Compatibility

The forensics signals are reported by the deep visibility agents on all platforms, except Solaris. Currently, only a few forensic signals are supported for AIX. For more information, see the Forensics signals section.

Forensics information is provided through Linux kernel APIs, Audit and syslog, Windows kernel APIs, Windows events, AIX audit system, and others. In general, OS vendors guarantee compatibility within a major release. However, it is possible that APIs could differ slightly across platforms and minor releases, as OS vendors may backport features and fixes. As a result, some forensic event types might not be available on some platforms. Also, the agent does not attempt to recover or enable any OS services that are disabled when the agent starts.

For example, there are number of forensic signals that use the Linux Audit Framework. If forensics are enabled, a deep visibility agent will insert Secure Workload audit rules into the system after the agent starts. The rule insertion requires the system to have the augenrules utility that is installed and /etc/audit/rules.d directory. If any of these prerequisites are not satisfied, Secure Workload audit rules will not be inserted. As a result, Forensics signals including File Access and Raw Socket Creation will not be reported.

If a user has enabled forensics previously and disables it, the agent removes the audit rules that are inserted by Secure Workload. On Red Hat 7.3 and CentOS 7.3, we observed an operating system bug that may impact the rule removal process. The agent removes the audit rules by: 1. Removing the taau.rules in /etc/audit/rules.d/ 2. Running $service auditd restart. The OS regenerates the ruleset based on the audit.rules and *.rules files in /etc/audit/rules.d/. Then auditd will load the rules into the system.

The operating system adds -D at the beginning of /etc/audit/rules.d/audit.rules file to clear all the rules before inserting the new ruleset. However, on Red Hat 7.3 and CentOS 7.3 machines the /etc/audit/rules.d/audit.rules may not have -D. This is because the OS creates an empty /etc/audit/rules.d/audit.rules file if this file does not exist and a default rule file in the subdirectory of /usr/share/doc/audit-<version>/ does not exist either, for example, /usr/share/doc/audit- 2.8.4/rules/10-base-config.rules is one possible default rule location. The exact OS behavior can be observed from the RPM update script by running $rpm -qf -scripts /etc/audit/rules.d

In Linux, some forensics signals rely on the observation of 64-bit system calls. 32-bit Linux system calls are not supported in the current release.

Based on the Compatibility Matrix, here's a list of operating systems (OS) supported on agents:

• Linux: supported on all versions

• Windows: all supported versions

• AIX: supported on AIX 7.2 and Power8 or greater

• Solaris: supported on x86_64 and SPARC