examples/05_sudo_to_root.json

{
  "timestamp": "2026-06-06T18:40:02.500+0000",
  "rule": {
    "level": 8,
    "description": "User successfully changed UID to root.",
    "id": "5402",
    "groups": ["syslog", "sudo", "privilege_escalation"],
    "mitre": {"id": ["T1548.003"], "tactic": ["Privilege Escalation"], "technique": ["Sudo and Sudo Caching"]}
  },
  "agent": {"id": "007", "name": "poste-deploy-01"},
  "data": {"srcuser": "deploy", "dstuser": "root"},
  "full_log": "Jun  6 18:40:02 poste-deploy-01 sudo:   deploy : TTY=pts/2 ; PWD=/home/deploy ; USER=root ; COMMAND=/bin/bash"
}