Local Linux host auditing

[CyBurrr]

Hello,

I was wondering what is everyone using to monitor local Linux logging for hosts. I am looking for a solution like Winlogbeat to monitor certain changes on the host level of the machines monitored in the environment such as file changes or login by user(s). I was curious if Filebeats would be best since Wazuh is going away in 2.4.

[dougburks]

For Security Onion 2.3, you can use Filebeat to collect logs from Linux hosts:
https://docs.securityonion.net/en/2.3/beats.html

For Security Onion 2.4, you can use Elastic Agent:
https://docs.securityonion.net/en/2.4/elastic-agent.html

[InfosecGoon]

If you're looking to monitor specific log files, Filebeat (2.3) or Elastic Agent (2.4) would be the way to go. If you want to monitor more granular endpoint activity, you might want to look into generating logs with auditd or Sysmon4Linux and then forwarding those logs into SO.