{"id":15049778,"url":"https://github.com/mozilla/audit-go","last_synced_at":"2025-12-17T19:18:34.052Z","repository":{"id":22939600,"uuid":"26288897","full_name":"mozilla/audit-go","owner":"mozilla","description":"INACTIVE - http://mzl.la/ghe-archive - Linux Audit Plugin for heka written using netlink Protocol in golang and Lua","archived":true,"fork":false,"pushed_at":"2019-03-29T07:06:20.000Z","size":180,"stargazers_count":73,"open_issues_count":0,"forks_count":16,"subscribers_count":24,"default_branch":"master","last_synced_at":"2024-09-19T03:21:23.779Z","etag":null,"topics":["inactive","unmaintained"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mozilla.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":"audit.rules","citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-11-06T20:37:37.000Z","updated_at":"2024-08-23T16:52:27.000Z","dependencies_parsed_at":"2022-08-21T17:10:52.618Z","dependency_job_id":null,"html_url":"https://github.com/mozilla/audit-go","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Faudit-go","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Faudit-go/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Faudit-go/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Faudit-go/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mozilla","download_url":"https://codeload.github.com/mozilla/audit-go/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219866556,"owners_count":16554245,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["inactive","unmaintained"],"created_at":"2024-09-24T21:22:23.663Z","updated_at":"2025-10-04T12:30:40.948Z","avatar_url":"https://github.com/mozilla.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"#Linux Audit Heka Plugin (GO)\n\n\n### Note:\n\nThe project has now been divided into two parts, the API to deal with linux kernel audit framework is now provided by [libaudit-go](https://github.com/mozilla/libaudit-go) (in current development) and the client (audit-go) which provides an example to leverage libaudit-go.\n\n-----------------------\n\nThis project aims to deliver the same functionality as Linux Audit (auditd, audispd) + audisp-cef/json but in native Go as a plugin to Heka.\n\nCurrently the project listen for events from the kernel via the Netlink protocol and parse the messages and save them in `/tmp/log`.\n\nCurrently the Heka plugin is provided externally. Heka reads input using [Logstreamer](http://hekad.readthedocs.org/en/v0.10.0/config/inputs/logstreamer.html) from the file saved by `audit-go` and uses a custom lua decoder ([SandBoxed](http://hekad.readthedocs.org/en/v0.10.0/config/decoders/sandbox.html) decoder in Heka) defined in `audit_decoder.lua` which parses the audit messages and convert them to Heka Messages.\n\nThe messages are then converted to JSON format using [ESJsonEncoder](http://hekad.readthedocs.org/en/v0.10.0/config/encoders/esjson.html) of Heka.\n\nTo run with heka:\n\n*   Move the decoder to decoders directory of Heka.\n\n    `cp audit_decoder.lua /usr/share/heka/lua_decoders/`\n\n*   Run heka with the config file `heka.toml`.\n\n   `hekad -config=heka.toml`\n\n*   You can change the config settings as per your convenience and enable additional outputs in Heka. For example, to feed the JSON messages to an Elasticsearch server, uncomment lines 68-73 in `heka.toml` (assuming the ES server is running on `localhost:9200`).\n\nGoals:\n\n*   To reduce complexity while integrating with log aggregation, visualization tools (eg. Kibana) and security tools (eg. MozDef).\n*   Easier configuration and rule management.\n\n###[Project Wiki](https://wiki.mozilla.org/Security/Mentorships/MWoS/2014/Linux_Audit_heka_plugin_%28Go%29)\n\nFeedback\n-----------------\nOpen an issue [https://github.com/mozilla/audit-go/issues](https://github.com/mozilla/audit-go/issues) to report a bug or request a new feature. Other comments and suggestions can be directly emailed to the authors.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozilla%2Faudit-go","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmozilla%2Faudit-go","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozilla%2Faudit-go/lists"}