Refactoring Auditbeat Modules

[andrewkroh]

Update: See Breaking Changes in Auditbeat 6.2 for info about how to upgrade from an earlier version.

---

We want to do some refactoring to change the config and event schema before the Auditbeat GA release. Auditbeat reuses Metricbeat's framework, and the framework's orientation around metrics is visible to the Auditbeat user, but it shouldn't be.

Goals

• Simplify configuration for the end-user
  • Modules should map clearly to events the users want to monitor.
• Divorce from the Metricbeat event data model
  • The metricset namespace isn't necessary here.
• Abstract the data source from module
  • Users shouldn't need to know how the data is collected
  • If needed an advanced user should be able to control what data sources are used.
  • For example have a module for monitoring what processes are running or what sockets are active rather than a module oriented around a data source like the kernel's audit framework or eBPF.
• Provide specialized dashboards for each module.

Steps

1. Modify the Metricbeat framework to allow for customization of the event builder (the builder is responsible for adding the metricset field to all events).
2. Reorganize the config to allow for modules without "metricsets".
3. Rename the existing audit/kernel metricset to the auditd module. (As we add modules I expect this to be used less.)
4. Rename the existing audit/file metricset to file_integrity.

Sample Configs

Note the removal of metricsets: [] and the removal of the module name prefixes from the config options.

auditbeat.modules:
- module: file_integrity
  paths:
  - /bin
  - /usr/bin
  - /sbin
  - /usr/sbin
  - /etc
  scan_at_start: true
  scan_rate_per_sec: 50 MiB
  max_file_size: 100 MiB
  hash_types: [sha1]

auditbeat.modules:
- module: auditd
  resolve_ids: true
  failure_mode: silent
  backlog_limit: 8196
  rate_limit: 0
  include_raw_message: false
  include_warnings: false

[ruflin]

Separation of data source from modules reminds me a lot of prospectors types and modules in Filebeat. Would be great to sync up on this one for Filebeat to make sure the configuration options are similar.