Auditd Manager Integration #12967
Unanswered
jdonovan1013
asked this question in
2.4
Replies: 1 comment
-
We look at adding additional integrations as time allows |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Version
2.4.60
Installation Method
Security Onion ISO image
Description
configuration
Installation Type
Distributed
Location
on-prem with Internet access
Hardware Specs
Meets minimum requirements
CPU
4
RAM
24
Storage for /
100
Storage for /nsm
60
Network Traffic Collection
span port
Network Traffic Speeds
Less than 1Gbps
Status
Yes, all services on all nodes are running OK
Salt Status
No, there are no failures
Logs
No, there are no additional clues
Detail
Migrating from 2.3 to 2.4, and at the point of configuring Elastic Agent policies in Fleet.
Up to now, we have used AuditBeat to gather Linux audit data. There are a number of advantages to readability and useability of the audit data using Auditbeat rather than simply reading logs directly from the log files with Filebeat. With Elastic Agent, there are two different integrations available for reading audit data:
https://www.elastic.co/guide/en/fleet/current/migrate-auditbeat-to-agent.html
Currently, SO 2.4 only supports "Auditd Logs", which reads logs from the files, similar to Filebeat. An AuditBeat replacement does exist, "Auditd Manager", however it is not currently supported in 2.4. Technically Auditd Logs meets the need, but there are some definite disadvantages.
So, two questions:
Guidelines
Beta Was this translation helpful? Give feedback.
All reactions