WARNING: Version 6.2 of Auditbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Common fields
editCommon fields
editContains common fields available in all event types.
event.module
editThe name of the module that generated the event.
event.action
edittype: keyword
example: logged-in
Action describes the change that triggered the event. For the file integrity module the possible values are: attributes_modified, created, deleted, updated, moved, and config_change.
file fields
editFile attributes.
file.path
edittype: text
The path to the file.
file.path.raw
edittype: keyword
The path to the file. This is a non-analyzed field that is useful for aggregations.
file.target_path
edittype: keyword
The target path for symlinks.
file.type
edittype: keyword
The file type (file, dir, or symlink).
file.device
edittype: keyword
The device.
file.inode
edittype: keyword
The inode representing the file in the filesystem.
file.uid
edittype: keyword
The user ID (UID) or security identifier (SID) of the file owner.
file.owner
edittype: keyword
The file owner’s username.
file.gid
edittype: keyword
The primary group ID (GID) of the file.
file.group
edittype: keyword
The primary group name of the file.
file.mode
edittype: keyword
example: 416
The mode of the file in octal representation.
file.setuid
edittype: boolean
example: True
Set if the file has the setuid
bit set. Omitted otherwise.
file.setgid
edittype: boolean
example: True
Set if the file has the setgid
bit set. Omitted otherwise.
file.size
edittype: long
The file size in bytes (field is only added when type
is file
).
file.mtime
edittype: date
The last modified time of the file (time when content was modified).
file.ctime
edittype: date
The last change time of the file (time when metadata was changed).
file.origin
edittype: text
An array of strings describing a possible external origin for this file. For example, the URL it was downloaded from. Only supported in macOS, via the kMDItemWhereFroms attribute. Omitted if origin information is not available.
file.origin.raw
edittype: keyword
This is a non-analyzed field that is useful for aggregations on the origin data.
selinux fields
editThe SELinux identity of the file.
file.selinux.user
edittype: keyword
The owner of the object.
file.selinux.role
edittype: keyword
The object’s SELinux role.
file.selinux.domain
edittype: keyword
The object’s SELinux domain or type.
file.selinux.level
edittype: keyword
example: s0
The object’s SELinux level.