KVM

Support Added: FortiSIEM 6.3.1

Last Modification: FortiSIEM 6.3.1

Vendor Version Tested: Not Provided

Vendor: Free Software released under the General Public License (GPL).

Product Information: https://www.linux-kvm.org/page/Main_Page

• What is Discovered and Monitored
• Event Types
• Rules
• Reports
• Configuration
• Sample Logs

What is Discovered and Monitored

Method	Information discovered	Metrics collected	Logs collected	Used for
syslog	Host name, Reporting IP	None	Virtual Machine monitoring and changes	Security Monitoring

Event Types

• LINUX_Auditd_VIRT_MACHINE_ID

• LINUX_Auditd_VIRT_CONTROL

• LINUX_Auditd_VIRT_RESOURCE

Rules

There are no specific rules.

Reports

There are no specific reports.

Configuration

To configure, take the following steps:

1. Install auditd daemon on linux host. (i.e apt-get install auditd)

2. Edit/etc/audit/auditd.conf and configure as follows (take note of log_format = ENRICHED as this provides the real users behind the UIDs and AUIDs):
   

   Note: This file controls the configuration of the audit daemon.
   

   local_events = yes
   write_logs = yes
   log_file = /var/log/audit/audit.log
   log_group = root
   log_format = ENRICHED
   flush = INCREMENTAL_ASYNC
   freq = 50
   max_log_file = 8
   num_logs = 5
   priority_boost = 4
   disp_qos = lossy
   dispatcher = /sbin/audispd
   name_format = NONE
   ##name = mydomain
   max_log_file_action = ROTATE
   space_left = 75
   space_left_action = SYSLOG
   action_mail_acct = root
   admin_space_left = 50
   admin_space_left_action = SUSPEND
   disk_full_action = SUSPEND
   disk_error_action = SUSPEND
   use_libwrap = yes
   ##tcp_listen_port =
   tcp_listen_queue = 5
   tcp_max_per_addr = 1
   ##tcp_client_ports = 1024-65535
   tcp_client_max_idle = 0
   enable_krb5 = no
   krb5_principal = auditd
   ##krb5_key_file = /etc/audit/audit.key
   distribute_network = no
   

3. Configure rsyslog to send this logfile via syslog by editing /etc/rsyslog.conf and adding these lines:
   Note: This does not need Linux agent.
   

   $ModLoad imfile
   $InputFileName /var/log/audit/audit.log
   $InputFileTag tag_audit_log:
   $InputFileStateFile audit_log
   $InputFileSeverity info
   $InputFileFacility local6
   $InputRunFileMonitor
   *.* @replace.with.fortisiem.collector.IP:514
   

Sample Logs

Sample logs are provided here. For more information on logs, see https://libvirt.org/auditlog.html.

<182>Jul 26 15:20:36 fsa3000e4 tag_audit_log: type=VIRT_CONTROL msg=audit(1627305635.364:82451): pid=25686 uid=0 auid=4294967295 ses=4294967295 msg='virt=kvm op=start reason=booted vm="DT_FSR_Agent" uuid=104735e9-c1ea-44bc-8d99-0fe6fde58b73 vm-pid=25722 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"

<182>Jul 26 15:20:36 fsa3000e4 tag_audit_log: type=VIRT_RESOURCE msg=audit(1627305634.788:82437): pid=25686 uid=0 auid=4294967295 ses=4294967295 msg='virt=kvm resrc=net reason=open vm="DT_FSR_Agent" uuid=104735e9-c1ea-44bc-8d99-0fe6fde58b73 net=52:54:00:e7:84:3c path="/dev/net/tun" rdev=0A:C8 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"

<182>Jul 26 15:20:36 fsa3000e4 tag_audit_log: type=VIRT_MACHINE_ID msg=audit(1627305634.632:82435): pid=25686 uid=0 auid=4294967295 ses=4294967295 msg='virt=kvm vm="DT_FSR_Agent" uuid=104735e9-c1ea-44bc-8d99-0fe6fde58b73 vm-ctx=+64055:+64055 img-ctx=+64055:+64055 model=dac exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"