search

threathunters-io / laurel

Transform Linux Audit logs for SIEM usage
GNU General Public License v3.0
707 stars 56 forks source link

Implement uid-groups enrichment #204

Closed hillu closed 8 months ago

hillu commented 8 months ago

This feature adds a UID_GROUPS entry containing a list of groups that uid is a member of.

This should be useful to infer special rights associated with groups, such as sudo, docker, etc.