elastic / elastic/beats

Add support for collecting user name on FIM (File Integrity Monitoring)

Open
#36,934 15 comments 1 reaction 1 assignee Claimed by @jasoncyp View on GitHub
Auditbeat Team:Elastic-Agent Team:Security-Windows Platform
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

**Describe the enhancement:**
FIM module collect the user name info and visualize in user.name field on both Linux and Windows

**Describe a specific use case for the enhancement or feature:**

User/customer has FIM requirements due to they are FSI industry. For the compliance requirements, customer needs to monitor the critical path to understand what has been changed, **who does the change**, who is the file owner and in which platform etc..

Most of features our FIM integration can support except the **user name**

This make the FIM module is not quite out-of-the-box to replace other existing solution. This will be our added value to talk about Elastic platform when comes to security compliance.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.