Visualize command history

Elastic Stack Kibana
1

I'm a complete noob at Elastic Stack. I need to display command history in kibana in an easy to read format, I'm looking for something like this. For that, I've set auditbeat with this rule to log every command someone runs:
-a always,exit -F arch=b64 -S execve,execveat -F key=actionmade
However the log that it generates is really complicated and hard to read.

I'm facing two things:

  1. Is it possible to create a table like in the first picture? If so, could I ask for some guidance?
  2. This is a more minor thing but auditbeat logs some commands that the system runs and not the user, is it possible to make it log only commands that a user enters with a shell?

Thanks ahead!

2

I'd start by going into Discover on the auditbeat log and expanding a few records to find one that is actually a command history record. You'll have to hit the '>' sign infront of it to expand it. Once you've worked out the fields you want (date, user and command), slipping them into a table is real easy - just ignore the rest of the fields.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.