Use Auditbeat to collect system audit data and monitor file changes

Prerequisites

• An Alibaba Cloud Elasticsearch cluster is created.

  For more information, see Create an Elasticsearch cluster.

• The Auto Indexing feature is enabled for the Elasticsearch cluster.

  For security purposes, Alibaba Cloud Elasticsearch disables the Auto Indexing feature by default. However, Beats depends on this feature. If you select Elasticsearch for Output when you create a shipper, you must enable the Auto Indexing feature. For more information, see Enable auto indexing.

• An Alibaba Cloud Elastic Compute Service (ECS) instance is created in the same Virtual Private Cloud (VPC) as the Elasticsearch cluster.

  For more information about, see Create an instance by using the provided wizard.

  Notice Beats supports only Aliyun Linux, Red Hat Linux, and CentOS.
• Cloud Assistant is installed on the ECS instance.
• Docker is installed on the ECS instance.

Use Auditbeat to monitor system file changes

1. Log on to the Alibaba Cloud Beats console.
2. In the Create Shipper section of the page that appears, click Auditbeat.
3. Configure the shipper.
   For more information, see Install a shipper. The following figure shows the configurations that are used in this topic.

   Note

   • If you select Enable Kibana Monitoring, the system enables Auditbeat service monitoring in the Kibana console.
   • If you select Enable Kibana Dashboard, the system generates charts in the Kibana console. You do not need to configure the YML file. Alibaba Cloud Kibana is configured in a VPC. You must enable the Kibana private network access feature on the Kibana configuration page. For more information, see Configure a whitelist for access to the Kibana console over the Internet or an internal network.

   In this topic, default configurations are used in auditbeat.yml. No modifications are required for this file. The configurations of related modules are described as follows:

   • Auditd

     - module: auditd
       # Load audit rules from separate files. Same format as audit.rules(7).
       audit_rule_files: [ '${path.config}/audit.rules.d/*.conf' ]
       audit_rules: |

     • audit_rule_files: specifies the files from which audit rules are loaded. Wildcards are supported. By default, files for 32-bit and 64-bit systems are provided.
     • audit_rules: specifies audit rules. You can connect to your ECS instance and run the ./auditbeat show auditd-rules command to view default audit rules.

       -a never,exit -S all -F pid=26253
       -a always,exit -F arch=b32 -S all -F key=32bit-abi
       -a always,exit -F arch=b64 -S execve,execveat -F key=exec
       -a always,exit -F arch=b64 -S connect,accept,bind -F key=external-access
       -w /etc/group -p wa -k identity
       -w /etc/passwd -p wa -k identity
       -w /etc/gshadow -p wa -k identity
       -a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F key=access
       -a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EPERM -F key=access

       Note In most cases, the default audit rules can meet your needs. If you want to use custom audit rules, modify the audit rule files in the audit.rules.d directory.
   • File integrity

     - module: file_integrity
       paths:
       - /bin
       - /usr/bin
       - /sbin
       - /usr/sbin
       - /etc

     paths: specifies the directories that store the files you want to monitor. Default directories include /bin, /user/bin, /sbin, /usr/sbin, and /etc.

4. Select the target ECS instance.
   
5. Enable the shipper and check whether the shipper installation succeeds.
   1. Click Enable.
      Then, the Enable Shipper message appears.
   2. Click Back to Beats Shippers. In the Manage Shippers section of the Beats Data Shippers page, view the installed shipper.
   3. After the state of the shipper changes to Enabled 1/1, click View Instances in the Actions column.
   4. In the View Instances pane, check whether the shipper installation on the ECS instance succeeds. If the value of Installed Shippers is Heartbeat Normal, the shipper installation succeeds.
      
6. View the collected data.
   1. Log on to the Kibana console of your Elasticsearch cluster. For more information, see Log on to the Kibana console.
   2. In the left-side navigation pane, click Discover. On the page that appears, select auditbeat-* from the drop-down list in the upper-left corner and specify a period in the upper-right corner. Then, view the data collected by Auditbeat within the specified period.
      
   3. In the left-side navigation pane, click Dashboard.
   4. In the Dashboards section of the page that appears, click [Auditbeat File Integrity] Overview. On the page that appears, select a period. Then, view the changes to monitored files within the specified period.