Graylog2 / Graylog2/graylog2-server

Add auditbeat-windows sidecar collector and add auditbeat windows binary into Sidecar

Open
#17,524 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

Adding the auditbeat windows sidecar collector in the next release would help user getting auditbeat working for windows in a simple and easy way, rather than creating manually the sidecar collector.

If you could also add the auditbeat binary to the sidecar package, it will help further more the new users.

## Why?

I was setting up Windows Log monitoring and especially File Monitoring with Event ID 4656 and 4663, and I realized it is a pain in the ass to differentiate an real user action (file creation, read attribute, etc) and a computer action which use the same privilege than the user, and nothing in the logs can tell the difference between the same action made in two differente ways.

That is why auditbeat could help the user monitoring this part easily, but as it is an avanced request, maybe it is unecessary/not useful as it is in your point of view.

## Your Environment

* Graylog Version: 5.2.1
* OpenSearch Version: 2.11.0
* MongoDB Version: 6.0.11
* Operating System: Docker
* Browser version: Chrome 119.0.6045.160

Please find below a default configuration for windows-auditbeat:

[auditbeat-windows.json](https://github.com/Graylog2/graylog2-server/files/13510579/auditbeat-windows.json)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.