[Rule Tuning] Changes to rules due to lack of file changes events in Linux Endpoint Security

[w0rk3r]

Issues

Resolves #1608

Summary

The current endpoint security for Linux does not log file changes, which cause our rules to not fire when they should.

Here are some points that this PR aims to discuss and solve:

1. The main issue is that we have cross-platform rules using the file change events, so we cannot simply remove the endpoint security index from them, as this would remove the support for macOS endpoint security, which have the data source used by the rule.

• We can solve this by converting these (cross-platform) rules to specific OS rules, but which implications this brings? @brokensound77, we would need to deprecate the cross-platform one (and create two new rules), or can I move it to the MacOS folder, modify it and create a new one for Linux?

2. Auditbeat will not generate file change events in most cases. By default only files located in "/bin", "/usr/bin", "/sbin", "/usr/sbin", "/etc" (base folders) will trigger file change events, subfolders need to be specified, or the recursive option needs to be set to True, which may cause performance issues.

• Test and provide guidance on Auditbeat configuration

[w0rk3r]

Leaving this one in draft until we discuss the implications

[w0rk3r]

We can suggest changes to auditbeat configurations in file_integrity or audit_rules section. I'll be using file_integrity to paths and audit_rules for specific files

[w0rk3r]

Closing this one as I'm trying to figure out alternative ways of dealing with the issue, some rules aim to monitor files that are located in multiple directories. The file integrity module can solve this with the recursive option. Still, it doesn't contain any information related to the process responsible for the modification, making it impossible to make exclusions.