{"action":"created","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/948","repository_url":"https://api.github.com/repos/ossec/ossec-hids","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/948/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/948/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/948/events","html_url":"https://github.com/ossec/ossec-hids/pull/948","id":174778701,"number":948,"title":"A more thorough sudo decoder","user":{"login":"ddpbsd","id":4983989,"avatar_url":"https://avatars.githubusercontent.com/u/4983989?v=3","gravatar_id":"","url":"https://api.github.com/users/ddpbsd","html_url":"https://github.com/ddpbsd","followers_url":"https://api.github.com/users/ddpbsd/followers","following_url":"https://api.github.com/users/ddpbsd/following{/other_user}","gists_url":"https://api.github.com/users/ddpbsd/gists{/gist_id}","starred_url":"https://api.github.com/users/ddpbsd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddpbsd/subscriptions","organizations_url":"https://api.github.com/users/ddpbsd/orgs","repos_url":"https://api.github.com/users/ddpbsd/repos","events_url":"https://api.github.com/users/ddpbsd/events{/privacy}","received_events_url":"https://api.github.com/users/ddpbsd/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-09-02T14:53:48Z","updated_at":"2016-09-14T10:58:43Z","closed_at":"2016-09-02T15:41:00Z","pull_request":{"url":"https://api.github.com/repos/ossec/ossec-hids/pulls/948","html_url":"https://github.com/ossec/ossec-hids/pull/948","diff_url":"https://github.com/ossec/ossec-hids/pull/948.diff","patch_url":"https://github.com/ossec/ossec-hids/pull/948.patch"},"body":" that pulls more information out of the log. Independently written by me and Jon Schipp who tossed his\r\ninto the ether at https://komunity.komand.com/learn/article/ossec-series-configuration-pitfalls/"},"comment":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/comments/246977684","html_url":"https://github.com/ossec/ossec-hids/pull/948#issuecomment-246977684","issue_url":"https://api.github.com/repos/ossec/ossec-hids/issues/948","id":246977684,"user":{"login":"ddpbsd","id":4983989,"avatar_url":"https://avatars.githubusercontent.com/u/4983989?v=3","gravatar_id":"","url":"https://api.github.com/users/ddpbsd","html_url":"https://github.com/ddpbsd","followers_url":"https://api.github.com/users/ddpbsd/followers","following_url":"https://api.github.com/users/ddpbsd/following{/other_user}","gists_url":"https://api.github.com/users/ddpbsd/gists{/gist_id}","starred_url":"https://api.github.com/users/ddpbsd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddpbsd/subscriptions","organizations_url":"https://api.github.com/users/ddpbsd/orgs","repos_url":"https://api.github.com/users/ddpbsd/repos","events_url":"https://api.github.com/users/ddpbsd/events{/privacy}","received_events_url":"https://api.github.com/users/ddpbsd/received_events","type":"User","site_admin":false},"created_at":"2016-09-14T10:58:43Z","updated_at":"2016-09-14T10:58:43Z","body":"@torataks Does this work any better?\r\n```\r\n<decoder name=\"sudo\">\r\n  <program_name>^sudo</program_name>\r\n  <regex>^\\s+(\\S+)\\s:\\sTTY=\\S+\\s;\\sPWD=(\\S+)\\s;\\sUSER=(\\S+)\\s;\\sCOMMAND=(\\.+)$</regex>\r\n  <order>srcuser,url,dstuser,status</order>\r\n  <fts>name,srcuser,location</fts>\r\n  <ftscomment>First time user executed the sudo command</ftscomment>\r\n</decoder>\r\n```"}}
{"actor":{"display_login":"ddpbsd"}}