Which beat to use?

Elastic Stack Beats
1

Hello,

Does anyone know which beat to use for monitoring:

  1. File attributes on windows - I have already checked auditbeat but there is no such option for Windows
  2. File shifts between folders on windows - Here auditbeat only indicates the start path, there is no information where the file was moved.
  3. Is it possible to compare two files (in elastic or kibana) to find out that they are the same/find the differences? Such a diff on linux but on elastic.

Thank you in advance for your help!

3

Hi @Murango

Auditbeat includes the File Integrity Module which on Windows uses the ReadDirectoryChangesW function. This function reports 8 types of changes to files in a directory like rename, change of size etc.
If your use case requires more options then you may configure a Windows system monitoring tool to write the required changes to the eventlog and collect this log with Winlogbeat.
Auditbeat on Windows and Winlogbeat seem to have less functionalities that the *nix versions, but hopefully they catch up in the upcoming releases.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.