Beats auditbeat

by Elasticv9.4.2

Last updated Jun 8, 2026

Collect your Linux audit framework data and monitor the integrity of your files.

Install with winget

$ winget install --id Elastic.Auditbeat --exact --version 9.4.2

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Silent install command for Beats auditbeat

Beats auditbeat uses MSI (WiX). The silent install switches are /quiet /norestart.

One-line silent install (x64, machine scope)

msiexec.exe /i auditbeat-9.4.2-windows-x86_64.msi /quiet /norestart

See the full silent install reference for Beats auditbeat →

Built by Pckgr

For Intune admins

Stop chasing app updates. Pckgr patches them for you.

Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.

Start free 30-day trial

No credit card required.

Installers · v9.4.2

Architecture	Type	Scope	Install	Download
x64	MSI WiX	machine		Direct

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

2 known CVEs via NVD

medium6.8Patched in wingetCVE-2023-49922affects before 7.17.16, 8.11.3Dec 12, 2023
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or...
Vendor advisory
medium5.9Patched in wingetCVE-2023-31421affects >=8.0.0 and <=8.9.2Oct 25, 2023
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the clien...
Vendor advisory

Source: NVD, updated 2h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr.

Related apps

Beats winlogbeatElastic
Elastic.Winlogbeatv9.4.2
Fetches and ships Windows Event logs
Beats packetbeatElastic
Elastic.Packetbeatv9.4.2
Monitors the network and applications by sniffing packets
Beats metricbeatElastic
Elastic.Metricbeatv9.4.2
Fetches sets of metrics from the operating system and services
Beats heartbeatElastic
Elastic.Heartbeatv9.4.2
Ping remote services for availability
Beats functionbeatElastic
Elastic.Functionbeatv8.17.3
Ship cloud data with serverless infrastructure.
Beats filebeatElastic
Elastic.Filebeatv9.4.2
Tails and ships log files

Frequently asked questions

How do I install Beats auditbeat on Windows?

Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id Elastic.Auditbeat --exact --version 9.4.2. winget downloads the installer from Elastic and runs it. Requires Windows 10 (1809+) or Windows 11.

How do I install Beats auditbeat silently for unattended deployment?

Add --silent and accept the agreements upfront: winget install --id Elastic.Auditbeat --exact 9.4.2 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.

What are the silent install switches for Beats auditbeat?

Beats auditbeat uses MSI (WiX). Run the downloaded installer with: msiexec.exe /i auditbeat-9.4.2-windows-x86_64.msi /quiet /norestart. The silent switches are /quiet /norestart.

How do I uninstall Beats auditbeat via winget?

Run: winget uninstall --id Elastic.Auditbeat --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from Beats auditbeat's Apps & Features entry.

Is Beats auditbeat free?

Beats auditbeat is distributed under Elastic-2.0. Refer to the publisher (https://www.elastic.co/downloads/beats/auditbeat) for the full license terms - Wingetly itself does not charge for installation.

Does Beats auditbeat work on Windows 10?

Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls Beats auditbeat directly from the publisher.

How do I keep Beats auditbeat up to date?

Run winget upgrade --id Elastic.Auditbeat --exact, or winget upgrade --all to update everything winget tracks. We index 10 versions of Beats auditbeat from microsoft/winget-pkgs.

Recent versions

9.4.2latest
9.4.1
9.4.0
9.3.4
9.3.3
9.3.2
9.3.1
9.3.0
9.2.4
9.2.3