Scale Your Auditing Events
summary
Elastic ships Auditbeat which reads the kernel audit subsystem and forwards structured events to Elasticsearch so logs don’t need brittle regex parsing. It reuses auditd rules verbatim, enriches events with host, AWS, Docker and Kubernetes metadata, and supports anomaly detection and file integrity monitoring with selectable hash algorithms and rate limits. Demos show detection of sudo “power abuse”, SSH brute force via GeoIP counts, file tampering, and a netcat port-open event, all searchable in prebuilt dashboards.
AI-written summary · about
chapters (10)
- 0:00Intro
- 3:16All Report
- 7:29The Elastic Stack
- 12:15Filebit
- 17:21Oddity
- 22:14Oddity Overview
- 27:00SSH Demo
- 35:01File Integrity Monitoring
- 39:28Learning Automatically
- 40:27Summary
related talks
44mScale Your Auditing Events
51mScale Your Auditing Events
35mUsing K8s Audit Logs to Secure Your Cluster
22mAudit in Kubernetes Now, and in the Future
57mPreventing Attacks at Scale
20mKubernetes audit log best practices
32mThreat Hunting at Scale: Auditing Thousands of Clusters With Falco + F...
37m"A Monitoring Platform for Kubernetes...