WARNING: Version 6.2 of Auditbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Common fieldsedit
Contains common fields available in all event types.
event.moduleedit
The name of the module that generated the event.
event.actionedit
type: keyword
example: logged-in
Action describes the change that triggered the event. For the file integrity module the possible values are: attributes_modified, created, deleted, updated, moved, and config_change.
file fieldsedit
File attributes.
file.pathedit
type: text
The path to the file.
file.path.rawedit
type: keyword
The path to the file. This is a non-analyzed field that is useful for aggregations.
file.target_pathedit
type: keyword
The target path for symlinks.
file.typeedit
type: keyword
The file type (file, dir, or symlink).
file.deviceedit
type: keyword
The device.
file.inodeedit
type: keyword
The inode representing the file in the filesystem.
file.uidedit
type: keyword
The user ID (UID) or security identifier (SID) of the file owner.
file.owneredit
type: keyword
The file owner’s username.
file.gidedit
type: keyword
The primary group ID (GID) of the file.
file.groupedit
type: keyword
The primary group name of the file.
file.modeedit
type: keyword
example: 416
The mode of the file in octal representation.
file.setuidedit
type: boolean
example: True
Set if the file has the setuid bit set. Omitted otherwise.
file.setgidedit
type: boolean
example: True
Set if the file has the setgid bit set. Omitted otherwise.
file.sizeedit
type: long
The file size in bytes (field is only added when type is file).
file.mtimeedit
type: date
The last modified time of the file (time when content was modified).
file.ctimeedit
type: date
The last change time of the file (time when metadata was changed).
file.originedit
type: text
An array of strings describing a possible external origin for this file. For example, the URL it was downloaded from. Only supported in macOS, via the kMDItemWhereFroms attribute. Omitted if origin information is not available.
file.origin.rawedit
type: keyword
This is a non-analyzed field that is useful for aggregations on the origin data.
selinux fieldsedit
The SELinux identity of the file.
file.selinux.useredit
type: keyword
The owner of the object.
file.selinux.roleedit
type: keyword
The object’s SELinux role.
file.selinux.domainedit
type: keyword
The object’s SELinux domain or type.
file.selinux.leveledit
type: keyword
example: s0
The object’s SELinux level.