auditbeat

Expression

product = "auditbeat"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	parent_process_id	Default			✓
	process_id	Default			✓
	syscall	Default			✓
	operation_type	Default			✓
	os	Default			✓
	domain_user_name
	process_command_line	Default			✓
	account_user_name
	group_id	Default			✓
	process_name	Default			✓
	domain	Default			✓
	process_path	Default			✓
	tag	Default			✓
	user	Default	✓	✓
	account	Default		✓
endpoint-authentication	src_ip	Default		✓
	additional_info	Default			✓
	event_name	Default			✓
network-session	process_id	Default			✓
	process_name	Default			✓
	domain	Default			✓
	process_dir	Default			✓
	domain_user_name
	process_path	Default			✓
	user	Default		✓
	direction	Default			✓
process-create	user_id	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	hash_md5	Default			✓
	domain_user_name
	user	Default		✓
process-modify	result	Default			✓
	app	Default			✓
	audit_id	Default			✓
	os	Default			✓
	operation_type	Default			✓
	group_id	Default			✓
	event_category	Default			✓
	user	Default		✓
	operation	Default			✓
	tags	Default			✓