Type to search.

System package dataset

Serverless Beta

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Beta

    This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Beta

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Beta

    This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

This is the package dataset of the system module.

It is implemented for Linux distributions using dpkg or rpm as their package manager, and for Homebrew on macOS (Darwin).

Required privileges

Privilege requirements depend on the package manager in use.

dpkg (Debian/Ubuntu)
No elevated privileges are required. The dpkg database at /var/lib/dpkg is world-readable.
RPM (RHEL/CentOS/SUSE)

The RPM library might attempt to write lock files to the RPM database, which typically requires root. To avoid this, configure package.rpm_drop_to_uid with a non-root UID. Auditbeat uses setreuid to switch to that UID before it queries the RPM database, which prevents unintended writes.

YAML 
- module: system
  datasets: [package]
  package.rpm_drop_to_uid: 1000
  1. UID to drop to before RPM queries
Homebrew (macOS)
No elevated privileges are required. Homebrew metadata is readable by the current user.
Docker

To report packages installed on the host rather than inside the container, mount the relevant package database paths from the host:

Shell 
# dpkg
docker run -v /var/lib/dpkg:/var/lib/dpkg:ro ...

# RPM
docker run -v /var/lib/rpm:/var/lib/rpm:ro ...

Example dashboard

The dataset comes with a sample dashboard:

Auditbeat System Package Dashboard

Fields

For a description of each field in the dataset, see the exported fields section.

Here is an example document generated by this dataset:

JSON 
{
    "@timestamp": "2017-10-12T08:05:34.853Z",
    "event": {
        "action": "existing_package",
        "category": [
            "package"
        ],
        "dataset": "package",
        "id": "6bed65c5-9797-4fb7-9ec7-2d1873c54371",
        "kind": "state",
        "module": "system",
        "type": [
            "info"
        ]
    },
    "message": "Package zstd (1.5.4) is already installed",
    "package": {
        "description": "Zstandard is a real-time compression algorithm",
        "installed": "2023-02-15T20:40:24.390086982-05:00",
        "name": "zstd",
        "reference": "https://facebook.github.io/zstd/",
        "type": "brew",
        "version": "1.5.4"
    },
    "service": {
        "type": "system"
    },
    "system": {
        "audit": {
            "package": {
                "entity_id": "SxYD3ZMh/Ym0lBIk",
                "installtime": "2023-02-15T20:40:24.390086982-05:00",
                "name": "zstd",
                "summary": "Zstandard is a real-time compression algorithm",
                "url": "https://facebook.github.io/zstd/",
                "version": "1.5.4"
            }
        }
    }
}