Keep track of file changes using Alerting OpenDistro for Elasticsearch

Today there was a need to monitor changes to certain files on the server, there are many different ways, for example, osquery from facebook , but since I recently started using Open Distro for Elasticsearch, I decided to monitor files with an elastic, one of its beat'ov .

I will not describe the installation of Elastics stack and Auditbeat, all according to the manuals, the only thing is, after installation, edit the auditbeat.yml file , add the path to the monitored file to the file_integrity module .

After setting up and starting, kibana will display the auditbeat- * index

Next, create a monitoring, specify the name of the monitoring, the scan interval, as well as the type of monitoring and index file:

in the Define extraction query write the following:

{
    "query": {
        "bool": {
            "must": [
                {
                    "match_phrase": {
                        "file.path": {
                            "query": "<путь/к отслеживаемому файлу>"
                        }
                    }
                }
            ],
            "filter": [
                {
                    "term": {
                        "event.action": {
                            "value": "attributes_modified"    #изменения атрибутов, возможно created  или deleted
                        }
                    }
                },
                {
                    "range": {
                        "@timestamp": {
                            "from": "now-1m" #период за который отслеживаем изменение 
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    }
}

After we press the Run button and check the request, this should appear:

We try to change the target file and run the request again:

as you can see hits has changed by 2, click update and create a trigger to change the value:

We leave everything as in the picture.

Next, you can configure notifications in slack or another messenger.