Scale Your Auditing Events
summary
Keeps auditd rules but emits structured JSON into Elasticsearch so you can search and visualize rather than regex-parse raw lines; Auditbeat correlates process/user/namespace metadata, ships 114000 events from one host over hours (20k in the last hour) during the demo, and detects file changes like a mutated index.html via file integrity hashing. Dashboards and Elastic SIEM rules surface SSH egress and suspicious socket activity, and index lifecycle policies handle hot/warm/cold scaling.
AI-written summary · about
chapters (8)
- 0:00Start
- 3:26MONITOR File and network access System calls Commands run by a user Security events
- 15:22elastic stack
- 27:44elastic cloud
- 29:02eBPF powers on older kernels Easier configuration Written in Golang
- 39:33SYSTEM MODULE Simpler syntax for host, process, socket, user Added in 6.6 - not based on Auditd
- 47:10ILM Index Lifecycle Management
- 47:54PS: MACHINE LEARNING aka Anomaly Detection
related talks
44mScale Your Auditing Events
49mScale Your Auditing Events
42mMake your logs work for you
35mUsing K8s Audit Logs to Secure Your Cluster
41mScaling Observability: From Chaos to Clarity with Open Source Tools
25mAuditing in Kubernetes 101
32mThreat Hunting at Scale: Auditing Thousands of Clusters With Falco + F...
40mA needle in a logstack