System package dataset

This is the package dataset of the system module.

It is implemented for Linux distributions using dpkg or rpm as their package manager, and for Homebrew on macOS (Darwin).

Privilege requirements depend on the package manager in use.

dpkg (Debian/Ubuntu)

No elevated privileges are required. The dpkg database at /var/lib/dpkg is world-readable.

RPM (RHEL/CentOS/SUSE)

The RPM library might attempt to write lock files to the RPM database, which typically requires root. To avoid this, configure package.rpm_drop_to_uid with a non-root UID. Auditbeat uses setreuid to switch to that UID before it queries the RPM database, which prevents unintended writes.

- module: system
  datasets: [package]
  package.rpm_drop_to_uid: 1000
		

1. UID to drop to before RPM queries

Homebrew (macOS)

No elevated privileges are required. Homebrew metadata is readable by the current user.

Docker

To report packages installed on the host rather than inside the container, mount the relevant package database paths from the host:

# dpkg
docker run -v /var/lib/dpkg:/var/lib/dpkg:ro ...

# RPM
docker run -v /var/lib/rpm:/var/lib/rpm:ro ...
		

The dataset comes with a sample dashboard:

For a description of each field in the dataset, see the exported fields section.

Here is an example document generated by this dataset:

{
    "@timestamp": "2017-10-12T08:05:34.853Z",
    "event": {
        "action": "existing_package",
        "category": [
            "package"
        ],
        "dataset": "package",
        "id": "6bed65c5-9797-4fb7-9ec7-2d1873c54371",
        "kind": "state",
        "module": "system",
        "type": [
            "info"
        ]
    },
    "message": "Package zstd (1.5.4) is already installed",
    "package": {
        "description": "Zstandard is a real-time compression algorithm",
        "installed": "2023-02-15T20:40:24.390086982-05:00",
        "name": "zstd",
        "reference": "https://facebook.github.io/zstd/",
        "type": "brew",
        "version": "1.5.4"
    },
    "service": {
        "type": "system"
    },
    "system": {
        "audit": {
            "package": {
                "entity_id": "SxYD3ZMh/Ym0lBIk",
                "installtime": "2023-02-15T20:40:24.390086982-05:00",
                "name": "zstd",
                "summary": "Zstandard is a real-time compression algorithm",
                "url": "https://facebook.github.io/zstd/",
                "version": "1.5.4"
            }
        }
    }
}