get_configured_variables does not detect type=login (third line in audit.log)

[ernstleierzopf]

renaming to LOGIN1 for example makes it work.

[viktorbeck98]

Any idea what the issue is? I'll assign this to copilot. I would like to see if it is able to find the cause.

[ernstleierzopf]

I have to look into it when I find the time..

[ernstleierzopf]

The Copilot PR does not work I think.

[viktorbeck98]

Ok it was worth a try ...

[ernstleierzopf]

Somehow there is an issue when templates have a dash within the variable names, for example old-auid or old-ses. When removing these for testing, it works. I am currently debugging it.

[ernstleierzopf]

I could debug the issue now. Each time a template has only one static type, it is not correctly detected. This applies to audit templates with event_id = 2, 3, 4, 5 and the type=LOGIN, AVG, SYSCALL, PROCTITLE respectively.

These templates do not occur:

pid=<*> uid=<*> auid=<*> ses=<*> msg='cwd=<*> cmd=<*> terminal=<*> res=<*>'
table=<*> family=<*> entries=<*>

[ernstleierzopf]

The issue is that detectors only use STABLE classification variables. Adding STATIC variables fixes this issue, but I do not know other implications about this. @viktorbeck98 what do you think? Changes were added to #88.

[viktorbeck98]

@ernstleierzopf I get the issue now I think.

I checked and the NewValueDetector also only uses STABLE variables but should actually also allow STATIC ones, I will make a PR for that, probably with the option to turn it on/off.

We only use STABLE variables for the NewValueComboDetector because it would blow up the number of combinations that it is computing in the auto-config (ofc depending on the type of log). Also, this functionality is already covered by the NewValueDetector which tracks variables individually and not combos. If you think about it, a combination with a static variable does not hold more information (from an anomaly detection perspective) that tracking each one individually.

[viktorbeck98]

I made some changes in #92 so that both detectors allow STATIC variables. For NVD it defaults to true, while for NVCD it defaults to false.

One thing to add here: this just concerns the auto-configuration. When configuring manually this has no effect.