Configuring Auditbeat to only report modifications to files I want to monitor

[adrisr (Adrian Serrano)]

Okay, this are audit events generated by other processes (pam, sudo, etc.), and they show up even if Auditbeat itself install no rules for them.

To filter them out, the suggestion is to install a drop processor. Have a look at this answer:

Auditbeat event types

Auditbeat subscribes to all events from the kernel's audit framework. Even if you configure no audit rules there are still events that get generated by other processes that publish audit events (like PAM, su, sudo). You can add a processor to your configuration if you want to drop events. For example if you only wanted to receive events related to audit rules that you configured you could filter use auditbeat.modules: - module: auditd processors: - drop_event.when.not.equals.event.category…