Configure modules

Stack

To enable specific modules you add entries to the auditbeat.modules list in the auditbeat.yml config file. Each entry in the list begins with a dash (-) and is followed by settings for that module.

The following example shows a configuration that runs the auditd and file_integrity modules.

 auditbeat.modules: - module: auditd audit_rules: | -w /etc/passwd -p wa -k identity -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access - module: file_integrity paths: - /bin - /usr/bin - /sbin - /usr/sbin - /etc 

The configuration details vary by module. See the module documentation for more detail about configuring the available modules.