﻿---
title: Auditbeat
description: Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you...
url: https://docs-v3-preview.elastic.dev/elastic/beats/pull/49504/reference/auditbeat
products:
  - Auditbeat
  - Beats
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Auditbeat
Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
Auditbeat is an Elastic [Beat](https://www.elastic.co/beats). It’s based on the `libbeat` framework. For more information, see the [Beats Platform Reference](https://docs-v3-preview.elastic.dev/elastic/beats/pull/49504/reference).