We’ve manually written groups onto user objects using the groups repeated field, but haven’t stumbled into this. I’d be interested in your use case.
Some good advice that helped pull me out of a “map everything” rabbit hole was “Consider how you want to search the data once its ingested”. My brain wants to project my understanding of technical concepts into UDM, but this doesn’t always facilitate the SIEM/searching use case well.
So, the short answer is there isn’t a current UDM field that maps nicely to linux groups. But having that field might not help your search use case. What question are you hoping to answer and how would you search for it? Is it just historical groups created on a machine?
I also believe that you can add groups outside of the
groupadd
command, so perhaps setting up auditing on
/etc/group
would give you better coverage.
LinkedIn
Twitter
