auditbeat.modules:

- module: audit
  metricsets: ["kernel"]
  kernel.audit_rules: |
    ## Identity changes
    -w /etc/group -p wa -k identity
    -w /etc/passwd -p wa -k identity
    -w /etc/gshadow -p wa -k identity
    ## Unauthorized access attempts
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access

- module: audit
  metricsets: [file]
  file.paths:
  - /opt/
  file.max_file_size: 100 MiB
  file.hash_types: [sha1]


name: "{{ inventory_hostname }}"
tags: ["{{ env }}", "lightsail"]


processors:
- add_cloud_metadata: ~


xpack.monitoring.enabled: true


output.elasticsearch:
  hosts: ["{{ elasticsearch_host }}"]
  username: "{{ elasticsearch_user }}"
  password: "{{ elasticsearch_password }}"


setup:
  kibana:
    host: "{{ kibana_host }}"
    username: "{{ elasticsearch_user }}"
    password: "{{ elasticsearch_password }}"
  dashboards.enabled: true

auditbeat.modules:

- module: auditd
  resolve_ids: true
  failure_mode: silent
  backlog_limit: 8196
  rate_limit: 0
  include_raw_message: false
  include_warnings: false
  audit_rules: |
    ## Identity changes
    -w /etc/group -p wa -k identity
    -w /etc/passwd -p wa -k identity
    -w /etc/gshadow -p wa -k identity
    ## Unauthorized access attempts
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access

- module: file_integrity
  paths:
  - /opt/
  scan_at_start: true
  scan_rate_per_sec: 50 MiB
  file.max_file_size: 100 MiB
  file.hash_types: [sha1]


name: "{{ inventory_hostname }}"
tags: ["{{ env }}", "lightsail"]


processors:
- add_cloud_metadata: ~


xpack.monitoring.enabled: true


output.elasticsearch:
  hosts: ["{{ elasticsearch_host }}"]
  username: "{{ elasticsearch_user }}"
  password: "{{ elasticsearch_password }}"


setup:
  kibana:
    host: "{{ kibana_host }}"
    username: "{{ elasticsearch_user }}"
    password: "{{ elasticsearch_password }}"
  dashboards.enabled: true

CHANGE to the new Auditbeat config file format
CHANGE to the new Auditbeat config file format
