Commits on Dec 6, 2023

1. x-pack/auditbeat/module/system/process Report Linux capabilities …

   Implements #36404
   ECS: https://www.elastic.co/guide/en/ecs/master/ecs-process.html#field-process-thread-capabilities-effective
   
   Example output:
   
   ```
   {
     "@timestamp": "2023-12-05T19:34:54.425Z",
     "@metadata": {
       "beat": "auditbeat",
       "type": "_doc",
       "version": "8.12.0"
     },
     "process": {
       "thread": {
         "capabilities": {
           "effective": [
             "CAP_DAC_READ_SEARCH",
             "CAP_SYS_RESOURCE"
           ],
           "permitted": [
             "CAP_DAC_READ_SEARCH",
             "CAP_SYS_RESOURCE"
           ]
         }
       },
       "entity_id": "DADEDQU03GoDNhc1",
       "pid": 2841325,
       "start": "2023-12-05T19:32:53.180Z",
       "args": [
         "systemd-userwork: waiting..."
       ],
   ...
   ...
   ```
   
   Implementation is pretty straightforward, go-sysinfo will parse
   /proc/$PID/status and fill in CapabilityInfo.
   
   Don't merge, this depends on two external PRs:
   
   elastic/go-sysinfo#196
   elastic/go-sysinfo#197
   
   Next step is adding the same to add_process_metadata

   

   haesbaert committed Dec 6, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 93b380e
   • Browse repository at this point

   Copy the full SHA

   93b380e View commit details

   Browse the repository at this point in the history