Auditbeat Event for a Seccomp Violation

seccomp-violation.json

{
  "@timestamp": "2018-04-08T19:29:14.461Z",
  "@metadata": {
    "beat": "auditbeat",
    "type": "doc",
    "version": "6.2.2"
  },
  "event": {
    "action": "violated-seccomp-policy",
    "module": "auditd",
    "category": "dac-decision",
    "type": "seccomp"
  },
  "user": {
    "name_map": {
      "gid": "andrew_kroh",
      "uid": "andrew_kroh",
      "auid": "andrew_kroh"
    },
    "gid": "1002",
    "auid": "1001",
    "uid": "1001"
  },
  "process": {
    "exe": "/home/andrew_kroh/dropper",
    "pid": "11710",
    "name": "dropper"
  },
  "auditd": {
    "summary": {
      "actor": {
        "primary": "andrew_kroh",
        "secondary": "andrew_kroh"
      },
      "object": {
        "type": "process",
        "primary": "59"
      },
      "how": "/home/andrew_kroh/dropper"
    },
    "sequence": 4914,
    "result": "unknown",
    "session": "2082",
    "data": {
      "code": "0x0",
      "syscall": "59",
      "ip": "0x7fe0e11cc777",
      "sig": "31",
      "arch": "c000003e",
      "compat": "0"
    }
  },
  "beat": {
    "name": "gce-ubuntu1604",
    "hostname": "gce-ubuntu1604",
    "version": "6.2.2"
  }
}