fix(filters): Linux normalization and rule contracts

filters/audits/linux.md

@@ -0,0 +1,42 @@
+# Linux normalization and rule review
+
+Separate executable, working directory and signed exit status; correct outcomes and align path/grouping rule consumers.
+
+This draft targets UTMStack `v11`. It contains 1 filter changes
+and 23 rule changes for this technology only. Review covered
+1 filter configurations and 49 matching shipped rule files.
+Unchanged rules are listed in the regression manifest; they are not duplicated in the diff.
+
+## Contract and validation
+
+- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries.
+- Checked documented pipeline ordering, rename/move behavior, open vendor log fields,
+  event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping.
+- Strict SDK configuration decoding and actual CEL compilation pass for this scope.
+- 3 synthetic normalization cases pass, including SDK Event conversion and any
+  trigger predicate assertions recorded in the manifest.
+- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied.
+
+The shared alert-contract PR supplies the reusable Go runner for the manifest in
+`plugins/alerts/testdata/filter-contracts/linux.json`. Apply that support before running `go test ./...` in `plugins/alerts`.
+
+The changed rules also require the shared alert-grouping fix to resolve `lastEvent.*` values correctly at runtime.
+
+The model starts from synthetic extraction results. It does not run complex grok,
+JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch
+queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must
+still be checked in staging before rollout. No customer false-positive reduction
+has been measured and no production rollout is included.
+
+
+
+## References
+
+- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto)
+- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference)
+- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema)
+- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules)
+
+`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom
+`log.*` fields are accepted. Existing textual protocol casing and vendor action names
+are preserved unless a concrete consumer mismatch requires correction.

filters/linux/linux.yml

@@ -273,9 +273,27 @@ pipeline:
 
       - rename:
           from:
-            - log.JOBRESULT
-          to: actionResult
-          where: exists("log.JOBRESULT") && !regexMatch("log.JOBRESULT", "(?i)\b(?:denied|blocked|failed)\b")
+          - log.JOBRESULT
+          to: log.vendorActionResult
+          where: exists("log.JOBRESULT")
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: success
+          where: regexMatch("log.vendorActionResult", "(?i)^(success|succeeded|successful|ok|done|accepted|accept|allowed|allow|permitted|permit|passed|pass|true)$")
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: failure
+          where: regexMatch("log.vendorActionResult", "(?i)^(failure|failed|fail|error|invalid|timeout|false)$")
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: denied
+          where: regexMatch("log.vendorActionResult", "(?i)^(denied|deny|blocked|block|dropped|drop|rejected|reject|forbidden|unauthorized|quarantined)$")
 
       - rename:
           from:
@@ -341,15 +359,15 @@ pipeline:
           function: string
           params:
             key: severity
-            value: "emergency"
-          where: 'equals("log.priority", "0")'
+            value: critical
+          where: equals("log.priority", "0")
 
       - add:
           function: string
           params:
             key: severity
-            value: "alert"
-          where: 'equals("log.priority", "1")'
+            value: critical
+          where: equals("log.priority", "1")
 
       - add:
           function: string
@@ -376,8 +394,8 @@ pipeline:
           function: string
           params:
             key: severity
-            value: "notice"
-          where: 'equals("log.priority", "5")'
+            value: info
+          where: equals("log.priority", "5")
 
       - add:
           function: string
@@ -416,39 +434,57 @@ pipeline:
       # Map result to actionResult (success/failure)
       - rename:
           from:
-            - log.result
-          to: actionResult
-          where: 'equals("log.type", "auditd") && exists("log.result") && !regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")'
+          - log.result
+          to: log.vendorActionResult
+          where: exists("log.result")
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: success
+          where: regexMatch("log.vendorActionResult", "(?i)^(success|succeeded|successful|ok|done|accepted|accept|allowed|allow|permitted|permit|passed|pass|true)$")
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: failure
+          where: regexMatch("log.vendorActionResult", "(?i)^(failure|failed|fail|error|invalid|timeout|false)$")
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: denied
+          where: regexMatch("log.vendorActionResult", "(?i)^(denied|deny|blocked|block|dropped|drop|rejected|reject|forbidden|unauthorized|quarantined)$")
 
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'denied'
-          where: regexMatch("log.result", "(?i)\bdenied\b")
+            value: denied
+          where: regexMatch("log.result", "(?i)\\bdenied\\b")
 
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'blocked'
-          where: regexMatch("log.result", "(?i)\bblocked\b")
+            value: denied
+          where: regexMatch("log.result", "(?i)\\bblocked\\b")
 
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'failed'
-          where: regexMatch("log.result", "(?i)\bfailed\b")
+            value: failure
+          where: regexMatch("log.result", "(?i)\\bfailed\\b")
 
       # Map exe to origin.process (full path to executable)
       # Only if journald's COMM didn't already set origin.process
       - rename:
           from:
-            - log.exe
-          to: origin.process
-          where: 'equals("log.type", "auditd") && exists("log.exe") && !exists("origin.process")'
+          - log.exe
+          to: origin.path
+          where: equals("log.type", "auditd") && exists("log.exe")
 
       # Fallback: map auditd comm to origin.process if exe not mapped
       - rename:
@@ -474,19 +510,27 @@ pipeline:
       # Map cwd to origin.path (current working directory)
       - rename:
           from:
-            - log.cwd
-          to: origin.path
-          where: 'equals("log.type", "auditd") && exists("log.cwd")'
+          - log.cwd
+          to: log.workingDirectory
+          where: equals("log.type", "auditd") && exists("log.cwd")
 
       # Map exit code to statusCode (for correlation and alerting)
       - rename:
           from:
-            - log.exit
-          to: statusCode
-          where: 'equals("log.type", "auditd") && exists("log.exit")'
+          - log.exit
+          to: log.exitCode
+          where: equals("log.type", "auditd") && exists("log.exit")
 
       # Cast statusCode to integer (proto schema expects uint32)
       - cast:
           fields: [statusCode]
           to: int
-          where: 'equals("log.type", "auditd") && exists("statusCode")'
+          where: 'equals("log.type", "auditd") && exists("statusCode")'
+
+      # Normalize explicit outcomes; an unknown outcome remains unset.
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: failure
+          where: '!exists("actionResult") && lessThan("log.exitCode",0)'

plugins/alerts/testdata/filter-contracts/linux.json

@@ -0,0 +1,113 @@
+{
+  "technology": "Linux",
+  "filters": [
+    "filters/linux/linux.yml"
+  ],
+  "rules": [
+    "rules/linux/attempt_to_disable_syslog_service.yml",
+    "rules/linux/bruteforce_attack.yml",
+    "rules/linux/chattr_immutable_file.yml",
+    "rules/linux/debian_family/auditd_syslog_disabling.yml",
+    "rules/linux/debian_family/container_escape_techniques.yml",
+    "rules/linux/debian_family/crontab_persistence.yml",
+    "rules/linux/debian_family/debian_kernel_exploits.yml",
+    "rules/linux/debian_family/debian_specific_rootkits.yml",
+    "rules/linux/debian_family/ebpf_rootkit_detection.yml",
+    "rules/linux/debian_family/etc_shadow_access.yml",
+    "rules/linux/debian_family/kernel_exploit_indicators.yml",
+    "rules/linux/debian_family/ld_preload_hijacking.yml",
+    "rules/linux/debian_family/process_masquerading.yml",
+    "rules/linux/debian_family/reverse_shell_detection.yml",
+    "rules/linux/debian_family/shell_rc_file_modification.yml",
+    "rules/linux/debian_family/ssh_authorized_keys_modification.yml",
+    "rules/linux/debian_family/ssh_tunneling_port_forwarding.yml",
+    "rules/linux/debian_family/suid_sgid_binary_creation.yml",
+    "rules/linux/debian_family/suspicious_binary_in_tmp.yml",
+    "rules/linux/debian_family/systemd_timer_persistence.yml",
+    "rules/linux/disable_selinux_attempt.yml",
+    "rules/linux/file_deletion_via_shred.yml",
+    "rules/linux/file_transfer_or_listener_established_via_netcat.yml",
+    "rules/linux/insmod_kernel_module_load.yml",
+    "rules/linux/kde_autostart_modification.yml",
+    "rules/linux/kernel_module_removal.yml",
+    "rules/linux/linux_hping_activity.yml",
+    "rules/linux/linux_iodine_activity.yml",
+    "rules/linux/linux_nping_activity.yml",
+    "rules/linux/log_files_deleted.yml",
+    "rules/linux/modify_ssh_binaries.yml",
+    "rules/linux/perl_tty_shell.yml",
+    "rules/linux/pkexec_envar_hijack.yml",
+    "rules/linux/python_tty_shell.yml",
+    "rules/linux/reverse_shell_via_named_pipe.yml",
+    "rules/linux/rhel_family/boot_loader_attacks.yml",
+    "rules/linux/rhel_family/container_platform_attacks.yml",
+    "rules/linux/rhel_family/openshift_security_violations.yml",
+    "rules/linux/rhel_family/rhel_kernel_exploits.yml",
+    "rules/linux/rhel_family/rhel_specific_malware.yml",
+    "rules/linux/rhel_family/rpm_database_tampering.yml",
+    "rules/linux/rhel_family/secure_boot_violations.yml",
+    "rules/linux/rhel_family/selinux_policy_violations.yml",
+    "rules/linux/rhel_family/systemd_unit_file_attacks.yml",
+    "rules/linux/rhel_family/yum_dnf_repository_attacks.yml",
+    "rules/linux/tc_bpf_filter.yml",
+    "rules/linux/tunneling_via_earthworm.yml",
+    "rules/linux/unshare_namesapce_manipulation.yml",
+    "rules/linux/user_added_to_admin_group.yml"
+  ],
+  "fixtures": [
+    {
+      "name": "Linux negative syscall return preserved",
+      "filter": "linux/linux.yml",
+      "input": {
+        "log": {
+          "type": "auditd",
+          "exit": -13,
+          "exe": "/usr/bin/cat",
+          "comm": "cat",
+          "cwd": "/home/user"
+        }
+      },
+      "expected": {
+        "log.exitCode": -13,
+        "actionResult": "failure",
+        "origin.path": "/usr/bin/cat",
+        "origin.process": "cat",
+        "log.workingDirectory": "/home/user"
+      },
+      "absent": [
+        "statusCode"
+      ],
+      "rules": {}
+    },
+    {
+      "name": "Linux textual job failure",
+      "filter": "linux/linux.yml",
+      "input": {
+        "log": {
+          "JOBRESULT": "failed"
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "Linux unknown job result",
+      "filter": "linux/linux.yml",
+      "input": {
+        "log": {
+          "JOBRESULT": "dependency"
+        }
+      },
+      "expected": {
+        "log.vendorActionResult": "dependency"
+      },
+      "absent": [
+        "actionResult"
+      ],
+      "rules": {}
+    }
+  ]
+}

rules/linux/attempt_to_disable_syslog_service.yml

@@ -17,5 +17,5 @@ references:
   - "https://attack.mitre.org/techniques/T1562/001/"
 where: regexMatch("log.message", "((service|chkconfig) (syslog|rsyslog|syslog-ng) (stop|disable|off|kill))|((systemctl) (stop|disable|off|kill) (syslog|rsyslog|syslog-ng))")
 groupBy:
-  - origin.ip
-  - origin.user
+  - adversary.ip
+  - adversary.user

rules/linux/chattr_immutable_file.yml

@@ -20,5 +20,5 @@ references:
   - "https://attack.mitre.org/techniques/T1222/"
 where: regexMatch("log.message", "(chattr (\\+|-)i )")
 groupBy:
-  - origin.ip
-  - origin.user
+  - adversary.ip
+  - adversary.user

rules/linux/debian_family/auditd_syslog_disabling.yml

@@ -31,5 +31,5 @@ where: |
    contains("log.message", "syslog")) &&
   !(contains("log.message", "restart") || contains("log.message", "reload"))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user

rules/linux/debian_family/container_escape_techniques.yml

@@ -34,5 +34,5 @@ where: |
   (contains("log.message", "mount") && contains("log.message", "/dev/") &&
    (contains("log.message", "container") || contains("log.message", "docker")))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user

rules/linux/debian_family/debian_kernel_exploits.yml

@@ -45,5 +45,5 @@ where: |
    contains("log.message", "Return-oriented programming") ||
    contains("log.message", "ROP chain"))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user

rules/linux/debian_family/debian_specific_rootkits.yml

@@ -27,6 +27,6 @@ description: |
   7. Analyze network connections for command and control communications
   8. Update security tools and perform full system scan
 where: |
-  regexMatch("origin.process", "/(reptile|bdvl|azazel|jynx|xorddos)") || (contains("origin.command", "insmod") && regexMatch("origin.command", "(rootkit|hide|backdoor)")) || (contains("origin.command", "ld.so.preload") && regexMatch("origin.command", "(>>|tee|echo)"))
+  (regexMatch("origin.path", "/(reptile|bdvl|azazel|jynx|xorddos)") || regexMatch("origin.process", "/(reptile|bdvl|azazel|jynx|xorddos)")) || (contains("origin.command", "insmod") && regexMatch("origin.command", "(rootkit|hide|backdoor)")) || (contains("origin.command", "ld.so.preload") && regexMatch("origin.command", "(>>|tee|echo)"))
 deduplicateBy:
   - dataSource

rules/linux/debian_family/etc_shadow_access.yml

@@ -32,5 +32,5 @@ where: |
     contains("log.process", "usermod") || contains("log.process", "groupadd") ||
     contains("log.process", "chpasswd") || contains("log.process", "login"))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user

rules/linux/debian_family/kernel_exploit_indicators.yml

@@ -32,5 +32,5 @@ where: |
     contains("log.message", "copy_from_user"))) ||
   (contains("log.message", "SPLICE_F_MOVE") && contains("log.message", "pipe_buf_operations"))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user

rules/linux/debian_family/suid_sgid_binary_creation.yml

@@ -29,5 +29,5 @@ where: |
     contains("log.message", "2755") || contains("log.message", "6755") ||
     contains("log.message", "u+s") || contains("log.message", "g+s")))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user