Graylog2 / Graylog2/graylog2-server
Add auditbeat-windows sidecar collector and add auditbeat windows binary into Sidecar
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
Adding the auditbeat windows sidecar collector in the next release would help user getting auditbeat working for windows in a simple and easy way, rather than creating manually the sidecar collector.
If you could also add the auditbeat binary to the sidecar package, it will help further more the new users.
## Why?
I was setting up Windows Log monitoring and especially File Monitoring with Event ID 4656 and 4663, and I realized it is a pain in the ass to differentiate an real user action (file creation, read attribute, etc) and a computer action which use the same privilege than the user, and nothing in the logs can tell the difference between the same action made in two differente ways.
That is why auditbeat could help the user monitoring this part easily, but as it is an avanced request, maybe it is unecessary/not useful as it is in your point of view.
## Your Environment
* Graylog Version: 5.2.1
* OpenSearch Version: 2.11.0
* MongoDB Version: 6.0.11
* Operating System: Docker
* Browser version: Chrome 119.0.6045.160
Please find below a default configuration for windows-auditbeat:
[auditbeat-windows.json](https://github.com/Graylog2/graylog2-server/files/13510579/auditbeat-windows.json)
Contributor guide
Assessment
This issue has not been assessed yet.