[Auditbeat] Process dataset: Only report processes with executable

[cwurm]

The process dataset currently reports a lot of kernel processes on Linux, e.g. kworker/2:0, kworker/2:1, kworker/3:1, cpuhp/1.

I think we should exclude those. They don't provide a lot of value, the names are not unique, and they will not be able to use potential future features like process executable hashes.

[elasticmachine]

Pinging @elastic/secops

[andrewkroh]

Are that any cases Windows or Darwin where the exe can be empty?

I understand the Linux path very well, but not much the implications of this filter on other operating systems. I want to make sure that there isn't something that a user can do to cause the APIs that return the executable to fail which then cause us to not report their process.

Another option here would be to filter processes on Linux that are owned by root, start with [, end with], and have no executable. That would match [kworker/u3:0] for sure. Or are those [ ] brackets added by ps?

[adriansr]

Under Windows, I can't see a case where exe can be empty.

Another option here would be to filter processes on Linux that are owned by root, start with [, end with], and have no executable. That would match [kworker/u3:0] for sure. Or are those [ ] brackets added by ps?

Is this the process title as returned by ps? This can be changed by a running process by rewritting argv[0], so it will allow an attacker to hide a process from us.

[cwurm]

Are that any cases Windows or Darwin where the exe can be empty?

Good question. I've tested it by inverting the condition (only report processes that have no exe) and on both platforms it didn't output anything, at least on my machines.

Another option here would be to filter processes on Linux that are owned by root, start with [, end with], and have no executable. That would match [kworker/u3:0] for sure. Or are those [ ] brackets added by ps?

The brackets are by ps.

To be extra conservative, we could only exclude processes (1) on Linux, that are (2) owned by root (3), and (3) have no exe. That way, macOS and Windows are not impacted, and if a user has root on Linux, they can do almost anything anyway, including messing with the Auditbeat process. I'll push a change to that effect.

[andrewkroh]

LGTM