Auditbeat GA

[andrewkroh]

This issue tracks the tasks required to move Auditbeat from a beta release to a GA release.

Changes

• Refactoring Auditbeat Modules Auditbeat enhancement Refactoring Auditbeat Modules #5422 Allow specifying default metricsets #5675
• Unify the Auditbeat Event Schema Auditbeat enhancement Unify the Auditbeat Event Schema #5423
• Add recursive watches to file integrity module Auditbeat enhancement Add recursive watches to file integrity module #5421
  • Use fsevents for macOS Recursive file paths in Auditbeat #5266
  • fsnotify-backed recursive watcher for Linux / Windows fsnotify-backed recursive watcher for Linux #5833
• Add a way to exclude files in the integrity module Add exclude_files option to file integrity module #5342 Auditbeat: Add exclude_files option to file integrity module #5888
• Spooling to disk #TBD (Will not be include in the Auditbeat 6.2 release.) Introduce spooling to disk #6581 Added in 6.3.

Docs

• Document running Auditbeat under Docker Auditbeat docs Document running Auditbeat under Docker #5132

Testing

• Add Auditbeat to beats-tester Add Auditbeat testing beats-tester#69

[andrewkroh]

Testing Issues for 6.2

• World Writable File Count [Auditbeat File Integrity] visualization should filter out symlinks. Auditbeat GA cleanup #6138
• Add a breaking changes section the Auditbeat docs that explains the changes in 6.2 GA vs prior beta versions Auditbeat GA cleanup #6138
• Remove cfgwarn.Beta logging from the two modules. Auditbeat GA cleanup #6138
• Fix logging issue causing dpanic. https://gist.github.com/andrewkroh/37e11f7298f6dc5ff4fdccdc0264c367 Auditbeat GA cleanup #6138