I want to know the usernames of all the users who have access to particular server, I also want to know what activities they did on the server. How do I configure auditbeat to show all this on elastic.
I am using Elastic Version 7.17.5. Currently I can see the users who have logged in under observability/dashboard/logins. And under observability/dashboard/users I can see users who have access to the servers. But I want to see their names, currently they are displayed in a way I cant tell who exactly are the users
"root
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
ftp
nobody
systemd-network
dbus
polkitd
sshd
postfix
rpc
ntp
rpcuser
nfsnobody
sssd
tss
apache
nginx"
I want elastic to give me actual names/usernames, how do I do it?