When I create, modify, or delete a file called
test.txt on my server auditbeat does not send a log for it. Not sure why because my other modules appear to be working as intended. Here's the relevant portion from my config:
- module: file_integrity paths: - /bin - /usr/bin - /sbin - /usr/sbin - /etc
It's just the default configuration. I don't think I modified it at all.