Configure - FIM and Audit logs

This guide shows you how to integrate File Integrity Monitoring (FIM) and audit logs into the Secure60 platform.

Overview

This guide explains how to set up File Integrity Monitoring on either Linux or Windows operating systems — an essential component of complete visibility across your environment. File changes (and other permission changes) are a key event that may indicate malicious behaviour.

In this guide we use Auditbeat (a lightweight, open-source FIM and audit product) to send logs to a Secure60 Collector instance. As always, if you have any further questions, don’t hesitate to contact Secure60 Support.

Install Auditbeat

Installing and Configuring Auditbeat

This guide walks you through installing and configuring Auditbeat to monitor system and security events on your machine.

Prerequisites

• A system running a supported operating system (refer to the official Auditbeat documentation for compatibility details).
• Root or administrative privileges for installation.
• Install the Secure60 Collector. Minimum version: 1.06

1. Install Auditbeat

Download the latest Auditbeat version for your operating system from the official Elastic website: https://www.elastic.co/downloads/beats/auditbeat

Follow the installation instructions specific to your OS:

• Linux:
  1. curl -L -O https://artifacts.elastic.co/downloads/beats/auditbeat/auditbeat-8.13.2-amd64.deb
  2. sudo dpkg -i auditbeat-8.13.2-amd64.deb
• Windows:
  1. Run the downloaded .msi installer.

2. Configure Auditbeat

Open the Auditbeat configuration file for editing:

• Linux: /etc/auditbeat/auditbeat.yml
• Windows: C:\Program Files\auditbeat\auditbeat.yml

Note: You can specify which files and folders you want File Integrity Monitoring (FIM) to track, and which ones you prefer to exclude at file_integrity section.

Configure Logstash Output: We use the Logstash protocol to send data to the Secure60 Collector (The Secure60 Collector by default can listen as a Logstash processor). Add the following configuration under the output.logstash section:

output.logstash:
  hosts: ["<S60_COLLECTOR_IP_ADDRESS>:5044"]

Notes:

• Ensure you replace <S60_COLLECTOR_IP_ADDRESS> with the actual IP address of your Secure60 collector.
• Ensure you comment out (#) any other output areas that may be configured by default (Eg elastic search). Only one output at a time is supported.

Integrate with Secure60 Collector

To enable Syslog integration in the S60-collector, modify the .env file as follows:

ENABLE_AUDITBEAT=true

Logs can be viewed in the Secure60 portal.

Related

FIM and audit logs are core retention evidence — collect them centrally with Secure60 Log Management.

• ISO 27001 A.8.15 Logging — file-change and audit events are the evidence this control expects
• CERT-In 180-day log retention (India) — retain FIM and audit trails across the whole estate