The Illuminate Linux Auditbeat Spotlight for Graylog works with Graylog Illuminate Core and Elastic Auditbeat agent for Linux. The Auditbeat agent is a "lightweight shipper for audit data." The Auditbeat agent for Linux communicates with the Audit framework for LInux and adds processing, enrichment, and delivery of Linux audit messages.

The Linux Auditbeat Spotlight comes ready to use with pre-built dashboard views including:

• Linux Auditbeat Overview
• Network Activity
• Admin activity

These built-in views can serve as a starting point for creating custom dashboards.

Supported Version(s)

This Spotlight supports Auditbeat for Linux versions 7-8 and will function with both the Elastic-licensed and Apache-licensed versions of Auditbeat.

By default, Graylog Sidecar comes with the Apache-licensed version of Auditbeat. If you want to utilize the "system" module, you can install the Elastic-licensed version by adding the appropriate repo and installing Auditbeat alongside the bundled version.

Install Elastic Version of Auditbeat

For the APT package manager, run the following command:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list

For the YUM package manager, run the following command:

sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
cat << EOF | sudo tee -a /etc/yum.repos.d/elastic-8.x.repo
[elastic-8.x]
name=Elastic repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

Configure Auditbeat Log Collector in Graylog

Next, modify the Auditbeat log collector configuration. For more information on setting up Sidecar log collectors, see the Graylog documentation on default collector configurations.

1. Navigate to System > Sidecars and select the Configurations tab.

2. Then, under the Log Collectors menu, select Edit next to your Auditlog collector.

3. Modify the "Executable Path" field to point to the new Auditbeat agent's binary path, which is set to /usr/share/auditbeat/bin/auditbeat by default.

Optionally, you can also opt to create a new Auditbeat log collector with this path rather than modify the default so that you do not overwrite the default log collector. Remember to give it a unique name, like "Auditbeat (Elastic-licensed)."

Stream Configuration

This technology pack includes one stream:

• “Illuminate:Linux Auditbeat Messages”

Index Set Configuration

This technology pack includes one index set definition:

• "Illuminate: Linux Auditbeat Messages"

Log Format Example

["type=CRED_ACQ msg=audit(1633670701.685:6873): pid=5205 uid=0 auid=4294967095 ses=4294970295 subj=unconfined msg='op=PAM:setcred grantors=pam_permit,pam_cap acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"]

Requirements

• A configured Beats input on Graylog server (See “Create Beats Input” below)
• The "Beats type prefix" must be enabled
• One or more Linux hosts with Elastic Auditbeat installed
• Beats agents, including Auditbeat, can be managed using the Graylog Sidecar

fields event_source_product: linux_auditbeat

What is Provided

• Parsing rules to extract Linux Auditbeat logs into Graylog schema compatible fields
• Data lookup tables use in the normalization and enrichment of Linux Auditbeat log messages into the Graylog schema
• Dashboards

Auditbeat Log Message Processing

The Illuminate processing of Linux Auditbeat messages provides the following:

• Field extraction, normalization and message enrichment for Linux Auditbeat log messages
• GIM Categorization of the following messages:

Auditbeat Module: AuditD

| vendor_event_category |

Auditbeat Module: System

Auditbeat Module: File Integrity

Linux Auditbeat Spotlight Content Pack

Create a Beats Input

1. On the Select Input drop-down menu, select the System menu and then choose Inputs.
2. Select Beats from the Select Input drop-down menu.
3. Click Launch New Input.
4. Assign a node or select Global mode.
5. Set the Title, Bind Address, and listening Port. For example:
   1. Title: “Beats input 5044”
   2. Bind address: “0.0.0.0” to listen on all interfaces
   3. Port: “5044”
6. Make sure the option “Do not add Beats type as prefix” is not selected. Pipeline processing rules reference incoming data by field name and the pipeline will not function correctly if this prefix is omitted.
7. Save the input settings.
8. If the input does not start automatically, select Start Input to begin listening for and processing new Beats messages (including Linux Auditbeat messages).