Monitoring operating system audit data using Auditbeat
While it is useful to monitor logs and metrics directly related to your workload, an important element of comprehensive visibility is monitoring configuration changes on the machine hosting your workload. Audit data derived from the operating system can indicate changes that may result in bugs or undesired behavior, non-compliance with security policies, or users making unauthorized changes.
Auditbeat leverages the Linux audit framework (auditd) to consistently and reliably collect audit/security-relevant data from hosts. The scope of data collection includes the following:
- Linux kernel events related to unauthorized file access and remote access
- Changes on critical files and file paths
- Packages, processes, sockets, and user activity on the system
Data collection on auditd can be controlled using rules; curated rules can be found on openly available security hardening and best practice guides online.
...
