Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] Enable System module config on Windows #10237

Merged
merged 3 commits into from
Jan 28, 2019
Merged

[Auditbeat] Enable System module config on Windows #10237

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
75220b3
Enable System module config on Windows.
Jan 21, 2019
62be6fa
Changelog
Jan 22, 2019
f9f6a1a
Exclude socket|user.state.period from when not Linux.
Jan 24, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d

*Auditbeat*

- Enable System module config on Windows. {pull}10237[10237]

*Filebeat*

- Add `convert_timezone` option to Elasticsearch module to convert dates to UTC. {issue}9756[9756] {pull}9761[9761]
Expand Down
8 changes: 2 additions & 6 deletions x-pack/auditbeat/module/system/_meta/config.yml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
{{ if ne .GOOS "windows" -}}
{{ if .Reference -}}
# The system module collects security related information about a host.
# All datasets send both periodic state information (e.g. all currently
Expand All @@ -25,17 +24,14 @@
# The state.period can be overridden for any dataset.
# host.state.period: 12h
# process.state.period: 12h
{{ if eq .GOOS "linux" -}}
# socket.state.period: 12h
# user.state.period: 12h
{{- end }}
{{ end }}
{{ if eq .GOOS "linux" -}}
# Enabled by default. Auditbeat will read password fields in
# /etc/passwd and /etc/shadow and store a hash locally to
# detect any changes.
user.detect_password_changes: true
{{- end }}
{{- if false -}}
cwurm marked this conversation as resolved.
Show resolved Hide resolved
{{/* Only remaining use in packages, to be removed completely. */}}
report_changes: true
{{- end -}}
{{- end }}