Skip to content

Perform the Auditbeat scan_at_start execution without restarting the beat #34417

Open

Description

Provide real-time logging of individual file deletions within a folder using Auditbeat for Windows file integrity, even when the folder is deleted

I am using Auditbeat for Windows file integrity and have noticed that when I delete a folder, the event is captured and shows that the folder was deleted, but there are no logs of the individual files within the deleted folder until I restart the Auditbeat service, even though the 'recursive' parameter is set to true.
I've also observed that when I create a new folder, the event is captured correctly and shows the creation logs for both the folder and all its files.
It would be useful to have a feature to schedule the same scan the beats performs setting the parameter scan_at_start to true but without restarting the beat

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions