From 0f060b931535cede1c7c09dcfd006079b38a6bde Mon Sep 17 00:00:00 2001
From: Mosiur Rahman <connect.mosiur@gmail.com>
Date: Wed, 19 Aug 2026 03:49:50 +0000
Subject: [PATCH] I have created a conditional grok filter for audit log and
 seperated the SYSCALL event from audit. Created a parser for SYSCALL.

---
 .../charts/data-prepper/upgrade-dataprep.sh   |  1 +
 .../charts/data-prepper/values.yaml           | 32 +++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 helm-charts-observability/charts/data-prepper/upgrade-dataprep.sh

diff --git a/helm-charts-observability/charts/data-prepper/upgrade-dataprep.sh b/helm-charts-observability/charts/data-prepper/upgrade-dataprep.sh
new file mode 100644
index 0000000..6915482
--- /dev/null
+++ b/helm-charts-observability/charts/data-prepper/upgrade-dataprep.sh
@@ -0,0 +1 @@
+helm upgrade --install -n observability data-prepper -f values.yaml .
diff --git a/helm-charts-observability/charts/data-prepper/values.yaml b/helm-charts-observability/charts/data-prepper/values.yaml
index 3348dd2..0ae09a2 100644
--- a/helm-charts-observability/charts/data-prepper/values.yaml
+++ b/helm-charts-observability/charts/data-prepper/values.yaml
@@ -224,6 +224,37 @@ pipelineConfig:
         - drop_events: 
             drop_when: '/log_source != "audit.audit.log"'
 
+        - grok:
+            break_on_match: true
+            match: 
+              log:
+              - '^type=%{WORD:log_type} msg=audit\(%{INT:timestamp_seconds}\.%{INT:timestamp_fraction}:%{INT:event_id}\): %{GREEDYDATA:msg}'
+            target_key: audit
+
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "SYSCALL"'
+            match:
+              /audit/msg: 
+              - ^arch=%{WORD:arch} syscall=%{INT:syscall_id} success=%{WORD:success} 
+                exit=%{INT:exit_code} a0=%{NOTSPACE:a0} a1=%{NOTSPACE:a1} a2=%{NOTSPACE:a2}
+                a3=%{NOTSPACE:a3} items=%{INT:items} ppid=%{INT:ppid} pid=%{INT:pid} auid=%{INT:auid} 
+                uid=%{INT:uid} gid=%{INT:gid} euid=%{INT:euid} suid=%{INT:suid} fsuid=%{INT:fsuid} 
+                egid=%{INT:egid} sgid=%{INT:sgid} fsgid=%{INT:fsgid} tty=%{GREEDYDATA:terminal} 
+                ses=%{INT:ses} comm=\"%{NOTSPACE:comm}\" exe=\"%{GREEDYDATA:exe}\" subj=%{GREEDYDATA:subject} 
+                key=\"%{WORD:key}\".*ARCH=%{GREEDYDATA:architecture} SYSCALL=%{WORD:syscall} AUID=\"%{GREEDYDATA:AUID}\" 
+                UID=\"%{GREEDYDATA:UID}\" GID=\"%{GREEDYDATA:GID}\" EUID=\"%{GREEDYDATA:EUID}\" SUID=\"%{GREEDYDATA:SUID}\" 
+                FSUID=\"%{GREEDYDATA:FSUID}\" 
+                EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
+            target_key: syscall
+        - date:
+            match:
+              - key: /audit/timestamp_seconds
+                patterns:
+                  - epoch_second
+            destination: "@timestamp"
+
+
       sink:
         - opensearch:
             hosts:
@@ -235,6 +266,7 @@ pipelineConfig:
             cert: /usr/share/dataprepper/cert/root-ca.pem
             index: cpanel-audit-log-%{yyyy.MM.dd}
 
+            
     cpanel-kernel-pipeline:
       source:
         pipeline: