Beats: Auditbeat

Open in ChatGPTOpen in Claude

Coralogix provides seamless integration with Auditbeat so you can send your audit data from anywhere into Coralogix.

Prerequisites

• Install Auditbeat.

• A Logstash instance that you run in your own infrastructure, configured to receive Beats input and forward it to Coralogix. Coralogix no longer hosts a Logstash server for Beats shippers. See Run your own Logstash instance for the Logstash input, filter, and output configuration.

General

Private Key – Your Send Your Data - API Key is a unique ID that represents your company.

Company Id – A unique number which represents your company. You can get your company id from the settings tab in the Coralogix dashboard.

Application Name – The name of your main application, for example, a company named "SuperData" would probably insert the "SuperData" string parameter or if they want to debug their test environment they might insert the "SuperData– Test".

SubSystem Name – Your application probably has multiple subsystems, for example: Backend servers, Middleware, Frontend servers etc. in order to help you examine the data you need, inserting the subsystem parameter is vital.

Configuration

At the Host machine

Open your Auditbeat configuration file and configure it to use Logstash. For more information about configuring Auditbeat to use Logstash please refer to: https://www.elastic.co/guide/en/beats/auditbeat/current/logstash-output.html

Point your Auditbeat to output to your own Logstash instance:

<logstash-ip-address>:5044

Note

The Coralogix-hosted Logstash endpoints (logstashserver.coralogix.com, logstash.coralogix.in, logstashserver.coralogix.us) are retired and no longer accept data. See Deprecation of Coralogix-hosted Logstash.

Set the General values (Send-Your-Data API key, application name, and subsystem name) in your Logstash configuration, not in auditbeat.yml.

Here is a basic example of an auditbeat.yml file for watching some folders on your server:

#============================= Auditbeat Modules ===============================

auditbeat.modules:
- module: file_integrity
  enabled: true
  paths:
  - /bin
  - /usr/bin
  - /sbin
  - /usr/sbin
  - /etc

#----------------------------- Logstash output --------------------------------

output.logstash:
  enabled: true
  hosts: ["<logstash-ip-address>:5044"]

Using Docker

Build a Docker image with your auditbeat.yml:

FROM docker.elastic.co/beats/auditbeat:6.6.2

LABEL description="Auditbeat filesystem audit data collector"

# Adding configuration file for Auditbeat
COPY auditbeat.yml /usr/share/auditbeat/auditbeat.yml

# Changing permission of configuration file
USER root
RUN chown root:auditbeat /usr/share/auditbeat/auditbeat.yml

# Return to deploy user
USER auditbeat

Usage

You can deploy with Docker-compose:

version: '3.6'
services:
  auditbeat:
    image: docker.elastic.co/beats/auditbeat:6.6.2
    container_name: auditbeat
    volumes:
      - ./auditbeat.yml:/usr/share/auditbeat/auditbeat.yml:ro

Important: Don't forget to change the owner of auditbeat.yml file to root (uid=1000).