NOTE: You are looking at documentation for an older release. For the latest information, see the current release documentation.
Auditbeat overview
editAuditbeat overview
editAuditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
Auditbeat is an Elastic Beat. It’s
based on the libbeat
framework. For more information, see the
Beats Platform Reference.