Directories ¶ Show internal Expand all Path Synopsis agentbeat auditbeat cache cmd include module/system module/system/host module/system/login module/system/package module/system/package/schema module/system/process module/system/socket module/system/socket/dns module/system/socket/dns/afpacket module/system/socket/guess module/system/socket/helper module/system/user processors/sessionmd processors/sessionmd/processdb processors/sessionmd/procfs processors/sessionmd/provider processors/sessionmd/provider/kerneltracingprovider processors/sessionmd/provider/procfsprovider processors/sessionmd/timeutils processors/sessionmd/types dockerlogbeat pipelinemanager pipelinemock pipereader filebeat cmd fbreceiver include input/awscloudwatch input/awss3 input/azureblobstorage input/azureblobstorage/mock input/azureeventhub input/benchmark input/cel input/cloudfoundry input/cometd input/default-inputs input/entityanalytics input/entityanalytics/internal/collections input/entityanalytics/internal/kvstore input/entityanalytics/provider input/entityanalytics/provider/activedirectory input/entityanalytics/provider/activedirectory/internal/activedirectory input/entityanalytics/provider/azuread input/entityanalytics/provider/azuread/authenticator input/entityanalytics/provider/azuread/authenticator/mock input/entityanalytics/provider/azuread/authenticator/oauth2 input/entityanalytics/provider/azuread/fetcher input/entityanalytics/provider/azuread/fetcher/graph input/entityanalytics/provider/azuread/fetcher/mock input/entityanalytics/provider/jamf input/entityanalytics/provider/jamf/internal/jamf input/entityanalytics/provider/okta input/entityanalytics/provider/okta/internal/okta input/etw input/gcppubsub input/gcs input/gcs/mock input/http_endpoint input/httpjson input/internal/httplog input/internal/httpmon input/internal/private input/lumberjack input/netflow input/netflow/decoder input/netflow/decoder/atomic input/netflow/decoder/config input/netflow/decoder/examples input/netflow/decoder/fields input/netflow/decoder/ipfix input/netflow/decoder/protocol input/netflow/decoder/record input/netflow/decoder/template input/netflow/decoder/test input/netflow/decoder/v1 input/netflow/decoder/v5 input/netflow/decoder/v6 input/netflow/decoder/v7 input/netflow/decoder/v8 input/netflow/decoder/v9 input/o365audit input/o365audit/auth input/o365audit/poll input/salesforce input/streaming module/activemq module/aws module/awsfargate module/azure module/cef module/checkpoint module/cisco module/cisco/shared module/coredns module/crowdstrike module/cyberarkpas module/envoyproxy module/fortinet module/gcp module/google_workspace module/ibmmq module/iptables module/juniper module/microsoft module/misp module/mssql module/mysqlenterprise module/netflow module/o365 module/okta module/oracle module/panw module/rabbitmq module/salesforce module/snyk module/sophos module/suricata module/threatintel module/zeek module/zookeeper module/zoom processors/add_nomad_metadata processors/aws_vpcflow processors/aws_vpcflow/internal/strings processors/decode_cef processors/decode_cef/cef processors/decode_cef/cef/cmd/cef2json processors/decode_cef/cef/fuzz functionbeat config function/beater function/cmd function/core function/provider function/telemetry include manager/aws manager/beater manager/cmd manager/core manager/core/bundle manager/executor provider/aws provider/aws/aws provider/aws/aws/transformer provider/aws/cmd provider/aws/include provider/local provider/local/cmd provider/local/include provider/local/local scripts/mage heartbeat cmd include monitors/browser monitors/browser/source monitors/browser/source/fixtures monitors/browser/synthexec monitors/browser/synthexec/testcmd scenarios scenarios/framework libbeat autodiscover/providers/aws autodiscover/providers/aws/ec2 autodiscover/providers/aws/elb autodiscover/providers/aws/test autodiscover/providers/nomad common/aws common/cloudfoundry common/cloudfoundry/test common/nomad common/proc include management management/tests persistentcache processors/add_cloudfoundry_metadata processors/add_nomad_metadata reader/etw reader/parquet metricbeat cmd include module/activemq module/airflow module/aws module/aws/awshealth module/aws/billing module/aws/cloudwatch module/aws/cloudwatch/metadata/ec2 module/aws/cloudwatch/metadata/rds module/aws/cloudwatch/metadata/sqs module/aws/mtest module/aws/mtest/scripts module/awsfargate module/awsfargate/task_stats module/azure module/azure/app_insights module/azure/billing module/azure/monitor module/azure/storage module/azure/test module/cloudfoundry module/cloudfoundry/container module/cloudfoundry/counter module/cloudfoundry/mtest module/cloudfoundry/value module/cockroachdb module/containerd module/containerd/blkio module/containerd/cpu module/containerd/memory module/coredns module/coredns/stats module/enterprisesearch module/enterprisesearch/health module/enterprisesearch/stats module/gcp module/gcp/billing module/gcp/carbon module/gcp/metrics module/gcp/metrics/cloudsql module/gcp/metrics/compute module/gcp/metrics/redis module/ibmmq module/iis module/iis/application_pool module/iis/test module/iis/webserver module/iis/website module/istio module/istio/citadel module/istio/galley module/istio/mesh module/istio/mixer module/istio/pilot module/meraki module/meraki/device_health module/mssql module/mssql/performance module/mssql/testing module/mssql/transaction_log module/oracle module/oracle/performance module/oracle/sysmetric module/oracle/tablespace module/panw module/panw/interfaces module/panw/routing module/panw/system module/panw/vpn module/prometheus module/prometheus/collector module/prometheus/remote_write module/redisenterprise module/sql module/sql/query module/stan module/stan/channels module/stan/stats module/stan/subscriptions module/statsd module/statsd/server module/syncgateway module/syncgateway/db module/syncgateway/memory module/syncgateway/replication module/syncgateway/resources module/tomcat scripts/msetlists osquerybeat beater cmd ext/osquery-extension ext/osquery-extension/pkg/hostfs ext/osquery-extension/pkg/proc ext/osquery-extension/pkg/tables include internal/action internal/command internal/config internal/cpio internal/distro internal/ecs internal/fetch internal/fileutil internal/hash internal/install internal/msiutil internal/osqd internal/osqdcli internal/pkgutil internal/pub internal/tar internal/testutil internal/xar scripts/mage packetbeat cmd module npcap scripts/mage winlogbeat cmd include module module/powershell module/security module/sysmon module/wintest Click to show internal directories. Click to hide internal directories.