.yml b/packages/freeipa/data_stream/directory_access/fields/fields.yml new file mode 100644 index 00000000000..72cd2d320ac --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/fields/fields.yml @@ -0,0 +1,73 @@ +- name: freeipa.directory + type: group + description: 389DS directory server access log fields. + fields: + - name: connection_id + type: long + description: LDAP connection number (conn=N). + - name: operation_id + type: long + description: LDAP operation number within the connection (op=N). + - name: operation + type: keyword + description: LDAP operation type (BIND, SRCH, MOD, ADD, DEL, CMP, RESULT, CONNECTION, DISCONNECT). + - name: base_dn + type: keyword + description: Base DN for search operations. + - name: scope + type: keyword + description: Search scope (base, one, sub). + - name: filter + type: keyword + description: LDAP search filter. + - name: target_dn + type: keyword + description: Target DN for modify, add, delete, or compare operations. + - name: bind_dn + type: keyword + description: DN used for BIND authentication. + - name: bind_method + type: keyword + description: BIND method (SIMPLE or SASL/mechanism). + - name: result_code + type: integer + description: LDAP result code (0 = success). + - name: entries_returned + type: long + description: Number of entries returned by the operation. + - name: elapsed_time + type: float + description: Elapsed time for the operation in seconds. + - name: unindexed + type: boolean + description: Whether the operation required an unindexed search. + - name: ssl + type: boolean + description: Whether the connection uses SSL/TLS. + - name: tag_number + type: long + description: LDAP protocol tag number from RESULT. + - name: notes + type: keyword + description: Notes field from RESULT lines (P for paged, U for unindexed, A for all-ids threshold). + - name: new_superior + type: keyword + description: New parent DN in MODRDN operations. + - name: new_rdn + type: keyword + description: New relative distinguished name in MODRDN operations. + - name: target_op + type: long + description: Target operation ID being abandoned (ABANDON events only). + - name: wtime + type: float + description: Wait time before the operation was processed, in seconds. + - name: optime + type: float + description: Actual operation processing time, in seconds. + - name: ext_oid + type: keyword + description: OID of the LDAP extended operation. + - name: ext_name + type: keyword + description: Human-readable name of the LDAP extended operation. diff --git a/packages/freeipa/data_stream/directory_access/manifest.yml b/packages/freeipa/data_stream/directory_access/manifest.yml new file mode 100644 index 00000000000..cfc5fa9076c --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/manifest.yml @@ -0,0 +1,37 @@ +title: Directory Server Access Log +type: logs +streams: + - input: filestream + title: Directory Server Access Log + description: Collect 389DS LDAP access log events from the FreeIPA directory server. + vars: + - name: paths + type: text + title: Log File Paths + multi: true + required: true + show_user: true + default: + - /var/log/dirsrv/slapd-*/access + - name: tags + type: text + title: Tags + multi: true + required: false + show_user: false + default: + - freeipa-directory-access + - name: ignore_older + type: text + title: Ignore Older + description: Ignore log lines older than this duration. + required: false + show_user: false + default: 72h + - name: preserve_original_event + type: bool + title: Preserve Original Event + description: Preserve the raw log line in event.original. + required: false + show_user: true + default: false diff --git a/packages/freeipa/data_stream/directory_access/sample_event.json b/packages/freeipa/data_stream/directory_access/sample_event.json new file mode 100644 index 00000000000..f0c88a5f226 --- /dev/null +++ b/packages/freeipa/data_stream/directory_access/sample_event.json @@ -0,0 +1,75 @@ +{ + "log": { + "file": { + "inode": "14071730", + "path": "/var/log/dirsrv/slapd-EXAMPLE-TEST/access", + "device_id": "66306", + "fingerprint": "c8af355f52f042f6bf41953f638c7762474a85f0c40b8977088a214f18b5c19e" + }, + "offset": 46219203 + }, + "freeipa": { + "directory": { + "entries_returned": 1, + "optime": 0.000467528, + "connection_id": 1566, + "wtime": 0.000146482, + "elapsed_time": 0.000612577, + "tag_number": 101, + "operation_id": 2, + "result_code": 4, + "operation": "RESULT" + } + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "directory-server" + }, + "@timestamp": "2026-04-01T18:48:58.408Z", + "ecs": { + "version": "8.0.0" + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "type": "linux", + "family": "redhat", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 612577, + "agent_id_status": "verified", + "reason": "LDAP error code 4", + "ingested": "2026-04-01T18:49:21Z", + "kind": "event", + "action": "ldap_result", + "category": [ + "database" + ], + "type": [ + "info" + ], + "outcome": "failure" + } +} diff --git a/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json new file mode 100644 index 00000000000..c8f3fdd1426 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json @@ -0,0 +1,28 @@ +{ + "events": [ + { + "message": "[12/Mar/2026:21:27:32.144927462 +0000] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests" + }, + { + "message": "[12/Mar/2026:21:27:31.955553682 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=lab,dc=local does not exist" + }, + { + "message": "[12/Mar/2026:21:27:32.084297092 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Auto Membership Plugin - defaultass config,cn=Auto Membership Plugin,cn=plugins,cn=config" + }, + { + "message": "[12/Mar/2026:22:15:01.432100000 +0000] - ERR - NSMMReplicationPlugin - agmt=\"cn=meTorepl2.lab.local\" (repl2.lab.local:636): Replication bind failed - LDAP error 49 (Invalid credentials)" + }, + { + "message": "[12/Mar/2026:21:27:33.119208419 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task starts ..." + }, + { + "message": "[12/Mar/2026:22:30:00.123456789 +0000] - CRIT - ldbm_back_ldbm2index - db2index: userRoot: index lookup failed for objectClass" + }, + { + "message": "[12/Mar/2026:22:30:15.456789012 +0000] - ERR - NSMMReplicationPlugin - agmt=\"cn=meTorepl2.lab.local\" (repl2.lab.local:636): Replication session aborted" + }, + { + "message": "[12/Mar/2026:21:27:31.611461150 +0000] - INFO - Security Initialization - SSL info: Enabling default cipher set." + } + ] +} diff --git a/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-config.yml b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-config.yml new file mode 100644 index 00000000000..8ad8eb3f056 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-config.yml @@ -0,0 +1,3 @@ +dynamic_fields: + event.ingested: ".*" + tags: ".*" diff --git a/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-expected.json b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-expected.json new file mode 100644 index 00000000000..ed80a04e79a --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-default.json-expected.json @@ -0,0 +1,292 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-12T21:27:32.144Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "slapd started. Listening on All Interfaces port 389 for LDAP requests", + "subsystem": "slapd_daemon" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.955Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "reason": "acl_parse - The ACL target cn=vaults,cn=kra,dc=lab,dc=local does not exist", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "acl_parse - The ACL target cn=vaults,cn=kra,dc=lab,dc=local does not exist", + "subsystem": "NSACLPlugin" + } + }, + "log": { + "level": "warn" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:32.084Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "cos_dn_defs_cb - Skipping CoS Definition cn=Auto Membership Plugin - defaultass config,cn=Auto Membership Plugin,cn=plugins,cn=config", + "type": [ + "error" + ] + }, + "freeipa": { + "directory_error": { + "message": "cos_dn_defs_cb - Skipping CoS Definition cn=Auto Membership Plugin - defaultass config,cn=Auto Membership Plugin,cn=plugins,cn=config", + "subsystem": "cos-plugin" + } + }, + "log": { + "level": "err" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T22:15:01.432Z", + "error": { + "code": "49" + }, + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "agmt=\"cn=meTorepl2.lab.local\" (repl2.lab.local:636): Replication bind failed - LDAP error 49 (Invalid credentials)", + "type": [ + "error" + ] + }, + "freeipa": { + "directory_error": { + "agreement": "cn=meTorepl2.lab.local", + "ldap_error_code": 49, + "message": "agmt=\"cn=meTorepl2.lab.local\" (repl2.lab.local:636): Replication bind failed - LDAP error 49 (Invalid credentials)", + "remote_host": "repl2.lab.local", + "subsystem": "NSMMReplicationPlugin" + } + }, + "log": { + "level": "err" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "hosts": [ + "repl2.lab.local" + ] + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:33.119Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "[file ipa_sidgen_task.c, line 199]: Sidgen task starts ...", + "type": [ + "error" + ] + }, + "freeipa": { + "directory_error": { + "message": "[file ipa_sidgen_task.c, line 199]: Sidgen task starts ...", + "subsystem": "sidgen_task_thread" + } + }, + "log": { + "level": "err" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T22:30:00.123Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "db2index: userRoot: index lookup failed for objectClass", + "type": [ + "error" + ] + }, + "freeipa": { + "directory_error": { + "message": "db2index: userRoot: index lookup failed for objectClass", + "subsystem": "ldbm_back_ldbm2index" + } + }, + "log": { + "level": "crit" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T22:30:15.456Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "agmt=\"cn=meTorepl2.lab.local\" (repl2.lab.local:636): Replication session aborted", + "type": [ + "error" + ] + }, + "freeipa": { + "directory_error": { + "agreement": "cn=meTorepl2.lab.local", + "message": "agmt=\"cn=meTorepl2.lab.local\" (repl2.lab.local:636): Replication session aborted", + "remote_host": "repl2.lab.local", + "subsystem": "NSMMReplicationPlugin" + } + }, + "log": { + "level": "err" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "related": { + "hosts": [ + "repl2.lab.local" + ] + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.611Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: Enabling default cipher set.", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + } + ] +} diff --git a/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json new file mode 100644 index 00000000000..2e61d79a475 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json @@ -0,0 +1,49 @@ +{ + "events": [ + { + "message": "[12/Mar/2026:21:27:31.020733549 +0000] - INFO - bdb_pre_close - All database threads now stopped" + }, + { + "message": "[12/Mar/2026:21:27:31.070772715 +0000] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed" + }, + { + "message": "[12/Mar/2026:21:27:31.072483660 +0000] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 4 work q stack objects - freed 5 op stack objects" + }, + { + "message": "[12/Mar/2026:21:27:31.073493732 +0000] - INFO - main - slapd stopped." + }, + { + "message": "[12/Mar/2026:21:27:31.539051223 +0000] - INFO - slapd_extract_cert - CA CERT NAME: LAB.LOCAL IPA CA" + }, + { + "message": "[12/Mar/2026:21:27:31.542703514 +0000] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password if pin.txt does not exist." + }, + { + "message": "[12/Mar/2026:21:27:31.563886314 +0000] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert" + }, + { + "message": "[12/Mar/2026:21:27:31.611461150 +0000] - INFO - Security Initialization - SSL info: Enabling default cipher set." + }, + { + "message": "[12/Mar/2026:21:27:31.616250615 +0000] - INFO - Security Initialization - SSL info: Configured NSS Ciphers" + }, + { + "message": "[12/Mar/2026:21:27:31.617398589 +0000] - INFO - Security Initialization - SSL info: \tTLS_AES_128_GCM_SHA256: enabled" + }, + { + "message": "[12/Mar/2026:21:27:31.618372713 +0000] - INFO - Security Initialization - SSL info: \tTLS_CHACHA20_POLY1305_SHA256: enabled" + }, + { + "message": "[12/Mar/2026:21:27:31.619432720 +0000] - INFO - Security Initialization - SSL info: \tTLS_AES_256_GCM_SHA384: enabled" + }, + { + "message": "[12/Mar/2026:21:27:31.620403978 +0000] - INFO - Security Initialization - SSL info: \tTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled" + }, + { + "message": "[12/Mar/2026:21:27:31.621456922 +0000] - INFO - Security Initialization - SSL info: \tTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled" + }, + { + "message": "[12/Mar/2026:21:27:31.622481161 +0000] - INFO - Security Initialization - SSL info: \tTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled" + } + ] +} diff --git a/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-config.yml b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-config.yml new file mode 100644 index 00000000000..8ad8eb3f056 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-config.yml @@ -0,0 +1,3 @@ +dynamic_fields: + event.ingested: ".*" + tags: ".*" diff --git a/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-expected.json b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-expected.json new file mode 100644 index 00000000000..774b7d2a144 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/_dev/test/pipeline/test-real-logs.json-expected.json @@ -0,0 +1,500 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-12T21:27:31.020Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "All database threads now stopped", + "subsystem": "bdb_pre_close" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.070Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "Set of instances destroyed", + "subsystem": "ldbm_back_instance_set_destructor" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.072Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "slapd shutting down - freed 4 work q stack objects - freed 5 op stack objects", + "subsystem": "connection_post_shutdown_cleanup" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.073Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "slapd stopped.", + "subsystem": "main" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.539Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "CA CERT NAME: LAB.LOCAL IPA CA", + "subsystem": "slapd_extract_cert" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.542Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "reason": "SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password if pin.txt does not exist.", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password if pin.txt does not exist.", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "warn" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.563Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SERVER CERT NAME: Server-Cert", + "subsystem": "slapd_extract_cert" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.611Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: Enabling default cipher set.", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.616Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: Configured NSS Ciphers", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.617Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: \tTLS_AES_128_GCM_SHA256: enabled", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.618Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: \tTLS_CHACHA20_POLY1305_SHA256: enabled", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.619Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: \tTLS_AES_256_GCM_SHA384: enabled", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.620Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: \tTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.621Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: \tTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + }, + { + "@timestamp": "2026-03-12T21:27:31.622Z", + "event": { + "action": "directory_error", + "category": [ + "database" + ], + "dataset": "freeipa.directory_errors", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "directory_error": { + "message": "SSL info: \tTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled", + "subsystem": "Security Initialization" + } + }, + "log": { + "level": "info" + }, + "observer": { + "product": "FreeIPA", + "type": "directory-server", + "vendor": "Red Hat" + }, + "service": { + "type": "freeipa" + } + } + ] +} diff --git a/packages/freeipa/data_stream/directory_errors/_dev/test/system/test-default-config.yml b/packages/freeipa/data_stream/directory_errors/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..aa822e026b3 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/_dev/test/system/test-default-config.yml @@ -0,0 +1,5 @@ +vars: ~ +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/errors" diff --git a/packages/freeipa/data_stream/directory_errors/agent/stream/stream.yml.hbs b/packages/freeipa/data_stream/directory_errors/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..795d2c9fc82 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/agent/stream/stream.yml.hbs @@ -0,0 +1,16 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +prospector.scanner.symlinks: true +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} diff --git a/packages/freeipa/data_stream/directory_errors/elasticsearch/ingest_pipeline/default.yml b/packages/freeipa/data_stream/directory_errors/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..7cc9b301f8c --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,187 @@ +--- +description: Pipeline for FreeIPA 389 Directory Server error log events. +processors: + # Static metadata + - set: + tag: set_event_kind + field: event.kind + value: event + - set: + tag: set_event_module + field: event.module + value: freeipa + - set: + tag: set_event_dataset + field: event.dataset + value: freeipa.directory_errors + - set: + tag: set_event_category + field: event.category + value: + - database + + # Drop tab-continuation lines from multi-line log entries + - drop: + tag: drop_continuation + if: "ctx.message != null && ctx.message.length() > 0 && ctx.message.charAt(0) == (char)9" + + # Parse 389ds error log line + # Format: [DD/Mon/YYYY:HH:mm:ss.nnnnnnnnn +ZZZZ] - SEVERITY - SUBSYSTEM - MESSAGE + - grok: + tag: grok_dirsrv_line + field: message + patterns: + - "\\[%{DATA:_temp.timestamp} %{DATA:_temp.tz}\\] - %{WORD:_temp.severity} - %{DATA:freeipa.directory_error.subsystem} - %{GREEDYDATA:_temp.log_message}" + + # Trim nanosecond precision to microseconds (Java supports 6 digits max) + - gsub: + tag: gsub_timestamp_precision + field: _temp.timestamp + pattern: "(\\.\\d{6})\\d{3}" + replacement: "$1" + # Parse timestamp + - date: + tag: date_parse + field: _temp.timestamp + target_field: "@timestamp" + formats: + - "dd/MMM/yyyy:HH:mm:ss.SSSSSS" + - "dd/MMM/yyyy:HH:mm:ss" + timezone: "{{ _temp.tz }}" + + # Set log.level (lowercase) + - lowercase: + tag: lowercase_severity + field: _temp.severity + target_field: log.level + + # Set event.type based on severity + - set: + tag: set_event_type_error + if: "ctx.log.level == 'err' || ctx.log.level == 'crit' || ctx.log.level == 'alert' || ctx.log.level == 'emerg'" + field: event.type + value: + - error + - set: + tag: set_event_type_info + if: "ctx.event?.type == null" + field: event.type + value: + - info + + # Promote event.kind to alert for critical errors + - set: + tag: set_kind_alert + if: "ctx.log.level == 'crit' || ctx.log.level == 'alert' || ctx.log.level == 'emerg'" + field: event.kind + value: alert + + # Set the log message content + - set: + tag: set_log_message + if: ctx._temp?.log_message != null + field: freeipa.directory_error.message + copy_from: _temp.log_message + + # Set event.outcome based on severity + - set: + tag: set_outcome_failure + if: "ctx.log.level == 'err' || ctx.log.level == 'crit' || ctx.log.level == 'alert' || ctx.log.level == 'emerg'" + field: event.outcome + value: failure + - set: + tag: set_outcome_success + if: "ctx.event?.outcome == null" + field: event.outcome + value: success + + # Set event.reason for error/warning entries (truncated to 200 chars) + - script: + tag: script_event_reason + if: "ctx.log?.level == 'err' || ctx.log?.level == 'warn' || ctx.log?.level == 'crit' || ctx.log?.level == 'alert' || ctx.log?.level == 'emerg'" + lang: painless + ignore_failure: true + source: | + def msg = ctx.freeipa?.directory_error?.message; + if (msg != null) { + ctx.event.put('reason', msg.length() > 200 ? msg.substring(0, 200) : msg); + } + + # Set event.action + - set: + tag: set_event_action + field: event.action + value: directory_error + + # Optional: extract replication agreement info + - grok: + tag: grok_replication + field: _temp.log_message + if: ctx._temp?.log_message != null + ignore_failure: true + patterns: + - "agmt=\"%{DATA:freeipa.directory_error.agreement}\" \\(%{HOSTNAME:freeipa.directory_error.remote_host}:%{INT}\\).*LDAP error %{INT:freeipa.directory_error.ldap_error_code:int}" + - "agmt=\"%{DATA:freeipa.directory_error.agreement}\" \\(%{HOSTNAME:freeipa.directory_error.remote_host}:%{INT}\\)" + + # Map LDAP error code to ECS + - set: + tag: set_error_code + if: ctx.freeipa?.directory_error?.ldap_error_code != null + field: error.code + value: "{{freeipa.directory_error.ldap_error_code}}" + + # Service metadata + - set: + tag: set_service_type + field: service.type + value: freeipa + + # Related fields + - append: + tag: append_related_hosts + field: related.hosts + value: "{{freeipa.directory_error.remote_host}}" + if: ctx.freeipa?.directory_error?.remote_host != null + allow_duplicates: false + + # Observer metadata + - set: + tag: set_observer_vendor + field: observer.vendor + value: Red Hat + - set: + tag: set_observer_product + field: observer.product + value: FreeIPA + - set: + tag: set_observer_type + field: observer.type + value: directory-server + - set: + tag: set_observer_hostname + field: observer.hostname + copy_from: host.hostname + ignore_failure: true + + # Clean up + - remove: + tag: remove_temp + field: _temp + ignore_missing: true + - remove: + tag: remove_message + field: message + ignore_missing: true + - remove: + tag: remove_event_original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + field: event.original + ignore_missing: true + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} failed with message: {{ _ingest.on_failure_message }}" diff --git a/packages/freeipa/data_stream/directory_errors/fields/base-fields.yml b/packages/freeipa/data_stream/directory_errors/fields/base-fields.yml new file mode 100644 index 00000000000..cb9ca3f3c5c --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: "@timestamp" + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + value: freeipa + description: Event module. +- name: event.dataset + type: constant_keyword + value: freeipa.directory_errors + description: Event dataset. diff --git a/packages/freeipa/data_stream/directory_errors/fields/ecs.yml b/packages/freeipa/data_stream/directory_errors/fields/ecs.yml new file mode 100644 index 00000000000..4241bb6805c --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/fields/ecs.yml @@ -0,0 +1,51 @@ +- name: ecs.version + type: keyword + description: ECS version this event conforms to. +- name: error.message + type: match_only_text + description: Error message. +- name: event.kind + type: keyword + description: The kind of event. +- name: event.category + type: keyword + description: Event category for ECS compatibility. +- name: event.type + type: keyword + description: Event type for ECS compatibility. +- name: log.level + type: keyword + description: Log level of the event. +- name: event.action + type: keyword + description: The action captured by the event. +- name: event.outcome + type: keyword + description: The outcome of the event. +- name: event.reason + type: keyword + description: Reason for the event outcome. +- name: observer.vendor + type: keyword + description: Vendor of the observer. +- name: observer.product + type: keyword + description: Product name of the observer. +- name: observer.type + type: keyword + description: Type of the observer component. +- name: observer.hostname + type: keyword + description: Hostname of the observer. +- name: service.type + type: keyword + description: Service type identifier. +- name: error.code + type: keyword + description: LDAP error code from replication failures. +- name: related.hosts + type: keyword + description: All hostnames or FQDNs related to the event. +- name: tags + type: keyword + description: List of keywords used to tag each event. diff --git a/packages/freeipa/data_stream/directory_errors/fields/fields.yml b/packages/freeipa/data_stream/directory_errors/fields/fields.yml new file mode 100644 index 00000000000..66766e6b7f0 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/fields/fields.yml @@ -0,0 +1,19 @@ +- name: freeipa.directory_error + type: group + description: 389 Directory Server error log fields. + fields: + - name: message + type: match_only_text + description: Full log message text after the subsystem prefix. + - name: subsystem + type: keyword + description: Directory Server subsystem that produced the log entry. + - name: agreement + type: keyword + description: Replication agreement name. + - name: remote_host + type: keyword + description: Remote host in a replication agreement. + - name: ldap_error_code + type: integer + description: LDAP error code from a replication operation. diff --git a/packages/freeipa/data_stream/directory_errors/manifest.yml b/packages/freeipa/data_stream/directory_errors/manifest.yml new file mode 100644 index 00000000000..70f3d09c26b --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/manifest.yml @@ -0,0 +1,37 @@ +title: Directory Server Errors +type: logs +streams: + - input: filestream + title: Directory Server Errors + description: Collect 389 Directory Server error log events. + vars: + - name: paths + type: text + title: Log File Paths + multi: true + required: true + show_user: true + default: + - /var/log/dirsrv/slapd-*/errors + - name: tags + type: text + title: Tags + multi: true + required: false + show_user: false + default: + - freeipa-directory-errors + - name: ignore_older + type: text + title: Ignore Older + description: Ignore log lines older than this duration. + required: false + show_user: false + default: 72h + - name: preserve_original_event + type: bool + title: Preserve Original Event + description: Preserve the raw log line in event.original. + required: false + show_user: true + default: false diff --git a/packages/freeipa/data_stream/directory_errors/sample_event.json b/packages/freeipa/data_stream/directory_errors/sample_event.json new file mode 100644 index 00000000000..f8aaf1600a0 --- /dev/null +++ b/packages/freeipa/data_stream/directory_errors/sample_event.json @@ -0,0 +1,65 @@ +{ + "log": { + "file": { + "inode": "14069469", + "path": "/var/log/dirsrv/slapd-EXAMPLE-TEST/errors", + "device_id": "66306", + "fingerprint": "bfbaa773348a7449d0c5a3a9e16f41690633475870195d0eafc7e0f754180662" + }, + "offset": 128457, + "level": "err" + }, + "freeipa": { + "directory_error": { + "subsystem": "NSACLPlugin", + "message": "acl_access_allowed - Resetting aclpb_pblock 0x7f8702000000 to pblock addr 0x7f8700c00720" + } + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "directory-server" + }, + "@timestamp": "2026-04-01T09:19:16.890Z", + "ecs": { + "version": "8.0.0" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "type": "linux", + "family": "redhat", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "event": { + "agent_id_status": "verified", + "reason": "acl_access_allowed - Resetting aclpb_pblock 0x7f8702000000 to pblock addr 0x7f8700c00720", + "ingested": "2026-04-01T09:19:25Z", + "kind": "event", + "action": "directory_error", + "category": [ + "database" + ], + "type": [ + "error" + ], + "outcome": "failure" + } +} diff --git a/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json b/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json new file mode 100644 index 00000000000..65813fbf52d --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json @@ -0,0 +1,58 @@ +{ + "events": [ + { + "message": "[Thu Mar 12 21:25:10.123456 2026] [wsgi:error] [pid 71201:tid 71423] [remote 172.30.0.60:55270] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: user_add/1('testuser1', givenname='Test', sn='User1', version='2.254'): SUCCESS" + }, + { + "message": "[Thu Mar 12 21:29:50.731993 2026] [wsgi:error] [pid 71201:tid 71423] [remote 172.30.0.60:55276] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: group_add_member/1('testgroup', version='2.254', user=('testuser1,testuser2,testuser3',)): SUCCESS" + }, + { + "message": "[Thu Mar 12 21:35:22.891234 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_kerb] admin@LAB.LOCAL: hbacrule_add/1('allow_all_ssh', version='2.254'): SUCCESS" + }, + { + "message": "[Thu Mar 12 21:36:05.456789 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_kerb] admin@LAB.LOCAL: sudorule_add/1('allow_webadmins_sudo', version='2.254'): SUCCESS" + }, + { + "message": "[Thu Mar 12 21:31:32.472241 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_kerb] admin@LAB.LOCAL: dnsrecord_add/1('lab.local', 'ipa2', arecord=('172.30.0.61',), version='2.254'): SUCCESS" + }, + { + "message": "[Thu Mar 12 21:40:11.222333 2026] [wsgi:error] [pid 71201:tid 71423] [remote 172.30.0.60:55280] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: user_find/1(version='2.254', uid='testuser1'): SUCCESS" + }, + { + "message": "[Thu Mar 12 21:42:55.987654 2026] [wsgi:error] [pid 71201:tid 71423] [remote 172.30.0.60:55282] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: user_del/1('olduser', version='2.254'): SUCCESS" + }, + { + "message": "[Fri Mar 13 08:40:39.928464 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:58406] ipa: INFO: [jsonserver_kerb] admin@LAB.LOCAL: user_show/1('nonexistent_user', version='2.254'): NotFound" + }, + { + "message": "[Fri Mar 13 08:40:40.540835 2026] [wsgi:error] [pid 71199:tid 71426] [remote 172.30.0.60:58422] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: user_add/1('testuser1', givenname='Test', sn='Dup', version='2.254'): DuplicateEntry" + }, + { + "message": "[Fri Mar 13 08:40:43.645440 2026] [wsgi:error] [pid 71199:tid 71426] [remote 172.30.0.60:58444] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: cert_revoke/1('11', revocation_reason=6, version='2.254'): SUCCESS" + }, + { + "message": "[Fri Mar 13 08:40:45.188255 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:58536] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: host_del/1(['testhost.lab.local'], version='2.254'): SUCCESS" + }, + { + "message": "[Fri Mar 13 08:26:30.205202 2026] [wsgi:error] [pid 71199:tid 71426] [remote 172.30.0.60:41540] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: schema(known_fingerprints=('e1d6c890',), version='2.170'): SchemaUpToDate" + }, + { + "message": "[Fri Mar 13 09:00:00.123456 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: user_mod/1('testuser1', givenname='Updated', version='2.254'): SUCCESS etime=12000000" + }, + { + "message": "[Fri Mar 13 09:00:05.234567 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: group_remove_member/1('testgroup', version='2.254', user=('testuser1',)): SUCCESS" + }, + { + "message": "[Fri Mar 13 09:00:10.345678 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: cert_request/1('-----BEGIN CERTIFICATE REQUEST-----...', principal='host/test.lab.local@LAB.LOCAL', version='2.254'): SUCCESS etime=425000000" + }, + { + "message": "[Fri Mar 13 09:00:15.456789 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_session] testuser1@LAB.LOCAL: user_mod/1('testuser1', givenname='Hacker', version='2.254'): InsufficientAccess" + }, + { + "message": "[Fri Mar 13 09:00:20.567890 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_kerb] admin@LAB.LOCAL: ping(version='2.254'): SUCCESS" + }, + { + "message": "[Fri Mar 13 09:00:25.678901 2026] [wsgi:error] [pid 71200:tid 71420] [remote 172.30.0.60:59290] ipa: INFO: [jsonserver_session] admin@LAB.LOCAL: host_add/1('newhost.lab.local', force=True, version='2.254'): SUCCESS" + } + ] +} diff --git a/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-config.yml b/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-expected.json b/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-expected.json new file mode 100644 index 00000000000..007b4027a20 --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/_dev/test/pipeline/test-default.json-expected.json @@ -0,0 +1,1412 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-12T21:25:10.123Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "user_add", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "freeipa": { + "api": { + "command": "user_add", + "parameters": "'testuser1', givenname='Test', sn='User1', version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71201, + "thread": { + "id": 71423 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL", + "testuser1" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 55270 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin", + "target": { + "name": "testuser1" + } + } + }, + { + "@timestamp": "2026-03-12T21:29:50.731Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "group_add_member", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "change" + ] + }, + "freeipa": { + "api": { + "command": "group_add_member", + "parameters": "'testgroup', version='2.254', user=('testuser1,testuser2,testuser3',)", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "group": { + "name": "testgroup" + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71201, + "thread": { + "id": 71423 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 55276 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-12T21:35:22.891Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "hbacrule_add", + "category": [ + "iam", + "configuration" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "freeipa": { + "api": { + "command": "hbacrule_add", + "parameters": "'allow_all_ssh', version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_kerb", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "rule": { + "name": "allow_all_ssh" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-12T21:36:05.456Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "sudorule_add", + "category": [ + "iam", + "configuration" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "freeipa": { + "api": { + "command": "sudorule_add", + "parameters": "'allow_webadmins_sudo', version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_kerb", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "rule": { + "name": "allow_webadmins_sudo" + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-12T21:31:32.472Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "dnsrecord_add", + "category": [ + "iam", + "network" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "freeipa": { + "api": { + "command": "dnsrecord_add", + "parameters": "'lab.local', 'ipa2', arecord=('172.30.0.61',), version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_kerb", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "hosts": [ + "lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-12T21:40:11.222Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "user_find", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "api": { + "command": "user_find", + "parameters": "version='2.254', uid='testuser1'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71201, + "thread": { + "id": 71423 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 55280 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-12T21:42:55.987Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "user_del", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "freeipa": { + "api": { + "command": "user_del", + "parameters": "'olduser', version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71201, + "thread": { + "id": 71423 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL", + "olduser" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 55282 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin", + "target": { + "name": "olduser" + } + } + }, + { + "@timestamp": "2026-03-13T08:40:39.928Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "user_show", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "NotFound", + "type": [ + "info" + ] + }, + "freeipa": { + "api": { + "command": "user_show", + "parameters": "'nonexistent_user', version='2.254'", + "result": "NotFound", + "server_class": "jsonserver_kerb", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL", + "nonexistent_user" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 58406 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin", + "target": { + "name": "nonexistent_user" + } + } + }, + { + "@timestamp": "2026-03-13T08:40:40.540Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "user_add", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "DuplicateEntry", + "type": [ + "creation" + ] + }, + "freeipa": { + "api": { + "command": "user_add", + "parameters": "'testuser1', givenname='Test', sn='Dup', version='2.254'", + "result": "DuplicateEntry", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71199, + "thread": { + "id": 71426 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL", + "testuser1" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 58422 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin", + "target": { + "name": "testuser1" + } + } + }, + { + "@timestamp": "2026-03-13T08:40:43.645Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "cert_revoke", + "category": [ + "iam", + "authentication" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "api": { + "command": "cert_revoke", + "parameters": "'11', revocation_reason=6, version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71199, + "thread": { + "id": 71426 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 58444 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T08:40:45.188Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "host_del", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "freeipa": { + "api": { + "command": "host_del", + "parameters": "['testhost.lab.local'], version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "host": { + "name": "testhost.lab.local" + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "hosts": [ + "testhost.lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 58536 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T08:26:30.205Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "schema", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "api": { + "command": "schema", + "parameters": "known_fingerprints=('e1d6c890',), version='2.170'", + "result": "SchemaUpToDate", + "server_class": "jsonserver_session" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71199, + "thread": { + "id": 71426 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 41540 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T09:00:00.123Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "user_mod", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "duration": 12000000000, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "change" + ] + }, + "freeipa": { + "api": { + "command": "user_mod", + "parameters": "'testuser1', givenname='Updated', version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL", + "testuser1" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin", + "target": { + "name": "testuser1" + } + } + }, + { + "@timestamp": "2026-03-13T09:00:05.234Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "group_remove_member", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "change" + ] + }, + "freeipa": { + "api": { + "command": "group_remove_member", + "parameters": "'testgroup', version='2.254', user=('testuser1',)", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "group": { + "name": "testgroup" + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T09:00:10.345Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "cert_request", + "category": [ + "iam", + "authentication" + ], + "dataset": "freeipa.ipa_api", + "duration": 425000000000, + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "freeipa": { + "api": { + "command": "cert_request", + "parameters": "'-----BEGIN CERTIFICATE REQUEST-----...', principal='host/test.lab.local@LAB.LOCAL', version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T09:00:15.456Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "user_mod", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "InsufficientAccess", + "type": [ + "change" + ] + }, + "freeipa": { + "api": { + "command": "user_mod", + "parameters": "'testuser1', givenname='Hacker', version='2.254'", + "result": "InsufficientAccess", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "testuser1", + "testuser1@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "testuser1@LAB.LOCAL", + "name": "testuser1", + "target": { + "name": "testuser1" + } + } + }, + { + "@timestamp": "2026-03-13T09:00:20.567Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "ping", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "api": { + "command": "ping", + "parameters": "version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_kerb" + } + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T09:00:25.678Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "host_add", + "category": [ + "iam" + ], + "dataset": "freeipa.ipa_api", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "creation" + ] + }, + "freeipa": { + "api": { + "command": "host_add", + "parameters": "'newhost.lab.local', force=True, version='2.254'", + "result": "SUCCESS", + "server_class": "jsonserver_session", + "version": "1" + } + }, + "host": { + "name": "newhost.lab.local" + }, + "http": { + "request": { + "method": "POST" + } + }, + "log": { + "level": "INFO" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "type": "api-server", + "vendor": "Red Hat" + }, + "process": { + "pid": 71200, + "thread": { + "id": 71420 + } + }, + "related": { + "hosts": [ + "newhost.lab.local" + ], + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "port": 59290 + }, + "url": { + "path": "/ipa/json" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + } + ] +} diff --git a/packages/freeipa/data_stream/ipa_api/_dev/test/system/test-default-config.yml b/packages/freeipa/data_stream/ipa_api/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..39ca3800ad5 --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/_dev/test/system/test-default-config.yml @@ -0,0 +1,5 @@ +vars: ~ +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/error_log" diff --git a/packages/freeipa/data_stream/ipa_api/agent/stream/stream.yml.hbs b/packages/freeipa/data_stream/ipa_api/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..3c33b012fc9 --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/agent/stream/stream.yml.hbs @@ -0,0 +1,20 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +prospector.scanner.symlinks: true +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} +parsers: + - include_message: + patterns: + - "ipa: INFO:.*jsonserver" diff --git a/packages/freeipa/data_stream/ipa_api/elasticsearch/ingest_pipeline/default.yml b/packages/freeipa/data_stream/ipa_api/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..2356d39a9dd --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,344 @@ +--- +description: Pipeline for FreeIPA IPA API audit events. +processors: + # Static metadata + - set: + tag: set_event_kind + field: event.kind + value: event + - set: + tag: set_event_module + field: event.module + value: freeipa + - set: + tag: set_event_dataset + field: event.dataset + value: freeipa.ipa_api + + # Parse the httpd error_log IPA line + - grok: + tag: grok_ipa_api + field: message + patterns: + # Command with version suffix and etime: command/1(params): RESULT etime=N + - "\\[%{DATA:_temp.httpd_ts}\\] \\[wsgi:error\\] \\[pid %{POSINT:process.pid:int}:tid %{POSINT:process.thread.id:int}\\] \\[remote %{IP:source.ip}:%{POSINT:source.port:int}\\] ipa: %{WORD:_temp.log_level}: \\[%{DATA:freeipa.api.server_class}\\] %{DATA:_temp.principal}: %{DATA:freeipa.api.command}/%{DATA:freeipa.api.version}\\(%{DATA:freeipa.api.parameters}\\): %{NOTSPACE:freeipa.api.result} etime=%{NUMBER:_temp.etime:long}" + # Command with version suffix, no etime: command/1(params): RESULT + - "\\[%{DATA:_temp.httpd_ts}\\] \\[wsgi:error\\] \\[pid %{POSINT:process.pid:int}:tid %{POSINT:process.thread.id:int}\\] \\[remote %{IP:source.ip}:%{POSINT:source.port:int}\\] ipa: %{WORD:_temp.log_level}: \\[%{DATA:freeipa.api.server_class}\\] %{DATA:_temp.principal}: %{DATA:freeipa.api.command}/%{DATA:freeipa.api.version}\\(%{DATA:freeipa.api.parameters}\\): %{NOTSPACE:freeipa.api.result}" + # Command without version suffix: command(params): RESULT (e.g. schema, ping) + - "\\[%{DATA:_temp.httpd_ts}\\] \\[wsgi:error\\] \\[pid %{POSINT:process.pid:int}:tid %{POSINT:process.thread.id:int}\\] \\[remote %{IP:source.ip}:%{POSINT:source.port:int}\\] ipa: %{WORD:_temp.log_level}: \\[%{DATA:freeipa.api.server_class}\\] %{DATA:_temp.principal}: %{DATA:freeipa.api.command}\\(%{DATA:freeipa.api.parameters}\\): %{NOTSPACE:freeipa.api.result}" + + # Parse httpd timestamp + - date: + tag: date_parse + field: _temp.httpd_ts + target_field: "@timestamp" + formats: + - "EEE MMM dd HH:mm:ss.SSSSSS yyyy" + - "EEE MMM d HH:mm:ss.SSSSSS yyyy" + + # Map log level (lowercase for ECS consistency) + - lowercase: + tag: lowercase_log_level + field: _temp.log_level + target_field: log.level + ignore_missing: true + + # Extract user.name and user.domain from principal (admin@REALM) + - grok: + tag: grok_principal + field: _temp.principal + ignore_failure: true + patterns: + - "%{DATA:user.name}@%{GREEDYDATA:user.domain}" + - set: + tag: set_user_id + if: ctx._temp?.principal != null + field: user.id + copy_from: _temp.principal + + # Set event.action to the command name + - set: + tag: set_event_action + if: ctx.freeipa?.api?.command != null + field: event.action + copy_from: freeipa.api.command + + # Set event.outcome from result + # SUCCESS and SchemaUpToDate are successful outcomes; known IPA error classes are failures + - set: + tag: set_outcome_success + if: ctx.freeipa?.api?.result == 'SUCCESS' || ctx.freeipa?.api?.result == 'SchemaUpToDate' + field: event.outcome + value: success + - set: + tag: set_outcome_failure + if: >- + ctx.freeipa?.api?.result != null && + ctx.freeipa?.api?.result != 'SUCCESS' && + ctx.freeipa?.api?.result != 'SchemaUpToDate' + field: event.outcome + value: failure + - set: + tag: set_event_reason + if: >- + ctx.freeipa?.api?.result != null && + ctx.freeipa?.api?.result != 'SUCCESS' && + ctx.freeipa?.api?.result != 'SchemaUpToDate' + field: event.reason + copy_from: freeipa.api.result + + # Convert etime (microseconds) to event.duration (ECS nanoseconds) + - script: + tag: script_event_duration + if: ctx._temp?.etime != null + lang: painless + ignore_failure: true + source: | + ctx.event.put('duration', ctx._temp.etime * 1000L); + + # Extract target entity from first positional parameter: command('target', ...) + - grok: + tag: grok_target_entity + field: freeipa.api.parameters + if: ctx.freeipa?.api?.parameters != null + ignore_failure: true + patterns: + - "^'%{DATA:_temp.target_entity}'" + - "^\\['%{DATA:_temp.target_entity}'\\]" + + # Set group.name for group commands + - set: + tag: set_group_name + if: >- + ctx._temp?.target_entity != null && ( + ctx.freeipa?.api?.command == 'group_add' || + ctx.freeipa?.api?.command == 'group_del' || + ctx.freeipa?.api?.command == 'group_mod' || + ctx.freeipa?.api?.command == 'group_add_member' || + ctx.freeipa?.api?.command == 'group_remove_member' || + ctx.freeipa?.api?.command == 'group_show' || + ctx.freeipa?.api?.command == 'group_find') + field: group.name + copy_from: _temp.target_entity + + # Set user.target.name for user-targeting commands + - set: + tag: set_user_target + if: >- + ctx._temp?.target_entity != null && ( + ctx.freeipa?.api?.command == 'user_add' || + ctx.freeipa?.api?.command == 'user_del' || + ctx.freeipa?.api?.command == 'user_mod' || + ctx.freeipa?.api?.command == 'user_show' || + ctx.freeipa?.api?.command == 'user_find' || + ctx.freeipa?.api?.command == 'user_disable' || + ctx.freeipa?.api?.command == 'user_enable' || + ctx.freeipa?.api?.command == 'user_unlock') + field: user.target.name + copy_from: _temp.target_entity + + # Set host.name for host-targeting commands + - set: + tag: set_target_host + if: >- + ctx._temp?.target_entity != null && ( + ctx.freeipa?.api?.command == 'host_add' || + ctx.freeipa?.api?.command == 'host_del' || + ctx.freeipa?.api?.command == 'host_mod' || + ctx.freeipa?.api?.command == 'host_show') + field: host.name + copy_from: _temp.target_entity + + # Set rule.name for sudorule/hbacrule commands + - set: + tag: set_rule_name + if: >- + ctx._temp?.target_entity != null && + ctx.freeipa?.api?.command != null && ( + ctx.freeipa.api.command.startsWith('sudorule_') || + ctx.freeipa.api.command.startsWith('hbacrule_')) + field: rule.name + copy_from: _temp.target_entity + + # Set related.hosts for DNS and service commands + - append: + tag: append_related_hosts_dns + if: >- + ctx._temp?.target_entity != null && + ctx.freeipa?.api?.command != null && ( + ctx.freeipa.api.command.startsWith('dnsrecord_') || + ctx.freeipa.api.command.startsWith('dnszone_') || + ctx.freeipa.api.command.startsWith('service_')) + field: related.hosts + value: "{{_temp.target_entity}}" + allow_duplicates: false + + # Derive event.category and event.type from command + - script: + tag: script_event_category + lang: painless + ignore_failure: true + source: | + def cmd = ctx.event?.action; + if (cmd == null) return; + def category = ['iam']; + def type = ['info']; + if (cmd.endsWith('_add') || cmd.equals('cert_request')) { + type = ['creation']; + } else if (cmd.endsWith('_del')) { + type = ['deletion']; + } else if (cmd.endsWith('_mod') || cmd.equals('group_add_member') || cmd.equals('group_remove_member')) { + type = ['change']; + } else if (cmd.endsWith('_find') || cmd.endsWith('_show')) { + type = ['info']; + } + if (cmd.startsWith('hbacrule_') || cmd.startsWith('sudorule_')) { + category = ['iam', 'configuration']; + } else if (cmd.startsWith('dnsrecord_') || cmd.startsWith('dnszone_')) { + category = ['iam', 'network']; + } else if (cmd.startsWith('cert_')) { + category = ['iam', 'authentication']; + } else if (cmd.startsWith('service_')) { + category = ['iam', 'configuration']; + } + ctx.event.put('category', category); + ctx.event.put('type', type); + + # Promote event.kind to alert for permission failures + - set: + tag: set_kind_alert + if: ctx.freeipa?.api?.result == 'InsufficientAccess' + field: event.kind + value: alert + + # Related fields + - append: + tag: append_related_user + field: related.user + value: "{{user.name}}" + if: ctx.user?.name != null + allow_duplicates: false + - append: + tag: append_related_user_id + field: related.user + value: "{{user.id}}" + if: ctx.user?.id != null + allow_duplicates: false + - append: + tag: append_related_target_user + field: related.user + value: "{{user.target.name}}" + if: ctx.user?.target?.name != null + allow_duplicates: false + - append: + tag: append_related_ip + field: related.ip + value: "{{source.ip}}" + if: ctx.source?.ip != null + allow_duplicates: false + - append: + tag: append_related_hosts + field: related.hosts + value: "{{host.name}}" + if: ctx.host?.name != null + allow_duplicates: false + + # GeoIP enrichment + - geoip: + tag: geoip_source + field: source.ip + target_field: source.geo + ignore_missing: true + ignore_failure: true + - geoip: + tag: geoip_source_asn + field: source.ip + target_field: source.as + database_file: GeoLite2-ASN.mmdb + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_asn + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + tag: rename_as_org + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + + # Network, HTTP, and service metadata + - set: + tag: set_service_type + field: service.type + value: freeipa + - set: + tag: set_network_protocol + field: network.protocol + value: https + - set: + tag: set_network_transport + field: network.transport + value: tcp + - set: + tag: set_http_method + field: http.request.method + value: POST + - set: + tag: set_client_ip + if: ctx.source?.ip != null + field: client.ip + copy_from: source.ip + - set: + tag: set_url_path_json + if: "ctx.freeipa?.api?.server_class != null && (ctx.freeipa.api.server_class.contains('json') || ctx.freeipa.api.server_class.contains('session'))" + field: url.path + value: /ipa/json + - set: + tag: set_url_path_xml + if: "ctx.freeipa?.api?.server_class != null && ctx.freeipa.api.server_class.contains('xml')" + field: url.path + value: /ipa/xml + + # Observer metadata + - set: + tag: set_observer_vendor + field: observer.vendor + value: Red Hat + - set: + tag: set_observer_product + field: observer.product + value: FreeIPA + - set: + tag: set_observer_type + field: observer.type + value: api-server + - set: + tag: set_observer_hostname + field: observer.hostname + copy_from: host.hostname + ignore_failure: true + + # Clean up + - remove: + tag: remove_temp + field: _temp + ignore_missing: true + - remove: + tag: remove_message + field: message + ignore_missing: true + - remove: + tag: remove_event_original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + field: event.original + ignore_missing: true + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} failed with message: {{ _ingest.on_failure_message }}" diff --git a/packages/freeipa/data_stream/ipa_api/fields/base-fields.yml b/packages/freeipa/data_stream/ipa_api/fields/base-fields.yml new file mode 100644 index 00000000000..a88e80a6958 --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: "@timestamp" + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + value: freeipa + description: Event module. +- name: event.dataset + type: constant_keyword + value: freeipa.ipa_api + description: Event dataset. diff --git a/packages/freeipa/data_stream/ipa_api/fields/ecs.yml b/packages/freeipa/data_stream/ipa_api/fields/ecs.yml new file mode 100644 index 00000000000..c1736853416 --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/fields/ecs.yml @@ -0,0 +1,132 @@ +- name: ecs.version + type: keyword + description: ECS version this event conforms to. +- name: log.level + type: keyword + description: Log level of the IPA API message. +- name: error.message + type: match_only_text + description: Error message. +- name: event.kind + type: keyword + description: The kind of event. +- name: event.category + type: keyword + description: Event category for ECS compatibility. +- name: event.type + type: keyword + description: Event type for ECS compatibility. +- name: event.action + type: keyword + description: The action captured by the event. +- name: event.outcome + type: keyword + description: The outcome of the event (success or failure). +- name: event.reason + type: keyword + description: Reason for the event outcome when not SUCCESS. +- name: event.duration + type: long + description: Duration of the API call in nanoseconds. +- name: observer.vendor + type: keyword + description: Vendor of the observer. +- name: observer.product + type: keyword + description: Product name of the observer. +- name: observer.type + type: keyword + description: Type of the observer component. +- name: observer.hostname + type: keyword + description: Hostname of the observer. +- name: service.type + type: keyword + description: Service type identifier. +- name: network.protocol + type: keyword + description: Application protocol (https). +- name: network.transport + type: keyword + description: Transport protocol (tcp). +- name: http.request.method + type: keyword + description: HTTP request method (POST). +- name: url.path + type: keyword + description: URL path of the IPA API endpoint. +- name: client.ip + type: ip + description: IP address of the API client. +- name: source.ip + type: ip + description: IP address of the API client. +- name: source.port + type: long + description: Source port of the API client. +- name: user.name + type: keyword + description: Short principal name (without realm). +- name: user.domain + type: keyword + description: Kerberos realm of the principal. +- name: user.id + type: keyword + description: Full Kerberos principal (user@REALM). +- name: process.pid + type: long + description: Process ID of the httpd worker. +- name: process.thread.id + type: long + description: Thread ID of the httpd worker. +- name: user.target.name + type: keyword + description: Target user of the API command (the user being created, modified, or deleted). +- name: group.name + type: keyword + description: Target group name for group commands. +- name: host.name + type: keyword + description: Target host for host commands. +- name: rule.name + type: keyword + description: Target HBAC or sudo rule name. +- name: related.user + type: keyword + description: All user identifiers seen in this event. +- name: related.ip + type: ip + description: All IP addresses seen in this event. +- name: related.hosts + type: keyword + description: All hostnames seen in this event. +- name: source.geo.city_name + type: keyword + description: City name from GeoIP lookup. +- name: source.geo.continent_name + type: keyword + description: Continent name from GeoIP lookup. +- name: source.geo.country_iso_code + type: keyword + description: Country ISO code from GeoIP lookup. +- name: source.geo.country_name + type: keyword + description: Country name from GeoIP lookup. +- name: source.geo.location + type: geo_point + description: Longitude and latitude from GeoIP lookup. +- name: source.geo.region_iso_code + type: keyword + description: Region ISO code from GeoIP lookup. +- name: source.geo.region_name + type: keyword + description: Region name from GeoIP lookup. +- name: source.as.number + type: long + description: Autonomous System Number from GeoIP ASN lookup. +- name: source.as.organization.name + type: keyword + description: Organization name from GeoIP ASN lookup. +- name: tags + type: keyword + description: List of keywords used to tag each event. diff --git a/packages/freeipa/data_stream/ipa_api/fields/fields.yml b/packages/freeipa/data_stream/ipa_api/fields/fields.yml new file mode 100644 index 00000000000..ea61987805d --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/fields/fields.yml @@ -0,0 +1,19 @@ +- name: freeipa.api + type: group + description: FreeIPA JSON-RPC API call fields. + fields: + - name: command + type: keyword + description: IPA API command name (user_add, group_add_member, and others). + - name: parameters + type: match_only_text + description: Command parameters from the API call (can contain long values like CSRs). + - name: server_class + type: keyword + description: IPA server handler class (jsonserver_session, jsonserver_kerb). + - name: result + type: keyword + description: Raw result string from the API call (SUCCESS or error text). + - name: version + type: keyword + description: IPA API version used for the call. diff --git a/packages/freeipa/data_stream/ipa_api/manifest.yml b/packages/freeipa/data_stream/ipa_api/manifest.yml new file mode 100644 index 00000000000..e0dd8c0acbd --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/manifest.yml @@ -0,0 +1,37 @@ +title: IPA API Audit Events +type: logs +streams: + - input: filestream + title: IPA API Audit Events + description: Collect FreeIPA JSON-RPC API calls from the httpd error log. + vars: + - name: paths + type: text + title: Log File Paths + multi: true + required: true + show_user: true + default: + - /var/log/httpd/error_log + - name: tags + type: text + title: Tags + multi: true + required: false + show_user: false + default: + - freeipa-ipa-api + - name: ignore_older + type: text + title: Ignore Older + description: Ignore log lines older than this duration. + required: false + show_user: false + default: 72h + - name: preserve_original_event + type: bool + title: Preserve Original Event + description: Preserve the raw log line in event.original. + required: false + show_user: true + default: false diff --git a/packages/freeipa/data_stream/ipa_api/sample_event.json b/packages/freeipa/data_stream/ipa_api/sample_event.json new file mode 100644 index 00000000000..2c0b730d58d --- /dev/null +++ b/packages/freeipa/data_stream/ipa_api/sample_event.json @@ -0,0 +1,112 @@ +{ + "process": { + "pid": 7521, + "thread": { + "id": 7677 + } + }, + "log": { + "file": { + "inode": "14070656", + "path": "/var/log/httpd/error_log", + "device_id": "66306", + "fingerprint": "e7aeb518b4583988e24ceddd7f703603d63a4363ba08274f76314b4180f74906" + }, + "offset": 1378531, + "level": "INFO" + }, + "source": { + "port": 60456, + "ip": "10.89.0.2" + }, + "freeipa": { + "api": { + "result": "SUCCESS", + "server_class": "jsonserver_kerb", + "version": "1", + "parameters": "None, sizelimit=1, version='2.254'", + "command": "user_find" + } + }, + "url": { + "path": "/ipa/json" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "api-server" + }, + "@timestamp": "2026-04-01T18:48:58.409Z", + "ecs": { + "version": "8.0.0" + }, + "related": { + "hosts": [ + "ipa.example.test" + ], + "ip": [ + "10.89.0.2" + ], + "user": [ + "admin", + "admin@EXAMPLE.TEST" + ] + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "family": "redhat", + "type": "linux", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "method": "POST" + } + }, + "client": { + "ip": "10.89.0.2" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2026-04-01T18:49:09Z", + "kind": "event", + "action": "user_find", + "category": [ + "iam" + ], + "type": [ + "info" + ], + "outcome": "success" + }, + "user": { + "domain": "EXAMPLE.TEST", + "name": "admin", + "id": "admin@EXAMPLE.TEST" + } +} diff --git a/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json new file mode 100644 index 00000000000..52b9311854f --- /dev/null +++ b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json @@ -0,0 +1,37 @@ +{ + "events": [ + { + "message": "Mar 13 07:27:42 ipa1.lab.local krb5kdc[70110](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: ISSUE: authtime 1773386862, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, host/ipa1.lab.local@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL" + }, + { + "message": "Mar 13 07:12:42 ipa1.lab.local krb5kdc[70110](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: ISSUE: authtime 1773385962, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, host/ipa1.lab.local@LAB.LOCAL for ldap/ipa1.lab.local@LAB.LOCAL" + }, + { + "message": "Mar 13 07:27:42 ipa1.lab.local krb5kdc[70109](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: NEEDED_PREAUTH: host/ipa1.lab.local@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Additional pre-authentication required" + }, + { + "message": "Apr 15 09:23:05 ipa1.lab.local krb5kdc[1234](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18)}) 192.168.1.51: PREAUTH_FAILED: baduser@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Preauthentication failed" + }, + { + "message": "Apr 15 09:23:06 ipa1.lab.local krb5kdc[1234](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18)}) 192.168.1.51: CLIENT_NOT_FOUND: nosuchuser@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Client not found in Kerberos database" + }, + { + "message": "Apr 15 09:23:15 ipa1.lab.local krb5kdc[1234](info): TGS_REQ (2 etypes {aes256-cts-hmac-sha1-96(18)}) 192.168.1.50: SERVER_NOT_FOUND: authtime 1713178981, admin@EXAMPLE.COM for host/unknown.example.com@EXAMPLE.COM, Server not found in Kerberos database" + }, + { + "message": "Mar 13 08:26:29 ipa1.lab.local krb5kdc[70109](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: CLIENT KEY EXPIRED: testuser1@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Password has expired" + }, + { + "message": "Mar 13 08:26:29 ipa1.lab.local krb5kdc[70109](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: LOOKING_UP_SERVER: authtime 0, admin@LAB.LOCAL for HTTP/nonexistent.lab.local@LAB.LOCAL, Server not found in Kerberos database" + }, + { + "message": "Mar 12 21:26:00 ipa1.lab.local krb5kdc[65621](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: LOOKING_UP_CLIENT: host/ipa1.lab.local@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Server error" + }, + { + "message": "Mar 13 09:15:00 ipa1.lab.local krb5kdc[70110](info): TGS_REQ (2 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: ISSUE: authtime 1773390900, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, CONSTRAINED-DELEGATION s4u-client=testuser1@LAB.LOCAL, HTTP/webserver.lab.local@LAB.LOCAL for cifs/fileserver.lab.local@LAB.LOCAL" + }, + { + "message": "Apr 15 09:30:00 ipa1.lab.local krb5kdc[1234](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18)}) 192.168.1.52: LOCKED_OUT: lockeduser@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Clients credentials have been revoked" + } + ] +} diff --git a/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-config.yml b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-expected.json b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-expected.json new file mode 100644 index 00000000000..88fa3916c73 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-default.json-expected.json @@ -0,0 +1,731 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-13T07:27:42.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgt_grant", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "authtime": "2026-03-13T07:27:42.000Z", + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "encryption_type": "aes256-cts-hmac-sha384-192", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70110 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-13T07:12:42.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgs_grant", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "authtime": "2026-03-13T07:12:42.000Z", + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "encryption_type": "aes256-cts-hmac-sha384-192", + "realm": "LAB.LOCAL", + "request_type": "TGS_REQ", + "service_principal": "ldap/ipa1.lab.local@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70110 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-13T07:27:42.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_preauth_required", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "reason": "Additional pre-authentication required", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "error_code": "NEEDED_PREAUTH", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + { + "@timestamp": "2026-04-15T09:23:05.000Z", + "client": { + "ip": "192.168.1.51" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "Preauthentication failed", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "baduser@EXAMPLE.COM", + "error_code": "PREAUTH_FAILED", + "realm": "EXAMPLE.COM", + "request_type": "AS_REQ", + "service_principal": "krbtgt/EXAMPLE.COM@EXAMPLE.COM" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 1234 + }, + "related": { + "ip": [ + "192.168.1.51" + ], + "user": [ + "baduser", + "baduser@EXAMPLE.COM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "192.168.1.51" + }, + "user": { + "domain": "EXAMPLE.COM", + "id": "baduser@EXAMPLE.COM", + "name": "baduser" + } + }, + { + "@timestamp": "2026-04-15T09:23:06.000Z", + "client": { + "ip": "192.168.1.51" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "Client not found in Kerberos database", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "nosuchuser@EXAMPLE.COM", + "error_code": "CLIENT_NOT_FOUND", + "realm": "EXAMPLE.COM", + "request_type": "AS_REQ", + "service_principal": "krbtgt/EXAMPLE.COM@EXAMPLE.COM" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 1234 + }, + "related": { + "ip": [ + "192.168.1.51" + ], + "user": [ + "nosuchuser", + "nosuchuser@EXAMPLE.COM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "192.168.1.51" + }, + "user": { + "domain": "EXAMPLE.COM", + "id": "nosuchuser@EXAMPLE.COM", + "name": "nosuchuser" + } + }, + { + "@timestamp": "2026-04-15T09:23:15.000Z", + "client": { + "ip": "192.168.1.50" + }, + "event": { + "action": "kdc_tgs_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "Server not found in Kerberos database", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "authtime": "2024-04-15T11:03:01.000Z", + "client_principal": "admin@EXAMPLE.COM", + "error_code": "SERVER_NOT_FOUND", + "realm": "EXAMPLE.COM", + "request_type": "TGS_REQ", + "service_principal": "host/unknown.example.com@EXAMPLE.COM" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 1234 + }, + "related": { + "ip": [ + "192.168.1.50" + ], + "user": [ + "admin", + "admin@EXAMPLE.COM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "192.168.1.50" + }, + "user": { + "domain": "EXAMPLE.COM", + "id": "admin@EXAMPLE.COM", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-13T08:26:29.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "Password has expired", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "testuser1@LAB.LOCAL", + "error_code": "CLIENT KEY EXPIRED", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "testuser1", + "testuser1@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "testuser1@LAB.LOCAL", + "name": "testuser1" + } + }, + { + "@timestamp": "2026-03-13T08:26:29.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgs_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "Server not found in Kerberos database", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "authtime": "1970-01-01T00:00:00.000Z", + "client_principal": "admin@LAB.LOCAL", + "error_code": "LOOKING_UP_SERVER", + "realm": "LAB.LOCAL", + "request_type": "TGS_REQ", + "service_principal": "HTTP/nonexistent.lab.local@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + { + "@timestamp": "2026-03-12T21:26:00.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "failure", + "reason": "Server error", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "error_code": "LOOKING_UP_CLIENT", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 65621 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + { + "@timestamp": "2026-03-13T09:15:00.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgs_grant", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "authtime": "2026-03-13T08:35:00.000Z", + "client_principal": "HTTP/webserver.lab.local@LAB.LOCAL", + "encryption_type": "aes256-cts-hmac-sha1-96", + "realm": "LAB.LOCAL", + "request_type": "TGS_REQ", + "s4u_client": "testuser1@LAB.LOCAL", + "service_principal": "cifs/fileserver.lab.local@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70110 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "HTTP/webserver.lab.local", + "HTTP/webserver.lab.local@LAB.LOCAL", + "testuser1", + "testuser1@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60", + "user": { + "domain": "LAB.LOCAL", + "id": "HTTP/webserver.lab.local@LAB.LOCAL", + "name": "HTTP/webserver.lab.local" + } + }, + "user": { + "target": { + "domain": "LAB.LOCAL", + "id": "testuser1@LAB.LOCAL", + "name": "testuser1" + } + } + }, + { + "@timestamp": "2026-04-15T09:30:00.000Z", + "client": { + "ip": "192.168.1.52" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "Clients credentials have been revoked", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "lockeduser@EXAMPLE.COM", + "error_code": "LOCKED_OUT", + "realm": "EXAMPLE.COM", + "request_type": "AS_REQ", + "service_principal": "krbtgt/EXAMPLE.COM@EXAMPLE.COM" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 1234 + }, + "related": { + "ip": [ + "192.168.1.52" + ], + "user": [ + "lockeduser", + "lockeduser@EXAMPLE.COM" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "192.168.1.52" + }, + "user": { + "domain": "EXAMPLE.COM", + "id": "lockeduser@EXAMPLE.COM", + "name": "lockeduser" + } + } + ] +} diff --git a/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json new file mode 100644 index 00000000000..766f3cb34a1 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json @@ -0,0 +1,64 @@ +{ + "events": [ + { + "message": "Mar 15 20:12:42 ipa1.lab.local krb5kdc[70109](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: ISSUE: authtime 1773605562, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, host/ipa1.lab.local@LAB.LOCAL for ldap/ipa1.lab.local@LAB.LOCAL" + }, + { + "message": "Mar 15 20:12:42 ipa1.lab.local krb5kdc[70109](info): closing down fd 11" + }, + { + "message": "Mar 15 20:27:42 ipa1.lab.local krb5kdc[70109](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: NEEDED_PREAUTH: host/ipa1.lab.local@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Additional pre-authentication required" + }, + { + "message": "Mar 15 20:27:42 ipa1.lab.local krb5kdc[70109](info): closing down fd 11" + }, + { + "message": "Mar 15 20:27:42 ipa1.lab.local krb5kdc[70109](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: ISSUE: authtime 1773606462, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, host/ipa1.lab.local@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL" + }, + { + "message": "Mar 15 20:27:42 ipa1.lab.local krb5kdc[70109](info): closing down fd 11" + }, + { + "message": "Mar 15 20:27:42 ipa1.lab.local krb5kdc[70110](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: ISSUE: authtime 1773606462, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, host/ipa1.lab.local@LAB.LOCAL for ldap/ipa1.lab.local@LAB.LOCAL" + }, + { + "message": "Mar 15 20:27:42 ipa1.lab.local krb5kdc[70110](info): closing down fd 4" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70109](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: CLIENT_NOT_FOUND: nonexistent@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Client not found in Kerberos database" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70109](info): closing down fd 11" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70109](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: NEEDED_PREAUTH: admin@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Additional pre-authentication required" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70109](info): closing down fd 11" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70110](info): preauth (spake) verify failure: Preauthentication failed" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70110](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: PREAUTH_FAILED: admin@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Preauthentication failed" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70110](info): closing down fd 4" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70109](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: NEEDED_PREAUTH: admin@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Additional pre-authentication required" + }, + { + "message": "Mar 15 20:31:39 ipa1.lab.local krb5kdc[70109](info): closing down fd 11" + }, + { + "message": "Mar 15 20:31:40 ipa1.lab.local krb5kdc[70110](info): preauth (spake) verify failure: Preauthentication failed" + }, + { + "message": "Mar 15 20:31:40 ipa1.lab.local krb5kdc[70110](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 172.30.0.60: PREAUTH_FAILED: admin@LAB.LOCAL for krbtgt/LAB.LOCAL@LAB.LOCAL, Preauthentication failed" + }, + { + "message": "Mar 15 20:31:40 ipa1.lab.local krb5kdc[70110](info): closing down fd 4" + } + ] +} diff --git a/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-config.yml b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-config.yml new file mode 100644 index 00000000000..680abfa66c2 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-config.yml @@ -0,0 +1,5 @@ +dynamic_fields: + event.ingested: ".*" + "@timestamp": ".*" + freeipa.kdc.authtime: ".*" + tags: ".*" diff --git a/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-expected.json b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-expected.json new file mode 100644 index 00000000000..0171f5fc60f --- /dev/null +++ b/packages/freeipa/data_stream/kdc/_dev/test/pipeline/test-real-logs.json-expected.json @@ -0,0 +1,600 @@ +{ + "expected": [ + { + "@timestamp": "2026-03-15T20:12:42.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgs_grant", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "authtime": "2026-03-15T20:12:42.000Z", + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "encryption_type": "aes256-cts-hmac-sha384-192", + "realm": "LAB.LOCAL", + "request_type": "TGS_REQ", + "service_principal": "ldap/ipa1.lab.local@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + null, + { + "@timestamp": "2026-03-15T20:27:42.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_preauth_required", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "reason": "Additional pre-authentication required", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "error_code": "NEEDED_PREAUTH", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + null, + { + "@timestamp": "2026-03-15T20:27:42.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgt_grant", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "authtime": "2026-03-15T20:27:42.000Z", + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "encryption_type": "aes256-cts-hmac-sha384-192", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + null, + { + "@timestamp": "2026-03-15T20:27:42.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgs_grant", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "authtime": "2026-03-15T20:27:42.000Z", + "client_principal": "host/ipa1.lab.local@LAB.LOCAL", + "encryption_type": "aes256-cts-hmac-sha384-192", + "realm": "LAB.LOCAL", + "request_type": "TGS_REQ", + "service_principal": "ldap/ipa1.lab.local@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70110 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "host/ipa1.lab.local", + "host/ipa1.lab.local@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "host/ipa1.lab.local@LAB.LOCAL", + "name": "host/ipa1.lab.local" + } + }, + null, + { + "@timestamp": "2026-03-15T20:31:39.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "Client not found in Kerberos database", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "nonexistent@LAB.LOCAL", + "error_code": "CLIENT_NOT_FOUND", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "nonexistent", + "nonexistent@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "nonexistent@LAB.LOCAL", + "name": "nonexistent" + } + }, + null, + { + "@timestamp": "2026-03-15T20:31:39.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_preauth_required", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "reason": "Additional pre-authentication required", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "admin@LAB.LOCAL", + "error_code": "NEEDED_PREAUTH", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + null, + null, + { + "@timestamp": "2026-03-15T20:31:39.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "Preauthentication failed", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "admin@LAB.LOCAL", + "error_code": "PREAUTH_FAILED", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70110 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + null, + { + "@timestamp": "2026-03-15T20:31:39.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_preauth_required", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "event", + "module": "freeipa", + "outcome": "success", + "reason": "Additional pre-authentication required", + "type": [ + "info" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "admin@LAB.LOCAL", + "error_code": "NEEDED_PREAUTH", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70109 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + null, + null, + { + "@timestamp": "2026-03-15T20:31:40.000Z", + "client": { + "ip": "172.30.0.60" + }, + "event": { + "action": "kdc_tgt_failure", + "category": [ + "authentication" + ], + "dataset": "freeipa.kdc", + "kind": "alert", + "module": "freeipa", + "outcome": "failure", + "reason": "Preauthentication failed", + "type": [ + "start" + ] + }, + "freeipa": { + "kdc": { + "client_principal": "admin@LAB.LOCAL", + "error_code": "PREAUTH_FAILED", + "realm": "LAB.LOCAL", + "request_type": "AS_REQ", + "service_principal": "krbtgt/LAB.LOCAL@LAB.LOCAL" + } + }, + "log": { + "level": "info" + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa1.lab.local", + "product": "FreeIPA", + "type": "kdc", + "vendor": "Red Hat" + }, + "process": { + "pid": 70110 + }, + "related": { + "ip": [ + "172.30.0.60" + ], + "user": [ + "admin", + "admin@LAB.LOCAL" + ] + }, + "service": { + "type": "freeipa" + }, + "source": { + "ip": "172.30.0.60" + }, + "user": { + "domain": "LAB.LOCAL", + "id": "admin@LAB.LOCAL", + "name": "admin" + } + }, + null + ] +} diff --git a/packages/freeipa/data_stream/kdc/_dev/test/system/test-default-config.yml b/packages/freeipa/data_stream/kdc/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..d35c4473879 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/_dev/test/system/test-default-config.yml @@ -0,0 +1,5 @@ +vars: ~ +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/krb5kdc.log" diff --git a/packages/freeipa/data_stream/kdc/agent/stream/stream.yml.hbs b/packages/freeipa/data_stream/kdc/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..1a967d1e39d --- /dev/null +++ b/packages/freeipa/data_stream/kdc/agent/stream/stream.yml.hbs @@ -0,0 +1,20 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +prospector.scanner.symlinks: true +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} +parsers: + - include_message: + patterns: + - "krb5kdc\\[" diff --git a/packages/freeipa/data_stream/kdc/elasticsearch/ingest_pipeline/default.yml b/packages/freeipa/data_stream/kdc/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..da1c34e1809 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,349 @@ +--- +description: Pipeline for FreeIPA KDC authentication events. +processors: + # Static metadata + - set: + tag: set_event_kind + field: event.kind + value: event + - set: + tag: set_event_module + field: event.module + value: freeipa + - set: + tag: set_event_dataset + field: event.dataset + value: freeipa.kdc + - set: + tag: set_event_category + field: event.category + value: + - authentication + + # Parse syslog prefix and KDC message + - grok: + tag: grok_kdc_line + field: message + patterns: + # Ticket request lines (AS_REQ or TGS_REQ) — status can have spaces (e.g., "CLIENT KEY EXPIRED") + - "%{SYSLOGTIMESTAMP:_temp.syslog_ts} %{HOSTNAME:observer.hostname} krb5kdc\\[%{POSINT:process.pid:int}\\]\\(%{WORD:log.level}\\): %{WORD:freeipa.kdc.request_type} \\(%{INT} etypes \\{%{DATA:_temp.etypes_offered}\\}\\) %{IP:source.ip}: %{DATA:_temp.status}:%{GREEDYDATA:_temp.rest}" + # Non-ticket lines (closing down fd, etc.) + - "%{SYSLOGTIMESTAMP:_temp.syslog_ts} %{HOSTNAME:observer.hostname} krb5kdc\\[%{POSINT:process.pid:int}\\]\\(%{WORD:log.level}\\): %{GREEDYDATA:_temp.info_message}" + + # Skip non-ticket events (closing down fd, preauth verify failure, etc.) + - drop: + tag: drop_non_ticket + if: ctx._temp?.info_message != null && ctx.freeipa?.kdc?.request_type == null + + # Trim whitespace from status (multi-word statuses like "CLIENT KEY EXPIRED") + - trim: + tag: trim_status + field: _temp.status + if: ctx._temp?.status != null + + # Parse the rest of the ticket request line + - grok: + tag: grok_kdc_issue + field: _temp.rest + if: ctx._temp?.status == 'ISSUE' + ignore_failure: true + patterns: + - " authtime %{NUMBER:_temp.authtime:long}, etypes \\{rep=%{DATA:_temp.rep_etype}(?:, tkt=%{DATA:_temp.tkt_etype})?(?:, ses=%{DATA:_temp.ses_etype})?\\},? ?(?:CONSTRAINED-DELEGATION s4u-client=%{DATA:_temp.s4u_client}, )?%{DATA:_temp.client_principal} for %{GREEDYDATA:_temp.service_principal}" + + - grok: + tag: grok_kdc_failure + field: _temp.rest + if: ctx._temp?.status != null && ctx._temp?.status != 'ISSUE' + ignore_failure: true + patterns: + # Failure with authtime (TGS failures) — allow extra whitespace after comma + - " authtime %{NUMBER:_temp.authtime:long},%{SPACE}%{DATA:_temp.client_principal} for %{DATA:_temp.service_principal}, %{GREEDYDATA:event.reason}" + # Failure without authtime (AS_REQ failures) + - " %{DATA:_temp.client_principal} for %{DATA:_temp.service_principal}, %{GREEDYDATA:event.reason}" + + # Parse timestamp — syslog format doesn't include year; the date processor + # defaults to the current year. This matches how Cisco ASA, system.syslog, + # and other Elastic integrations handle yearless syslog timestamps. + # Limitation: logs from Dec 31 ingested on Jan 1 will get the wrong year. + - date: + tag: date_parse + field: _temp.syslog_ts + target_field: "@timestamp" + formats: + - "MMM d HH:mm:ss" + - "MMM dd HH:mm:ss" + - "MMM d HH:mm:ss" + + # Extract client principal parts (user@REALM) + - grok: + tag: grok_client_principal + field: _temp.client_principal + if: ctx._temp?.client_principal != null + ignore_failure: true + patterns: + - "%{DATA:user.name}@%{GREEDYDATA:user.domain}" + - set: + tag: set_user_id + if: ctx._temp?.client_principal != null + field: user.id + copy_from: _temp.client_principal + + # Set freeipa.kdc fields + - set: + tag: set_client_principal + if: ctx._temp?.client_principal != null + field: freeipa.kdc.client_principal + copy_from: _temp.client_principal + - set: + tag: set_service_principal + if: ctx._temp?.service_principal != null + field: freeipa.kdc.service_principal + copy_from: _temp.service_principal + # Set for all non-ISSUE statuses, including NEEDED_PREAUTH. NEEDED_PREAUTH is a normal + # pre-authentication negotiation step (event.outcome=success) but we store it here so + # analysts can filter on any KDC status code without special-casing the field. + - set: + tag: set_error_code + if: ctx._temp?.status != null && ctx._temp?.status != 'ISSUE' + field: freeipa.kdc.error_code + copy_from: _temp.status + - set: + tag: set_realm + if: ctx.user?.domain != null + field: freeipa.kdc.realm + copy_from: user.domain + + # Extract reply encryption type (just the name, not the number) + - grok: + tag: grok_rep_etype + field: _temp.rep_etype + if: ctx._temp?.rep_etype != null + ignore_failure: true + patterns: + - "%{DATA:freeipa.kdc.encryption_type}\\(%{INT}\\)" + - "%{GREEDYDATA:freeipa.kdc.encryption_type}" + + # Parse authtime to date + - date: + tag: date_authtime + if: ctx._temp?.authtime != null + field: _temp.authtime + target_field: freeipa.kdc.authtime + formats: + - UNIX + + # Set event.outcome + - set: + tag: set_outcome_success + if: ctx._temp?.status == 'ISSUE' + field: event.outcome + value: success + - set: + tag: set_outcome_failure + if: ctx._temp?.status != null && ctx._temp?.status != 'ISSUE' && ctx._temp?.status != 'NEEDED_PREAUTH' + field: event.outcome + value: failure + - set: + tag: set_outcome_preauth + if: ctx._temp?.status == 'NEEDED_PREAUTH' + field: event.outcome + value: success + + # Set event.action + - script: + tag: script_event_action + lang: painless + ignore_failure: true + source: | + def reqType = ctx.freeipa?.kdc?.request_type; + def status = ctx._temp?.status; + if (reqType == null || status == null) return; + if (reqType.equals("AS_REQ")) { + if (status.equals("ISSUE")) { + ctx.event.put("action", "kdc_tgt_grant"); + ctx.event.put("type", ["start"]); + } else if (status.equals("NEEDED_PREAUTH")) { + ctx.event.put("action", "kdc_preauth_required"); + ctx.event.put("type", ["info"]); + } else { + ctx.event.put("action", "kdc_tgt_failure"); + ctx.event.put("type", ["start"]); + } + } else if (reqType.equals("TGS_REQ")) { + if (status.equals("ISSUE")) { + ctx.event.put("action", "kdc_tgs_grant"); + ctx.event.put("type", ["info"]); + } else { + ctx.event.put("action", "kdc_tgs_failure"); + ctx.event.put("type", ["info"]); + } + } + + # Constrained delegation — split into source.user (acting service) and user.target (impersonated) + - set: + tag: set_s4u_client + if: ctx._temp?.s4u_client != null + field: freeipa.kdc.s4u_client + copy_from: _temp.s4u_client + - grok: + tag: grok_s4u_principal + if: ctx._temp?.s4u_client != null + field: _temp.s4u_client + ignore_failure: true + patterns: + - "%{DATA:user.target.name}@%{GREEDYDATA:user.target.domain}" + - set: + tag: set_s4u_target_id + if: ctx._temp?.s4u_client != null + field: user.target.id + copy_from: _temp.s4u_client + - rename: + tag: rename_source_user_name + if: ctx._temp?.s4u_client != null && ctx.user?.name != null + field: user.name + target_field: source.user.name + - rename: + tag: rename_source_user_domain + if: ctx._temp?.s4u_client != null && ctx.user?.domain != null + field: user.domain + target_field: source.user.domain + - rename: + tag: rename_source_user_id + if: ctx._temp?.s4u_client != null && ctx.user?.id != null + field: user.id + target_field: source.user.id + + # Promote event.kind to alert for security-significant failures + - set: + tag: set_kind_alert + if: >- + ctx.freeipa?.kdc?.error_code == 'LOCKED_OUT' || + ctx.freeipa?.kdc?.error_code == 'PREAUTH_FAILED' || + ctx.freeipa?.kdc?.error_code == 'CLIENT_NOT_FOUND' + field: event.kind + value: alert + + # Related fields + - append: + tag: append_related_user + field: related.user + value: "{{user.name}}" + if: ctx.user?.name != null + allow_duplicates: false + - append: + tag: append_related_user_id + field: related.user + value: "{{user.id}}" + if: ctx.user?.id != null + allow_duplicates: false + - append: + tag: append_related_source_user + field: related.user + value: "{{source.user.name}}" + if: ctx.source?.user?.name != null + allow_duplicates: false + - append: + tag: append_related_source_user_id + field: related.user + value: "{{source.user.id}}" + if: ctx.source?.user?.id != null + allow_duplicates: false + - append: + tag: append_related_target_user + field: related.user + value: "{{user.target.name}}" + if: ctx.user?.target?.name != null + allow_duplicates: false + - append: + tag: append_related_target_user_id + field: related.user + value: "{{user.target.id}}" + if: ctx.user?.target?.id != null + allow_duplicates: false + - append: + tag: append_related_ip + field: related.ip + value: "{{source.ip}}" + if: ctx.source?.ip != null + allow_duplicates: false + + # GeoIP enrichment + - geoip: + tag: geoip_source + field: source.ip + target_field: source.geo + ignore_missing: true + ignore_failure: true + - geoip: + tag: geoip_source_asn + field: source.ip + target_field: source.as + database_file: GeoLite2-ASN.mmdb + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_asn + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + tag: rename_as_org + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + + # Network and service metadata + - set: + tag: set_service_type + field: service.type + value: freeipa + - set: + tag: set_network_protocol + field: network.protocol + value: kerberos + - set: + tag: set_network_transport + field: network.transport + value: udp + - set: + tag: set_client_ip + if: ctx.source?.ip != null + field: client.ip + copy_from: source.ip + + # Observer metadata + - set: + tag: set_observer_vendor + field: observer.vendor + value: Red Hat + - set: + tag: set_observer_product + field: observer.product + value: FreeIPA + - set: + tag: set_observer_type + field: observer.type + value: kdc + + # Clean up + - remove: + tag: remove_temp + field: _temp + ignore_missing: true + - remove: + tag: remove_message + field: message + ignore_missing: true + - remove: + tag: remove_event_original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + field: event.original + ignore_missing: true + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} failed with message: {{ _ingest.on_failure_message }}" diff --git a/packages/freeipa/data_stream/kdc/fields/base-fields.yml b/packages/freeipa/data_stream/kdc/fields/base-fields.yml new file mode 100644 index 00000000000..cbc72753db5 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: "@timestamp" + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + value: freeipa + description: Event module. +- name: event.dataset + type: constant_keyword + value: freeipa.kdc + description: Event dataset. diff --git a/packages/freeipa/data_stream/kdc/fields/ecs.yml b/packages/freeipa/data_stream/kdc/fields/ecs.yml new file mode 100644 index 00000000000..5134561598f --- /dev/null +++ b/packages/freeipa/data_stream/kdc/fields/ecs.yml @@ -0,0 +1,120 @@ +- name: ecs.version + type: keyword + description: ECS version this event conforms to. +- name: error.message + type: match_only_text + description: Error message. +- name: event.kind + type: keyword + description: The kind of event. +- name: event.category + type: keyword + description: Event category for ECS compatibility. +- name: event.type + type: keyword + description: Event type for ECS compatibility. +- name: event.action + type: keyword + description: The action captured by the event. +- name: event.outcome + type: keyword + description: The outcome of the event (success or failure). +- name: event.reason + type: keyword + description: Reason for the event outcome, typically an error message. +- name: log.level + type: keyword + description: Log level of the event. +- name: observer.vendor + type: keyword + description: Vendor of the observer. +- name: observer.product + type: keyword + description: Product name of the observer. +- name: observer.type + type: keyword + description: Type of the observer component. +- name: observer.hostname + type: keyword + description: Hostname of the FreeIPA server. +- name: process.pid + type: long + description: Process ID of the KDC daemon. +- name: service.type + type: keyword + description: Service type identifier. +- name: network.protocol + type: keyword + description: Application protocol (kerberos). +- name: network.transport + type: keyword + description: Transport protocol (udp). +- name: client.ip + type: ip + description: IP address of the Kerberos client. +- name: source.ip + type: ip + description: IP address of the Kerberos client. +- name: user.name + type: keyword + description: Short principal name (or target user for non-delegation events). +- name: user.domain + type: keyword + description: Kerberos realm. +- name: user.id + type: keyword + description: Full Kerberos principal. +- name: user.target.name + type: keyword + description: Impersonated user in constrained delegation (S4U2Proxy). +- name: user.target.domain + type: keyword + description: Realm of the impersonated user in constrained delegation. +- name: user.target.id + type: keyword + description: Full principal of the impersonated user in constrained delegation. +- name: source.user.name + type: keyword + description: Acting service principal name in constrained delegation. +- name: source.user.domain + type: keyword + description: Realm of the acting service in constrained delegation. +- name: source.user.id + type: keyword + description: Full acting service principal in constrained delegation. +- name: related.user + type: keyword + description: All user identifiers seen in this event. +- name: related.ip + type: ip + description: All IP addresses seen in this event. +- name: source.geo.city_name + type: keyword + description: City name from GeoIP lookup. +- name: source.geo.continent_name + type: keyword + description: Continent name from GeoIP lookup. +- name: source.geo.country_iso_code + type: keyword + description: Country ISO code from GeoIP lookup. +- name: source.geo.country_name + type: keyword + description: Country name from GeoIP lookup. +- name: source.geo.location + type: geo_point + description: Longitude and latitude from GeoIP lookup. +- name: source.geo.region_iso_code + type: keyword + description: Region ISO code from GeoIP lookup. +- name: source.geo.region_name + type: keyword + description: Region name from GeoIP lookup. +- name: source.as.number + type: long + description: Autonomous System Number from GeoIP ASN lookup. +- name: source.as.organization.name + type: keyword + description: Organization name from GeoIP ASN lookup. +- name: tags + type: keyword + description: List of keywords used to tag each event. diff --git a/packages/freeipa/data_stream/kdc/fields/fields.yml b/packages/freeipa/data_stream/kdc/fields/fields.yml new file mode 100644 index 00000000000..cd1925a38a4 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/fields/fields.yml @@ -0,0 +1,31 @@ +- name: freeipa.kdc + type: group + description: Kerberos KDC authentication event fields. + fields: + - name: request_type + type: keyword + description: Kerberos request type (AS_REQ or TGS_REQ). + - name: client_principal + type: keyword + description: Full client Kerberos principal (user@REALM). + - name: service_principal + type: keyword + description: Full service principal being requested. + - name: encryption_type + type: keyword + description: Reply encryption type used for the ticket. + - name: error_code + type: keyword + description: >- + KDC status code for non-ISSUE responses. Set for all statuses except ISSUE, + including NEEDED_PREAUTH which has event.outcome=success because it is a + normal pre-authentication negotiation step, not a failure. + - name: realm + type: keyword + description: Kerberos realm. + - name: authtime + type: date + description: Authentication timestamp from the ticket. + - name: s4u_client + type: keyword + description: S4U2Proxy delegated client principal (constrained delegation). diff --git a/packages/freeipa/data_stream/kdc/manifest.yml b/packages/freeipa/data_stream/kdc/manifest.yml new file mode 100644 index 00000000000..c45376e7954 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/manifest.yml @@ -0,0 +1,37 @@ +title: KDC Authentication Events +type: logs +streams: + - input: filestream + title: KDC Authentication Events + description: Collect Kerberos KDC authentication events from krb5kdc.log + vars: + - name: paths + type: text + title: Log File Paths + multi: true + required: true + show_user: true + default: + - /var/log/krb5kdc.log + - name: tags + type: text + title: Tags + multi: true + required: false + show_user: false + default: + - freeipa-kdc + - name: ignore_older + type: text + title: Ignore Older + description: Ignore log lines older than this duration. + required: false + show_user: false + default: 72h + - name: preserve_original_event + type: bool + title: Preserve Original Event + description: Preserve the raw log line in event.original. + required: false + show_user: true + default: false diff --git a/packages/freeipa/data_stream/kdc/sample_event.json b/packages/freeipa/data_stream/kdc/sample_event.json new file mode 100644 index 00000000000..ac3d1d45590 --- /dev/null +++ b/packages/freeipa/data_stream/kdc/sample_event.json @@ -0,0 +1,98 @@ +{ + "process": { + "pid": 379 + }, + "log": { + "file": { + "inode": "13949025", + "path": "/var/log/krb5kdc.log", + "device_id": "66306", + "fingerprint": "ec0101bfb20272f986433e1d95695323827bdceb625e503936f02949c17d2fc2" + }, + "offset": 11787845, + "level": "info" + }, + "source": { + "ip": "10.89.0.2" + }, + "freeipa": { + "kdc": { + "client_principal": "admin@EXAMPLE.TEST", + "service_principal": "krbtgt/EXAMPLE.TEST@EXAMPLE.TEST", + "request_type": "AS_REQ", + "error_code": "NEEDED_PREAUTH", + "realm": "EXAMPLE.TEST" + } + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa.example.test", + "product": "FreeIPA", + "vendor": "Red Hat", + "type": "kdc" + }, + "@timestamp": "2026-04-01T18:49:29.000Z", + "ecs": { + "version": "8.0.0" + }, + "related": { + "ip": [ + "10.89.0.2" + ], + "user": [ + "admin", + "admin@EXAMPLE.TEST" + ] + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "family": "redhat", + "type": "linux", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "client": { + "ip": "10.89.0.2" + }, + "event": { + "agent_id_status": "verified", + "reason": "Additional pre-authentication required", + "ingested": "2026-04-01T18:49:43Z", + "kind": "event", + "action": "kdc_preauth_required", + "category": [ + "authentication" + ], + "type": [ + "info" + ], + "outcome": "success" + }, + "user": { + "domain": "EXAMPLE.TEST", + "name": "admin", + "id": "admin@EXAMPLE.TEST" + } +} diff --git a/packages/freeipa/docs/README.md b/packages/freeipa/docs/README.md new file mode 100644 index 00000000000..4310932ac16 --- /dev/null +++ b/packages/freeipa/docs/README.md @@ -0,0 +1,974 @@ +# FreeIPA Integration + +This integration collects security-relevant logs from FreeIPA (Red Hat IdM) identity management servers. It parses authentication events from the Kerberos KDC, LDAP operations from 389 Directory Server, PKI certificate lifecycle events from Dogtag CA, and high-level IAM operations from the FreeIPA JSON API. All data streams use filestream input to read log files directly from the server. + +## Compatibility + +Tested with FreeIPA 4.11 on Rocky Linux 9 and RHEL 9. Should work with FreeIPA 4.6 and later on any supported platform (RHEL 7+, CentOS, Rocky, Alma, Fedora). Red Hat IdM is the same software and produces the same log formats. + +## Setup + +Deploy one Elastic Agent per FreeIPA server. The agent reads log files directly, so it needs to run on the same host (or have the log directories mounted). + +### File permissions + +The Elastic Agent process needs read access to these log files: + +| Log file | Default owner | Notes | +|----------|---------------|-------| +| `/var/log/krb5kdc.log` | root:root | Readable by root only by default | +| `/var/log/dirsrv/slapd-*/access` | dirsrv:dirsrv | | +| `/var/log/dirsrv/slapd-*/errors` | dirsrv:dirsrv | | +| `/var/log/pki/pki-tomcat/ca/signedAudit/ca_audit` | pkiuser:pkiuser | Only on CA replicas | +| `/var/log/httpd/error_log` | root:root | | + + +Add the `elastic-agent` user to the `dirsrv` and `pkiuser` groups, or use ACLs: + +```bash +setfacl -m u:elastic-agent:r /var/log/krb5kdc.log +setfacl -m u:elastic-agent:rx /var/log/dirsrv/slapd-* +setfacl -m u:elastic-agent:r /var/log/dirsrv/slapd-*/access +setfacl -m u:elastic-agent:r /var/log/dirsrv/slapd-*/errors +setfacl -m u:elastic-agent:rx /var/log/pki/pki-tomcat/ca/signedAudit +setfacl -m u:elastic-agent:r /var/log/pki/pki-tomcat/ca/signedAudit/ca_audit +setfacl -m u:elastic-agent:r /var/log/httpd/error_log +``` + +### Logging configuration + +FreeIPA enables most logging by default. Verify these settings are in place: + + +**KDC logging** (krb5.conf): +```ini +[logging] + kdc = FILE:/var/log/krb5kdc.log + admin_server = FILE:/var/log/kadmind.log +``` + +**389ds access logging** (enabled by default, verify with the following command): +```bash +dsconf slapd-YOUR-REALM config get nsslapd-accesslog-logging-enabled +``` + +**IPA API logging** (default.conf): + +No configuration required. API operations are logged at INFO level regardless of the `debug` setting. The `debug = True` option adds startup DEBUG messages (~700 lines per httpd restart) but does not affect API operation logging. + + +### Elastic Agent configuration + +1. In Kibana, go to **Integrations** and search for "FreeIPA". +2. Add the integration and review the default log file paths for each data stream. +3. If your FreeIPA instance name differs from the default, update the 389ds log paths (replace `LAB-LOCAL` with your realm name, dots replaced by dashes). +4. Enable **Preserve Original Event** if you want the raw log line stored in `event.original`. +5. Deploy the policy to an Elastic Agent running on each FreeIPA server. + +## Transforms + +The integration includes optional transforms that enable cross-event correlation for advanced detection rules. + +### latest_bind + +Maintains a real-time lookup table mapping each LDAP `connection_id` to the authenticated `bind_dn` and `bind_method` from the corresponding BIND event. This enables detection rules to identify WHO performed an LDAP operation by joining RESULT or SRCH events with the bind context. + +**Enables:** Anonymous LDAP enumeration detection, credential attribute search attribution, non-service account enumeration detection, sensitive DN modification attribution, LDAP configuration change attribution. + +**Destination index:** `logs-freeipa_latest.dest_bind-1` (lookup mode, compatible with ES|QL LOOKUP JOIN). + +**Refresh:** Every 30 seconds. **Retention:** 7 days. + +### latest_connection + +Maintains a lookup of connection metadata mapping each `connection_id` to `source.ip`, `destination.ip`, and SSL status. Enables correlation of LDAP operations with their network origin. + +**Destination index:** `logs-freeipa_latest.dest_connection-1` (lookup mode). + +**Refresh:** Every 30 seconds. **Retention:** 7 days. + +### latest_auth + +Tracks the most recent Kerberos authentication (TGT grant or failure) per `(client_principal, source_ip)` pair. Used by detection rules to identify authentication from new or unusual source IPs for known principals. + +**Destination index:** `logs-freeipa_latest.dest_auth-1` (lookup mode). + +**Refresh:** Every 30 seconds. **Retention:** 30 days. + +### Activating transforms + +Transforms are installed in a stopped state. The `kibana_system` user that Fleet uses to manage transforms does not have privileges on custom integration indices, so the transforms need to be started by a user with the right access. + +The simplest approach is to run the update and start calls as a superuser (the `elastic` admin account or equivalent): + +``` +POST /_transform/logs-freeipa.latest_bind-default-/_update +{} + +POST /_transform/logs-freeipa.latest_bind-default-/_start +``` + +The empty `_update` call reassigns the transform's stored credentials to the calling user. Repeat for `latest_connection` and `latest_auth`. Replace `` with the installed package version (for example, `0.1.0`). + +For environments where using the admin account is not appropriate, create a dedicated role with read access to the source indices and write access to the destination indices: + +``` +PUT /_security/role/freeipa_transform +{ + "indices": [ + { + "names": ["logs-freeipa.directory_access-*", "logs-freeipa.kdc-*"], + "privileges": ["read", "view_index_metadata"] + }, + { + "names": ["logs-freeipa_latest.*"], + "privileges": ["create_index", "delete", "index", "manage", "read"] + } + ] +} +``` + +Assign this role to a service account or API key, then run the `_update` and `_start` calls as that identity. + +## Data Streams + +### KDC + +The `kdc` data stream collects Kerberos KDC authentication events from `/var/log/krb5kdc.log`. Each event represents a ticket request (AS_REQ for TGT, TGS_REQ for service ticket) with its outcome, client principal, service principal, source IP, and encryption types. + +An example event for `kdc` looks as following: + +```json +{ + "process": { + "pid": 379 + }, + "log": { + "file": { + "inode": "13949025", + "path": "/var/log/krb5kdc.log", + "device_id": "66306", + "fingerprint": "ec0101bfb20272f986433e1d95695323827bdceb625e503936f02949c17d2fc2" + }, + "offset": 11787845, + "level": "info" + }, + "source": { + "ip": "10.89.0.2" + }, + "freeipa": { + "kdc": { + "client_principal": "admin@EXAMPLE.TEST", + "service_principal": "krbtgt/EXAMPLE.TEST@EXAMPLE.TEST", + "request_type": "AS_REQ", + "error_code": "NEEDED_PREAUTH", + "realm": "EXAMPLE.TEST" + } + }, + "network": { + "protocol": "kerberos", + "transport": "udp" + }, + "observer": { + "hostname": "ipa.example.test", + "product": "FreeIPA", + "vendor": "Red Hat", + "type": "kdc" + }, + "@timestamp": "2026-04-01T18:49:29.000Z", + "ecs": { + "version": "8.0.0" + }, + "related": { + "ip": [ + "10.89.0.2" + ], + "user": [ + "admin", + "admin@EXAMPLE.TEST" + ] + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "family": "redhat", + "type": "linux", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "client": { + "ip": "10.89.0.2" + }, + "event": { + "agent_id_status": "verified", + "reason": "Additional pre-authentication required", + "ingested": "2026-04-01T18:49:43Z", + "kind": "event", + "action": "kdc_preauth_required", + "category": [ + "authentication" + ], + "type": [ + "info" + ], + "outcome": "success" + }, + "user": { + "domain": "EXAMPLE.TEST", + "name": "admin", + "id": "admin@EXAMPLE.TEST" + } +} +``` + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| client.ip | IP address of the Kerberos client. | ip | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. | keyword | +| event.category | Event category for ECS compatibility. | keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.kind | The kind of event. | keyword | +| event.module | Event module. | constant_keyword | +| event.outcome | The outcome of the event (success or failure). | keyword | +| event.reason | Reason for the event outcome, typically an error message. | keyword | +| event.type | Event type for ECS compatibility. | keyword | +| freeipa.kdc.authtime | Authentication timestamp from the ticket. | date | +| freeipa.kdc.client_principal | Full client Kerberos principal (user@REALM). | keyword | +| freeipa.kdc.encryption_type | Reply encryption type used for the ticket. | keyword | +| freeipa.kdc.error_code | KDC status code for non-ISSUE responses. Set for all statuses except ISSUE, including NEEDED_PREAUTH which has event.outcome=success because it is a normal pre-authentication negotiation step, not a failure. | keyword | +| freeipa.kdc.realm | Kerberos realm. | keyword | +| freeipa.kdc.request_type | Kerberos request type (AS_REQ or TGS_REQ). | keyword | +| freeipa.kdc.s4u_client | S4U2Proxy delegated client principal (constrained delegation). | keyword | +| freeipa.kdc.service_principal | Full service principal being requested. | keyword | +| log.level | Log level of the event. | keyword | +| network.protocol | Application protocol (kerberos). | keyword | +| network.transport | Transport protocol (udp). | keyword | +| observer.hostname | Hostname of the FreeIPA server. | keyword | +| observer.product | Product name of the observer. | keyword | +| observer.type | Type of the observer component. | keyword | +| observer.vendor | Vendor of the observer. | keyword | +| process.pid | Process ID of the KDC daemon. | long | +| related.ip | All IP addresses seen in this event. | ip | +| related.user | All user identifiers seen in this event. | keyword | +| service.type | Service type identifier. | keyword | +| source.as.number | Autonomous System Number from GeoIP ASN lookup. | long | +| source.as.organization.name | Organization name from GeoIP ASN lookup. | keyword | +| source.geo.city_name | City name from GeoIP lookup. | keyword | +| source.geo.continent_name | Continent name from GeoIP lookup. | keyword | +| source.geo.country_iso_code | Country ISO code from GeoIP lookup. | keyword | +| source.geo.country_name | Country name from GeoIP lookup. | keyword | +| source.geo.location | Longitude and latitude from GeoIP lookup. | geo_point | +| source.geo.region_iso_code | Region ISO code from GeoIP lookup. | keyword | +| source.geo.region_name | Region name from GeoIP lookup. | keyword | +| source.ip | IP address of the Kerberos client. | ip | +| source.user.domain | Realm of the acting service in constrained delegation. | keyword | +| source.user.id | Full acting service principal in constrained delegation. | keyword | +| source.user.name | Acting service principal name in constrained delegation. | keyword | +| tags | List of keywords used to tag each event. | keyword | +| user.domain | Kerberos realm. | keyword | +| user.id | Full Kerberos principal. | keyword | +| user.name | Short principal name (or target user for non-delegation events). | keyword | +| user.target.domain | Realm of the impersonated user in constrained delegation. | keyword | +| user.target.id | Full principal of the impersonated user in constrained delegation. | keyword | +| user.target.name | Impersonated user in constrained delegation (S4U2Proxy). | keyword | + + +### Directory Access + +The `directory_access` data stream collects LDAP operation logs from 389 Directory Server (`/var/log/dirsrv/slapd-*/access`). Each line is one event — either an operation (BIND, SRCH, MOD, ADD, DEL) or a RESULT line with the outcome. Operations and results share `conn=N op=N` identifiers for correlation. + +An example event for `directory_access` looks as following: + +```json +{ + "log": { + "file": { + "inode": "14071730", + "path": "/var/log/dirsrv/slapd-EXAMPLE-TEST/access", + "device_id": "66306", + "fingerprint": "c8af355f52f042f6bf41953f638c7762474a85f0c40b8977088a214f18b5c19e" + }, + "offset": 46219203 + }, + "freeipa": { + "directory": { + "entries_returned": 1, + "optime": 0.000467528, + "connection_id": 1566, + "wtime": 0.000146482, + "elapsed_time": 0.000612577, + "tag_number": 101, + "operation_id": 2, + "result_code": 4, + "operation": "RESULT" + } + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "directory-server" + }, + "@timestamp": "2026-04-01T18:48:58.408Z", + "ecs": { + "version": "8.0.0" + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "type": "linux", + "family": "redhat", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 612577, + "agent_id_status": "verified", + "reason": "LDAP error code 4", + "ingested": "2026-04-01T18:49:21Z", + "kind": "event", + "action": "ldap_result", + "category": [ + "database" + ], + "type": [ + "info" + ], + "outcome": "failure" + } +} +``` + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| client.ip | IP address of the LDAP client. | ip | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.ip | IP address of the directory server. | ip | +| destination.port | Listening port of the directory server (389 or 636). | long | +| ecs.version | ECS version this event conforms to. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. | keyword | +| event.category | Event category for ECS compatibility. | keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.duration | Duration of the LDAP operation in nanoseconds. | long | +| event.kind | The kind of event. | keyword | +| event.module | Event module. | constant_keyword | +| event.outcome | The outcome of the event (success or failure). | keyword | +| event.reason | Reason for the event outcome, typically an LDAP error description. | keyword | +| event.type | Event type for ECS compatibility. | keyword | +| freeipa.directory.base_dn | Base DN for search operations. | keyword | +| freeipa.directory.bind_dn | DN used for BIND authentication. | keyword | +| freeipa.directory.bind_method | BIND method (SIMPLE or SASL/mechanism). | keyword | +| freeipa.directory.connection_id | LDAP connection number (conn=N). | long | +| freeipa.directory.elapsed_time | Elapsed time for the operation in seconds. | float | +| freeipa.directory.entries_returned | Number of entries returned by the operation. | long | +| freeipa.directory.ext_name | Human-readable name of the LDAP extended operation. | keyword | +| freeipa.directory.ext_oid | OID of the LDAP extended operation. | keyword | +| freeipa.directory.filter | LDAP search filter. | keyword | +| freeipa.directory.new_rdn | New relative distinguished name in MODRDN operations. | keyword | +| freeipa.directory.new_superior | New parent DN in MODRDN operations. | keyword | +| freeipa.directory.notes | Notes field from RESULT lines (P for paged, U for unindexed, A for all-ids threshold). | keyword | +| freeipa.directory.operation | LDAP operation type (BIND, SRCH, MOD, ADD, DEL, CMP, RESULT, CONNECTION, DISCONNECT). | keyword | +| freeipa.directory.operation_id | LDAP operation number within the connection (op=N). | long | +| freeipa.directory.optime | Actual operation processing time, in seconds. | float | +| freeipa.directory.result_code | LDAP result code (0 = success). | integer | +| freeipa.directory.scope | Search scope (base, one, sub). | keyword | +| freeipa.directory.ssl | Whether the connection uses SSL/TLS. | boolean | +| freeipa.directory.tag_number | LDAP protocol tag number from RESULT. | long | +| freeipa.directory.target_dn | Target DN for modify, add, delete, or compare operations. | keyword | +| freeipa.directory.target_op | Target operation ID being abandoned (ABANDON events only). | long | +| freeipa.directory.unindexed | Whether the operation required an unindexed search. | boolean | +| freeipa.directory.wtime | Wait time before the operation was processed, in seconds. | float | +| network.protocol | Application protocol (ldap or ldaps). | keyword | +| network.transport | Transport protocol (tcp). | keyword | +| observer.hostname | Hostname of the observer. | keyword | +| observer.product | Product name of the observer. | keyword | +| observer.type | Type of the observer component. | keyword | +| observer.vendor | Vendor of the observer. | keyword | +| related.ip | All IP addresses seen in this event. | ip | +| related.user | All user identifiers seen in this event. | keyword | +| server.ip | IP address of the directory server. | ip | +| service.type | Service type identifier. | keyword | +| source.as.number | Autonomous System Number from GeoIP ASN lookup. | long | +| source.as.organization.name | Organization name from GeoIP ASN lookup. | keyword | +| source.geo.city_name | City name from GeoIP lookup. | keyword | +| source.geo.continent_name | Continent name from GeoIP lookup. | keyword | +| source.geo.country_iso_code | Country ISO code from GeoIP lookup. | keyword | +| source.geo.country_name | Country name from GeoIP lookup. | keyword | +| source.geo.location | Longitude and latitude from GeoIP lookup. | geo_point | +| source.geo.region_iso_code | Region ISO code from GeoIP lookup. | keyword | +| source.geo.region_name | Region name from GeoIP lookup. | keyword | +| source.ip | IP address of the LDAP client. | ip | +| tags | List of keywords used to tag each event. | keyword | +| tls.cipher | TLS cipher suite used. | keyword | +| tls.client.x509.issuer.distinguished_name | Issuer DN of the client certificate. | keyword | +| tls.client.x509.subject.distinguished_name | Subject DN of the client certificate. | keyword | +| tls.version | TLS version negotiated. | keyword | +| tls.version_protocol | TLS version protocol component (tls). | keyword | +| user.id | Full bind DN. | keyword | +| user.name | Username extracted from the bind DN. | keyword | + + +### Directory Errors + +The `directory_errors` data stream collects error and warning logs from 389 Directory Server (`/var/log/dirsrv/slapd-*/errors`). This includes replication failures, plugin errors, unindexed search warnings, and server lifecycle events. + +An example event for `directory_errors` looks as following: + +```json +{ + "log": { + "file": { + "inode": "14069469", + "path": "/var/log/dirsrv/slapd-EXAMPLE-TEST/errors", + "device_id": "66306", + "fingerprint": "bfbaa773348a7449d0c5a3a9e16f41690633475870195d0eafc7e0f754180662" + }, + "offset": 128457, + "level": "err" + }, + "freeipa": { + "directory_error": { + "subsystem": "NSACLPlugin", + "message": "acl_access_allowed - Resetting aclpb_pblock 0x7f8702000000 to pblock addr 0x7f8700c00720" + } + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "directory-server" + }, + "@timestamp": "2026-04-01T09:19:16.890Z", + "ecs": { + "version": "8.0.0" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "type": "linux", + "family": "redhat", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "event": { + "agent_id_status": "verified", + "reason": "acl_access_allowed - Resetting aclpb_pblock 0x7f8702000000 to pblock addr 0x7f8700c00720", + "ingested": "2026-04-01T09:19:25Z", + "kind": "event", + "action": "directory_error", + "category": [ + "database" + ], + "type": [ + "error" + ], + "outcome": "failure" + } +} +``` + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. | keyword | +| error.code | LDAP error code from replication failures. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. | keyword | +| event.category | Event category for ECS compatibility. | keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.kind | The kind of event. | keyword | +| event.module | Event module. | constant_keyword | +| event.outcome | The outcome of the event. | keyword | +| event.reason | Reason for the event outcome. | keyword | +| event.type | Event type for ECS compatibility. | keyword | +| freeipa.directory_error.agreement | Replication agreement name. | keyword | +| freeipa.directory_error.ldap_error_code | LDAP error code from a replication operation. | integer | +| freeipa.directory_error.message | Full log message text after the subsystem prefix. | match_only_text | +| freeipa.directory_error.remote_host | Remote host in a replication agreement. | keyword | +| freeipa.directory_error.subsystem | Directory Server subsystem that produced the log entry. | keyword | +| log.level | Log level of the event. | keyword | +| observer.hostname | Hostname of the observer. | keyword | +| observer.product | Product name of the observer. | keyword | +| observer.type | Type of the observer component. | keyword | +| observer.vendor | Vendor of the observer. | keyword | +| related.hosts | All hostnames or FQDNs related to the event. | keyword | +| service.type | Service type identifier. | keyword | +| tags | List of keywords used to tag each event. | keyword | + + +### CA Audit + +The `ca_audit` data stream collects signed audit events from the Dogtag PKI Certificate Authority (`/var/log/pki/pki-tomcat/ca/signedAudit/ca_audit`). This includes certificate requests, issuances, revocations, CA authentication events, and session tracking. This data stream is only active on FreeIPA servers that run the CA role. + +An example event for `ca_audit` looks as following: + +```json +{ + "server": { + "ip": "10.89.0.2" + }, + "log": { + "file": { + "inode": "14070368", + "path": "/var/log/pki/pki-tomcat/ca/signedAudit/ca_audit", + "device_id": "66306", + "fingerprint": "a04bc75ae3e18025de3dc6f0dc36c4e09a8db3f0c1ddafc3f5e33fe3f1554870" + }, + "offset": 252717 + }, + "destination": { + "port": 636, + "ip": "10.89.0.2" + }, + "source": { + "ip": "10.89.0.2" + }, + "freeipa": { + "ca": { + "issuer_dn": "CN=Certificate Authority,O=EXAMPLE.TEST", + "event_type": "CLIENT_ACCESS_SESSION_TERMINATED", + "server_host": "10.89.0.2", + "server_port": 636, + "serial_number": "8", + "thread": "0.LDAPConnThread-5 ldaps://ipa.example.test:636", + "info": "clientAlertReceived: CLOSE_NOTIFY" + } + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "ca" + }, + "@timestamp": "2026-04-01T10:19:23.000Z", + "file": { + "x509": { + "serial_number": "8", + "issuer": { + "distinguished_name": "CN=Certificate Authority,O=EXAMPLE.TEST" + } + } + }, + "ecs": { + "version": "8.0.0" + }, + "related": { + "ip": [ + "10.89.0.2" + ], + "user": [ + "ipa.example.test", + "CN=ipa.example.test,O=EXAMPLE.TEST" + ] + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "family": "redhat", + "type": "linux", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2026-04-01T10:19:41Z", + "kind": "event", + "action": "ca_session_terminate", + "category": [ + "session" + ], + "type": [ + "end" + ], + "outcome": "success" + }, + "user": { + "name": "ipa.example.test", + "id": "CN=ipa.example.test,O=EXAMPLE.TEST" + } +} +``` + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.ip | IP address of the server (from ServerHost). | ip | +| destination.port | Port of the server (from ServerPort). | long | +| ecs.version | ECS version this event conforms to. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. | keyword | +| event.category | Event category for ECS compatibility. | keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.kind | The kind of event. | keyword | +| event.module | Event module. | constant_keyword | +| event.outcome | The outcome of the event (success or failure). | keyword | +| event.type | Event type for ECS compatibility. | keyword | +| file.x509.issuer.distinguished_name | Certificate issuer distinguished name. | keyword | +| file.x509.serial_number | Certificate serial number. | keyword | +| file.x509.subject.distinguished_name | Certificate subject distinguished name. | keyword | +| freeipa.ca.acl_op | ACL operation from authorization events. | keyword | +| freeipa.ca.acl_resource | ACL resource name from authorization events. | keyword | +| freeipa.ca.approval | Approval status of certificate status change requests. | keyword | +| freeipa.ca.auth_manager | Authentication manager used for the request. | keyword | +| freeipa.ca.crl_number | CRL sequence number from CRL generation events. | keyword | +| freeipa.ca.crl_size | Number of entries in the generated CRL. | long | +| freeipa.ca.event_type | CA audit event type (for example, CLIENT_ACCESS_SESSION_ESTABLISH, CERT_REQUEST_PROCESSED). | keyword | +| freeipa.ca.info | Additional information from the audit event (can contain stack traces or long error messages). | match_only_text | +| freeipa.ca.issuer_dn | Certificate issuer distinguished name. | keyword | +| freeipa.ca.profile | Certificate profile ID used for the request. | keyword | +| freeipa.ca.request_id | Certificate request ID. | keyword | +| freeipa.ca.request_type | Certificate request type (for example, enrollment, renewal). | keyword | +| freeipa.ca.revocation_reason | Reason code for certificate revocation. | keyword | +| freeipa.ca.role | Role assumed in ROLE_ASSUME events. | keyword | +| freeipa.ca.scope | Scope of the configuration change. | keyword | +| freeipa.ca.serial_number | Certificate serial number. | keyword | +| freeipa.ca.server_host | Server hostname or IP from the audit event. | keyword | +| freeipa.ca.server_port | Server port from the audit event. | integer | +| freeipa.ca.subject_dn | Certificate subject distinguished name. | keyword | +| freeipa.ca.thread | Thread name from the CA audit log. | keyword | +| observer.hostname | Hostname of the observer. | keyword | +| observer.product | Product name of the observer. | keyword | +| observer.type | Type of the observer component. | keyword | +| observer.vendor | Vendor of the observer. | keyword | +| related.hosts | All hostnames seen in this event. | keyword | +| related.ip | All IP addresses seen in this event. | ip | +| related.user | All user identifiers seen in this event. | keyword | +| server.ip | IP address of the server. | ip | +| service.type | Service type identifier. | keyword | +| source.as.number | Autonomous System Number from GeoIP ASN lookup. | long | +| source.as.organization.name | Organization name from GeoIP ASN lookup. | keyword | +| source.geo.city_name | City name from GeoIP lookup. | keyword | +| source.geo.continent_name | Continent name from GeoIP lookup. | keyword | +| source.geo.country_iso_code | Country ISO code from GeoIP lookup. | keyword | +| source.geo.country_name | Country name from GeoIP lookup. | keyword | +| source.geo.location | Longitude and latitude from GeoIP lookup. | geo_point | +| source.geo.region_iso_code | Region ISO code from GeoIP lookup. | keyword | +| source.geo.region_name | Region name from GeoIP lookup. | keyword | +| source.ip | IP address of the client. | ip | +| tags | List of keywords used to tag each event. | keyword | +| user.id | Subject ID from the audit event. | keyword | +| user.name | Subject identity from the audit event. | keyword | + + +### IPA API + +The `ipa_api` data stream collects FreeIPA JSON API operation logs from the Apache error log (`/var/log/httpd/error_log`). Each event represents a high-level IPA command (user_add, group_add_member, cert_request, and others) with the acting principal, parameters, and result. + +An example event for `ipa_api` looks as following: + +```json +{ + "process": { + "pid": 7521, + "thread": { + "id": 7677 + } + }, + "log": { + "file": { + "inode": "14070656", + "path": "/var/log/httpd/error_log", + "device_id": "66306", + "fingerprint": "e7aeb518b4583988e24ceddd7f703603d63a4363ba08274f76314b4180f74906" + }, + "offset": 1378531, + "level": "INFO" + }, + "source": { + "port": 60456, + "ip": "10.89.0.2" + }, + "freeipa": { + "api": { + "result": "SUCCESS", + "server_class": "jsonserver_kerb", + "version": "1", + "parameters": "None, sizelimit=1, version='2.254'", + "command": "user_find" + } + }, + "url": { + "path": "/ipa/json" + }, + "network": { + "protocol": "https", + "transport": "tcp" + }, + "observer": { + "product": "FreeIPA", + "hostname": "ipa.example.test", + "vendor": "Red Hat", + "type": "api-server" + }, + "@timestamp": "2026-04-01T18:48:58.409Z", + "ecs": { + "version": "8.0.0" + }, + "related": { + "hosts": [ + "ipa.example.test" + ], + "ip": [ + "10.89.0.2" + ], + "user": [ + "admin", + "admin@EXAMPLE.TEST" + ] + }, + "service": { + "type": "freeipa" + }, + "host": { + "hostname": "ipa.example.test", + "os": { + "kernel": "6.18.18-1-lts", + "codename": "Blue Onyx", + "name": "Rocky Linux", + "family": "redhat", + "type": "linux", + "version": "9.7 (Blue Onyx)", + "platform": "rocky" + }, + "containerized": false, + "ip": [ + "10.89.0.2", + "fe80::10d4:6fff:fe83:f407" + ], + "name": "ipa.example.test", + "id": "39a2c6cdbd52ac815c089dc52ec548ba", + "mac": [ + "12-D4-6F-83-F4-07" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "method": "POST" + } + }, + "client": { + "ip": "10.89.0.2" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2026-04-01T18:49:09Z", + "kind": "event", + "action": "user_find", + "category": [ + "iam" + ], + "type": [ + "info" + ], + "outcome": "success" + }, + "user": { + "domain": "EXAMPLE.TEST", + "name": "admin", + "id": "admin@EXAMPLE.TEST" + } +} +``` + +**ECS Field Reference** + +Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| client.ip | IP address of the API client. | ip | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. | keyword | +| event.category | Event category for ECS compatibility. | keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.duration | Duration of the API call in nanoseconds. | long | +| event.kind | The kind of event. | keyword | +| event.module | Event module. | constant_keyword | +| event.outcome | The outcome of the event (success or failure). | keyword | +| event.reason | Reason for the event outcome when not SUCCESS. | keyword | +| event.type | Event type for ECS compatibility. | keyword | +| freeipa.api.command | IPA API command name (user_add, group_add_member, and others). | keyword | +| freeipa.api.parameters | Command parameters from the API call (can contain long values like CSRs). | match_only_text | +| freeipa.api.result | Raw result string from the API call (SUCCESS or error text). | keyword | +| freeipa.api.server_class | IPA server handler class (jsonserver_session, jsonserver_kerb). | keyword | +| freeipa.api.version | IPA API version used for the call. | keyword | +| group.name | Target group name for group commands. | keyword | +| host.name | Target host for host commands. | keyword | +| http.request.method | HTTP request method (POST). | keyword | +| log.level | Log level of the IPA API message. | keyword | +| network.protocol | Application protocol (https). | keyword | +| network.transport | Transport protocol (tcp). | keyword | +| observer.hostname | Hostname of the observer. | keyword | +| observer.product | Product name of the observer. | keyword | +| observer.type | Type of the observer component. | keyword | +| observer.vendor | Vendor of the observer. | keyword | +| process.pid | Process ID of the httpd worker. | long | +| process.thread.id | Thread ID of the httpd worker. | long | +| related.hosts | All hostnames seen in this event. | keyword | +| related.ip | All IP addresses seen in this event. | ip | +| related.user | All user identifiers seen in this event. | keyword | +| rule.name | Target HBAC or sudo rule name. | keyword | +| service.type | Service type identifier. | keyword | +| source.as.number | Autonomous System Number from GeoIP ASN lookup. | long | +| source.as.organization.name | Organization name from GeoIP ASN lookup. | keyword | +| source.geo.city_name | City name from GeoIP lookup. | keyword | +| source.geo.continent_name | Continent name from GeoIP lookup. | keyword | +| source.geo.country_iso_code | Country ISO code from GeoIP lookup. | keyword | +| source.geo.country_name | Country name from GeoIP lookup. | keyword | +| source.geo.location | Longitude and latitude from GeoIP lookup. | geo_point | +| source.geo.region_iso_code | Region ISO code from GeoIP lookup. | keyword | +| source.geo.region_name | Region name from GeoIP lookup. | keyword | +| source.ip | IP address of the API client. | ip | +| source.port | Source port of the API client. | long | +| tags | List of keywords used to tag each event. | keyword | +| url.path | URL path of the IPA API endpoint. | keyword | +| user.domain | Kerberos realm of the principal. | keyword | +| user.id | Full Kerberos principal (user@REALM). | keyword | +| user.name | Short principal name (without realm). | keyword | +| user.target.name | Target user of the API command (the user being created, modified, or deleted). | keyword | + + +## Alert rule templates + +Alert rule templates provide pre-defined configurations for creating alert rules in Kibana. They are not enabled by default — navigate to **Stack Management > Rules** to review and activate them. Each template ships a sensible default threshold that you can adjust after activation. + +Alert rule templates require Elastic Stack version 9.2.0 or later. On earlier versions the ES|QL queries can be used manually in **Stack Management > Rules** with the "Elasticsearch query" rule type. + +For more information, refer to the [Elastic documentation](https://www.elastic.co/docs/reference/fleet/alerting-rule-templates). + +**[FreeIPA] Replication Errors** + +Fires when replication agreement errors appear in the directory server error log. Replication failures between FreeIPA servers can cause split-brain conditions and data inconsistency across replicas. Groups alerts by agreement name and remote host. + +**[FreeIPA] Unindexed LDAP Searches** + +Fires when 5 or more unindexed LDAP searches are detected in a 15-minute window. Unindexed searches cause full table scans in the directory database, degrading performance for all LDAP clients including SSH logins, sudo rule evaluation, and HBAC checks. + +**[FreeIPA] LDAP High Operation Latency** + +Fires when the p95 LDAP operation latency exceeds 5 seconds (adjustable) across at least 10 operations in a 5-minute window. High LDAP latency directly impacts Kerberos authentication, sudo resolution, and HBAC evaluation on all enrolled clients. + +**[FreeIPA] IPA API Error Spike** + +Fires when 10 or more API errors occur in a 5-minute window. A spike in IPA API errors can indicate backend issues such as an unreachable LDAP server, a plugin failure, or a schema conflict after an upgrade. + +**[FreeIPA] CA Subsystem Connection Failures** + +Fires when the Dogtag CA cannot connect to its LDAP backend (connection refused errors). CA connection failures cause silent certificate renewal failures which can lead to expired IPA server certificates weeks later. Only relevant on servers running the CA role. diff --git a/packages/freeipa/elasticsearch/transform/latest_auth/fields/ecs.yml b/packages/freeipa/elasticsearch/transform/latest_auth/fields/ecs.yml new file mode 100644 index 00000000000..45f80558f30 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_auth/fields/ecs.yml @@ -0,0 +1,15 @@ +- name: "@timestamp" + type: date + description: Event timestamp. +- name: user.name + type: keyword + description: Username extracted from the bind DN. +- name: user.id + type: keyword + description: Full bind DN. +- name: observer.hostname + type: keyword + description: FreeIPA server hostname. +- name: event.dataset + type: keyword + description: Event dataset. diff --git a/packages/freeipa/elasticsearch/transform/latest_auth/fields/fields.yml b/packages/freeipa/elasticsearch/transform/latest_auth/fields/fields.yml new file mode 100644 index 00000000000..ebb0b21e523 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_auth/fields/fields.yml @@ -0,0 +1,15 @@ +- name: freeipa.kdc.client_principal + type: keyword + description: Kerberos client principal (user@REALM). +- name: freeipa.kdc.service_principal + type: keyword + description: Service principal requested. +- name: freeipa.kdc.error_code + type: keyword + description: KDC error code for failed requests. +- name: freeipa.kdc.request_type + type: keyword + description: AS_REQ or TGS_REQ. +- name: freeipa.kdc.encryption_type + type: keyword + description: Encryption type used. diff --git a/packages/freeipa/elasticsearch/transform/latest_auth/manifest.yml b/packages/freeipa/elasticsearch/transform/latest_auth/manifest.yml new file mode 100644 index 00000000000..249e649db52 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_auth/manifest.yml @@ -0,0 +1,19 @@ +start: false +destination_index_template: + settings: + index: + mode: lookup + sort: + field: + - "@timestamp" + order: + - desc + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: false diff --git a/packages/freeipa/elasticsearch/transform/latest_auth/transform.yml b/packages/freeipa/elasticsearch/transform/latest_auth/transform.yml new file mode 100644 index 00000000000..773d15a6b13 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_auth/transform.yml @@ -0,0 +1,46 @@ +source: + index: + - "logs-freeipa.kdc-*" + query: + bool: + filter: + - terms: + event.action: + - kdc_tgt_grant + - kdc_tgt_failure + +dest: + index: "logs-freeipa_latest.dest_auth-1" + aliases: + - alias: "logs-freeipa_latest.auth" + move_on_creation: true + +latest: + unique_key: + - freeipa.kdc.client_principal + - source.ip + sort: "@timestamp" + +description: >- + Maintains a latest-state index of Kerberos authentication events per + (client_principal, source_ip) pair. Enables detection of authentication + from new or unusual source IPs for known principals. + +frequency: 30s + +sync: + time: + field: event.ingested + delay: 60s + +retention_policy: + time: + field: "@timestamp" + max_age: 30d + +_meta: + managed: true + fleet_transform_version: 0.1.0 + +settings: + unattended: true diff --git a/packages/freeipa/elasticsearch/transform/latest_bind/fields/ecs.yml b/packages/freeipa/elasticsearch/transform/latest_bind/fields/ecs.yml new file mode 100644 index 00000000000..45f80558f30 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_bind/fields/ecs.yml @@ -0,0 +1,15 @@ +- name: "@timestamp" + type: date + description: Event timestamp. +- name: user.name + type: keyword + description: Username extracted from the bind DN. +- name: user.id + type: keyword + description: Full bind DN. +- name: observer.hostname + type: keyword + description: FreeIPA server hostname. +- name: event.dataset + type: keyword + description: Event dataset. diff --git a/packages/freeipa/elasticsearch/transform/latest_bind/fields/fields.yml b/packages/freeipa/elasticsearch/transform/latest_bind/fields/fields.yml new file mode 100644 index 00000000000..8b9a168981a --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_bind/fields/fields.yml @@ -0,0 +1,15 @@ +- name: freeipa.directory.connection_id + type: long + description: 389DS connection identifier. +- name: freeipa.directory.operation_id + type: long + description: Operation identifier within the connection. +- name: freeipa.directory.bind_dn + type: keyword + description: Distinguished name used in the BIND request. +- name: freeipa.directory.bind_method + type: keyword + description: Authentication method (SIMPLE or SASL/mechanism). +- name: freeipa.directory.operation + type: keyword + description: LDAP operation type. diff --git a/packages/freeipa/elasticsearch/transform/latest_bind/manifest.yml b/packages/freeipa/elasticsearch/transform/latest_bind/manifest.yml new file mode 100644 index 00000000000..249e649db52 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_bind/manifest.yml @@ -0,0 +1,19 @@ +start: false +destination_index_template: + settings: + index: + mode: lookup + sort: + field: + - "@timestamp" + order: + - desc + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: false diff --git a/packages/freeipa/elasticsearch/transform/latest_bind/transform.yml b/packages/freeipa/elasticsearch/transform/latest_bind/transform.yml new file mode 100644 index 00000000000..eff36d4d284 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_bind/transform.yml @@ -0,0 +1,44 @@ +source: + index: + - "logs-freeipa.directory_access-*" + query: + bool: + filter: + - term: + freeipa.directory.operation: BIND + +dest: + index: "logs-freeipa_latest.dest_bind-1" + aliases: + - alias: "logs-freeipa_latest.bind" + move_on_creation: true + +latest: + unique_key: + - freeipa.directory.connection_id + - observer.hostname + sort: "@timestamp" + +description: >- + Maintains a latest-state index mapping connection_id to the BIND DN and + user identity. Enables LOOKUP JOIN from any operation on the same + connection to resolve who authenticated. + +frequency: 30s + +sync: + time: + field: event.ingested + delay: 60s + +retention_policy: + time: + field: "@timestamp" + max_age: 7d + +_meta: + managed: true + fleet_transform_version: 0.1.0 + +settings: + unattended: true diff --git a/packages/freeipa/elasticsearch/transform/latest_connection/fields/ecs.yml b/packages/freeipa/elasticsearch/transform/latest_connection/fields/ecs.yml new file mode 100644 index 00000000000..6cc9da4b2d7 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_connection/fields/ecs.yml @@ -0,0 +1,15 @@ +- name: "@timestamp" + type: date + description: Event timestamp. +- name: source.ip + type: ip + description: Client IP address. +- name: destination.ip + type: ip + description: Server IP address. +- name: observer.hostname + type: keyword + description: FreeIPA server hostname. +- name: event.dataset + type: keyword + description: Event dataset. diff --git a/packages/freeipa/elasticsearch/transform/latest_connection/fields/fields.yml b/packages/freeipa/elasticsearch/transform/latest_connection/fields/fields.yml new file mode 100644 index 00000000000..f28e6d4f860 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_connection/fields/fields.yml @@ -0,0 +1,9 @@ +- name: freeipa.directory.connection_id + type: long + description: 389DS connection identifier. +- name: freeipa.directory.ssl + type: boolean + description: Whether the connection uses SSL/TLS. +- name: freeipa.directory.operation + type: keyword + description: LDAP operation type. diff --git a/packages/freeipa/elasticsearch/transform/latest_connection/manifest.yml b/packages/freeipa/elasticsearch/transform/latest_connection/manifest.yml new file mode 100644 index 00000000000..249e649db52 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_connection/manifest.yml @@ -0,0 +1,19 @@ +start: false +destination_index_template: + settings: + index: + mode: lookup + sort: + field: + - "@timestamp" + order: + - desc + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: false diff --git a/packages/freeipa/elasticsearch/transform/latest_connection/transform.yml b/packages/freeipa/elasticsearch/transform/latest_connection/transform.yml new file mode 100644 index 00000000000..513ec601411 --- /dev/null +++ b/packages/freeipa/elasticsearch/transform/latest_connection/transform.yml @@ -0,0 +1,44 @@ +source: + index: + - "logs-freeipa.directory_access-*" + query: + bool: + filter: + - term: + freeipa.directory.operation: CONNECTION + +dest: + index: "logs-freeipa_latest.dest_connection-1" + aliases: + - alias: "logs-freeipa_latest.connection" + move_on_creation: true + +latest: + unique_key: + - freeipa.directory.connection_id + - observer.hostname + sort: "@timestamp" + +description: >- + Maintains a latest-state index mapping connection_id to source.ip, + destination.ip, and SSL status. Enables enrichment of BIND, SRCH, and + RESULT events with the originating client IP. + +frequency: 30s + +sync: + time: + field: event.ingested + delay: 60s + +retention_policy: + time: + field: "@timestamp" + max_age: 7d + +_meta: + managed: true + fleet_transform_version: 0.1.0 + +settings: + unattended: true diff --git a/packages/freeipa/img/logo.svg b/packages/freeipa/img/logo.svg new file mode 100644 index 00000000000..52cfb174bec --- /dev/null +++ b/packages/freeipa/img/logo.svg @@ -0,0 +1 @@ + diff --git a/packages/freeipa/kibana/alerting_rule_template/freeipa-api-error-spike.json b/packages/freeipa/kibana/alerting_rule_template/freeipa-api-error-spike.json new file mode 100644 index 00000000000..6fd0824eca1 --- /dev/null +++ b/packages/freeipa/kibana/alerting_rule_template/freeipa-api-error-spike.json @@ -0,0 +1,28 @@ +{ + "id": "freeipa-api-error-spike", + "type": "alerting_rule_template", + "attributes": { + "name": "[FreeIPA] IPA API Error Spike", + "tags": ["FreeIPA", "IPA API"], + "ruleTypeId": ".es-query", + "schedule": { + "interval": "1m" + }, + "params": { + "searchType": "esqlQuery", + "timeWindowSize": 5, + "timeWindowUnit": "m", + "esqlQuery": { + "esql": "// Alert when the IPA API error rate exceeds a threshold.\n// A spike in API errors may indicate backend issues (LDAP unreachable,\n// plugin failure, schema conflict after upgrade).\n// Adjust the error count threshold in the final WHERE clause as needed.\nFROM logs-freeipa.ipa_api-*\n| WHERE event.outcome == \"failure\"\n| STATS error_count = COUNT(*), errors = COUNT_DISTINCT(freeipa.api.result) BY freeipa.api.result\n| WHERE error_count >= 10" + }, + "groupBy": "row", + "timeField": "@timestamp" + }, + "alertDelay": { + "active": 2 + } + }, + "managed": true, + "coreMigrationVersion": "8.8.0", + "typeMigrationVersion": "10.1.0" +} diff --git a/packages/freeipa/kibana/alerting_rule_template/freeipa-ca-connection-failures.json b/packages/freeipa/kibana/alerting_rule_template/freeipa-ca-connection-failures.json new file mode 100644 index 00000000000..08a563216d3 --- /dev/null +++ b/packages/freeipa/kibana/alerting_rule_template/freeipa-ca-connection-failures.json @@ -0,0 +1,28 @@ +{ + "id": "freeipa-ca-connection-failures", + "type": "alerting_rule_template", + "attributes": { + "name": "[FreeIPA] CA Subsystem Connection Failures", + "tags": ["FreeIPA", "Certificate Authority"], + "ruleTypeId": ".es-query", + "schedule": { + "interval": "1m" + }, + "params": { + "searchType": "esqlQuery", + "timeWindowSize": 5, + "timeWindowUnit": "m", + "esqlQuery": { + "esql": "// Alert when the Dogtag CA cannot connect to its LDAP backend.\n// CA connection failures cause silent cert renewal failures which\n// can lead to expired IPA server certificates weeks later.\nFROM logs-freeipa.ca_audit-*\n| WHERE freeipa.ca.info IS NOT NULL AND freeipa.ca.info LIKE \"*Connection refused*\"\n| STATS failure_count = COUNT(*) BY freeipa.ca.server_host\n| WHERE failure_count >= 1" + }, + "groupBy": "row", + "timeField": "@timestamp" + }, + "alertDelay": { + "active": 1 + } + }, + "managed": true, + "coreMigrationVersion": "8.8.0", + "typeMigrationVersion": "10.1.0" +} diff --git a/packages/freeipa/kibana/alerting_rule_template/freeipa-ldap-high-latency.json b/packages/freeipa/kibana/alerting_rule_template/freeipa-ldap-high-latency.json new file mode 100644 index 00000000000..eb0ffd33bcb --- /dev/null +++ b/packages/freeipa/kibana/alerting_rule_template/freeipa-ldap-high-latency.json @@ -0,0 +1,28 @@ +{ + "id": "freeipa-ldap-high-latency", + "type": "alerting_rule_template", + "attributes": { + "name": "[FreeIPA] LDAP High Operation Latency", + "tags": ["FreeIPA", "Directory Server"], + "ruleTypeId": ".es-query", + "schedule": { + "interval": "1m" + }, + "params": { + "searchType": "esqlQuery", + "timeWindowSize": 5, + "timeWindowUnit": "m", + "esqlQuery": { + "esql": "// Alert when LDAP operations exceed a latency threshold.\n// High latency impacts authentication, sudo resolution, and HBAC evaluation.\n// Adjust the threshold (in seconds) in the final WHERE clause as needed.\nFROM logs-freeipa.directory_access-*\n| WHERE freeipa.directory.operation == \"RESULT\" AND freeipa.directory.elapsed_time IS NOT NULL\n| STATS p95_latency = PERCENTILE(freeipa.directory.elapsed_time, 95), op_count = COUNT(*)\n| WHERE op_count >= 10 AND p95_latency >= 5.0" + }, + "groupBy": "row", + "timeField": "@timestamp" + }, + "alertDelay": { + "active": 2 + } + }, + "managed": true, + "coreMigrationVersion": "8.8.0", + "typeMigrationVersion": "10.1.0" +} diff --git a/packages/freeipa/kibana/alerting_rule_template/freeipa-replication-errors.json b/packages/freeipa/kibana/alerting_rule_template/freeipa-replication-errors.json new file mode 100644 index 00000000000..4014cff9c45 --- /dev/null +++ b/packages/freeipa/kibana/alerting_rule_template/freeipa-replication-errors.json @@ -0,0 +1,28 @@ +{ + "id": "freeipa-replication-errors", + "type": "alerting_rule_template", + "attributes": { + "name": "[FreeIPA] Replication Errors", + "tags": ["FreeIPA", "Directory Server"], + "ruleTypeId": ".es-query", + "schedule": { + "interval": "1m" + }, + "params": { + "searchType": "esqlQuery", + "timeWindowSize": 5, + "timeWindowUnit": "m", + "esqlQuery": { + "esql": "// Alert when replication agreement errors are detected.\n// Replication failures can cause split-brain and data inconsistency.\n// Groups by agreement name and remote host.\nFROM logs-freeipa.directory_errors-*\n| WHERE freeipa.directory_error.agreement IS NOT NULL\n| STATS error_count = COUNT(*) BY freeipa.directory_error.agreement, freeipa.directory_error.remote_host\n| WHERE error_count >= 1" + }, + "groupBy": "row", + "timeField": "@timestamp" + }, + "alertDelay": { + "active": 1 + } + }, + "managed": true, + "coreMigrationVersion": "8.8.0", + "typeMigrationVersion": "10.1.0" +} diff --git a/packages/freeipa/kibana/alerting_rule_template/freeipa-unindexed-searches.json b/packages/freeipa/kibana/alerting_rule_template/freeipa-unindexed-searches.json new file mode 100644 index 00000000000..a131453ca5a --- /dev/null +++ b/packages/freeipa/kibana/alerting_rule_template/freeipa-unindexed-searches.json @@ -0,0 +1,28 @@ +{ + "id": "freeipa-unindexed-searches", + "type": "alerting_rule_template", + "attributes": { + "name": "[FreeIPA] Unindexed LDAP Searches", + "tags": ["FreeIPA", "Directory Server"], + "ruleTypeId": ".es-query", + "schedule": { + "interval": "1m" + }, + "params": { + "searchType": "esqlQuery", + "timeWindowSize": 15, + "timeWindowUnit": "m", + "esqlQuery": { + "esql": "// Alert when unindexed LDAP searches are detected.\n// Unindexed searches cause full table scans and degrade performance\n// for all LDAP clients (SSH logins, sudo, HBAC evaluation).\n// Adjust the threshold in the final WHERE clause as needed.\nFROM logs-freeipa.directory_access-*\n| WHERE freeipa.directory.unindexed == true\n| STATS unindexed_count = COUNT(*) BY freeipa.directory.notes\n| WHERE unindexed_count >= 5" + }, + "groupBy": "row", + "timeField": "@timestamp" + }, + "alertDelay": { + "active": 2 + } + }, + "managed": true, + "coreMigrationVersion": "8.8.0", + "typeMigrationVersion": "10.1.0" +} diff --git a/packages/freeipa/manifest.yml b/packages/freeipa/manifest.yml new file mode 100644 index 00000000000..add5710705e --- /dev/null +++ b/packages/freeipa/manifest.yml @@ -0,0 +1,38 @@ +format_version: "3.4.2" +name: freeipa +title: FreeIPA +version: "0.1.0" +description: Collect security logs from FreeIPA identity management servers. +type: integration +categories: + - security + - iam +conditions: + kibana: + version: "^8.19.0 || ^9.1.0" + elastic: + subscription: basic +icons: + - src: /img/logo.svg + title: FreeIPA + size: 32x32 + type: image/svg+xml +policy_templates: + - name: freeipa + title: FreeIPA + description: Collect security logs from FreeIPA servers + inputs: + - type: filestream + title: FreeIPA Logs + description: Collect logs from FreeIPA components (KDC, 389ds, Dogtag CA, IPA API) + vars: + - name: preserve_original_event + type: bool + title: Preserve Original Event + description: Preserve the raw log line in event.original. + required: false + show_user: true + default: false +owner: + github: elastic/obs-infraobs-integrations + type: community