[id="{beatname_lc}-overview"]
== {beatname_uc} overview

{beatname_uc} is a lightweight shipper that you can install on your servers to
audit the activities of users and processes on your systems. For example, you
can use {beatname_uc} to collect and centralize audit events from the Linux
Audit Framework. You can also use {beatname_uc} to detect changes to critical
files, like binaries and configuration files, and identify potential security
policy violations.

include::{libbeat-dir}/shared-libbeat-description.asciidoc[]
