System Audit Integration \

The System Audit integration collects various security-related information about a system. All data streams send both periodic state information (e.g. all currently installed packages) and real-time changes (e.g. when a new package is installed/uninstalled or an existing package is updated). Currently, the only implemented data stream is the package data stream, which collects various information about system packages. In the future, more data streams like (process, socket, hosts .. etc) will be added.

Each data stream sends two kinds of information: state and events.

State information is sent periodically. A state update will consist of events for each package that is installed or has had its state change in the polling period. All events belonging to the same state update will share the same UUID in event.id.

The frequency of state updates can be controlled for all data streams using the state.period configuration option. The default is 12h.

Event information is sent as the events occur (e.g. a package is installed, uninstalled or updated). All data streams are currently using a poll model to retrieve their data. The frequency of these polls is controlled by the period configuration parameter.

This module populates entity_id fields to uniquely identify entities (packages) within a host. This requires the module to obtain a unique identifier for the host:

• macOS: Uses the value returned by gethostuuid(2) system call.
• Linux: Uses the content of one of the following files, created by either systemd or dbus:

• /etc/machine-id
• /var/lib/dbus/machine-id
• /var/db/dbus/machine-id

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

For step-by-step instructions on how to set up an integration, see the Getting Started guide.

The data streams which are currently supported are:-

• package

Package helps you keep a record of events and changes happening to different packages on your system. The fields & events associated with the data stream are as follows:-

{
    "@timestamp": "2025-03-13T12:31:03.105Z",
    "agent": {
        "ephemeral_id": "7fcac89f-c92b-4d86-8853-ec20dec921b6",
        "id": "5c29f084-41d5-4418-bcdf-c8e009cb955b",
        "name": "elastic-agent-43116",
        "type": "auditbeat",
        "version": "8.17.3"
    },
    "data_stream": {
        "dataset": "system_audit.package",
        "namespace": "32543",
        "type": "logs"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "5c29f084-41d5-4418-bcdf-c8e009cb955b",
        "snapshot": false,
        "version": "8.17.3"
    },
    "event": {
        "action": "existing_package",
        "agent_id_status": "verified",
        "category": [
            "package"
        ],
        "dataset": "system_audit.package",
        "id": "7fbdd8bc-ac6c-4830-9541-e870532e7cef",
        "ingested": "2025-03-13T12:31:05Z",
        "kind": "state",
        "module": "system",
        "timezone": "+00:00",
        "type": [
            "info"
        ]
    },
    "host": {
        "architecture": "x86_64",
        "containerized": true,
        "hostname": "elastic-agent-43116",
        "ip": [
            "172.20.0.2",
            "172.18.0.7"
        ],
        "mac": [
            "02-42-AC-12-00-07",
            "02-42-AC-14-00-02"
        ],
        "name": "elastic-agent-43116",
        "os": {
            "codename": "focal",
            "family": "debian",
            "kernel": "5.15.153.1-microsoft-standard-WSL2",
            "name": "Ubuntu",
            "platform": "ubuntu",
            "type": "linux",
            "version": "20.04.6 LTS (Focal Fossa)"
        }
    },
    "input": {
        "type": "audit/system"
    },
    "message": "Package adduser (3.118ubuntu2) is already installed",
    "package": {
        "architecture": "all",
        "description": "add and remove users and groups",
        "name": "adduser",
        "size": 624,
        "type": "dpkg",
        "version": "3.118ubuntu2"
    },
    "system_audit": {
        "package": {
            "arch": "all",
            "name": "adduser",
            "size": 624,
            "summary": "add and remove users and groups",
            "version": "3.118ubuntu2"
        }
    },
    "tags": [
        "audit-system-package"
    ]
}

The integration comes with a package & audit system dashboard for easy identification of events and data overview :

Package Dashboard:

System Audit Dashboard:

For further information, please look at the Auditbeat System Module documentation.

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.