[id="{beatname_lc}-installation-configuration"]
== {beatname_uc} quick start: installation and configuration

++++
<titleabbrev>Quick start: installation and configuration</titleabbrev>
++++

This guide describes how to get started quickly with audit data collection.
You'll learn how to:

* install {beatname_uc} on each system you want to monitor
* specify the location of your audit data
* parse log data into fields and send it to {es}
* visualize the log data in {kib}

[role="screenshot"]
image::./images/auditbeat-auditd-dashboard.png[{beatname_uc} Auditd dashboard]

[float]
=== Before you begin

You need {es} for storing and searching your data, and {kib} for visualizing and
managing it.

include::{libbeat-dir}/tab-widgets/spinup-stack-widget.asciidoc[]

[float]
[[install]]
=== Step 1: Install {beatname_uc}

Install {beatname_uc} on all the servers you want to monitor.

To download and install {beatname_uc}, use the commands that work with your
system:

include::{libbeat-dir}/tab-widgets/install-widget.asciidoc[]

[float]
[[other-installation-options]]
==== Other installation options

* <<setup-repositories,APT or YUM>>
* https://www.elastic.co/downloads/beats/{beatname_lc}[Download page]
* <<running-on-docker,Docker>>
* <<running-on-kubernetes,Kubernetes>>

[float]
[[set-connection]]
=== Step 2: Connect to the {stack}

include::{libbeat-dir}/shared/connecting-to-es.asciidoc[]

[float]
[[enable-modules]]
=== Step 3: Configure data collection modules

{beatname_uc} uses <<auditbeat-modules,modules>> to collect audit information.

By default, {beatname_uc} uses a configuration that's tailored to the operating
system where {beatname_uc} is running.

To use a different configuration, change the module settings in
+{beatname_lc}.yml+.

The following example shows the `file_integrity` module configured to generate
events whenever a file in one of the specified paths changes on disk:

["source","sh",subs="attributes"]
-------------------------------------
auditbeat.modules:

- module: file_integrity
  paths:
  - /bin
  - /usr/bin
  - /sbin
  - /usr/sbin
  - /etc
-------------------------------------


include::{libbeat-dir}/shared/config-check.asciidoc[]

[float]
[[setup-assets]]
=== Step 4: Set up assets

{beatname_uc} comes with predefined assets for parsing, indexing, and
visualizing your data. To load these assets:

. Make sure the user specified in +{beatname_lc}.yml+ is
<<privileges-to-setup-beats,authorized to set up {beatname_uc}>>.

. From the installation directory, run:
+
--
include::{libbeat-dir}/tab-widgets/setup-widget.asciidoc[]
--
+
`-e` is optional and sends output to standard error instead of the configured log output.

This step loads the recommended {ref}/index-templates.html[index template] for writing to {es}
and deploys the sample dashboards for visualizing the data in {kib}.

[TIP]
=====
A connection to {es} (or {ess}) is required to set up the initial
environment. If you're using a different output, such as {ls}, see
<<load-template-manually>> and <<load-kibana-dashboards>>.
=====

[float]
[[start]]
=== Step 5: Start {beatname_uc}

Before starting {beatname_uc}, modify the user credentials in
+{beatname_lc}.yml+ and specify a user who is
<<privileges-to-publish-events,authorized to publish events>>.

To start {beatname_uc}, run:

// tag::start-step[]
include::{libbeat-dir}/tab-widgets/start-widget.asciidoc[]
// end::start-step[]

{beatname_uc} should begin streaming events to {es}.

If you see a warning about too many open files, you need to increase the
`ulimit`. See the <<ulimit,FAQ>> for more details.

[float]
[[view-data]]
=== Step 6: View your data in {kib}

To make it easier for you to start auditing the activities of users and
processes on your system, {beatname_uc} comes with pre-built {kib} dashboards
and UIs for visualizing your data.

include::{libbeat-dir}/shared/opendashboards.asciidoc[tag=open-dashboards]

[float]
=== What's next?

Now that you have audit data streaming into {es}, learn how to unify your logs,
metrics, uptime, and application performance data.

include::{libbeat-dir}/shared/obs-apps.asciidoc[]
