diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index 34321b61161b..147ca45ced16 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -1,5 +1,137 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
 
+env:
+  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_ARM_64: "core-ubuntu-2004-aarch64"
+  IMAGE_WIN_2016: "family/core-windows-2016"
+  IMAGE_WIN_2019: "family/core-windows-2019"
+  IMAGE_WIN_2022: "family/core-windows-2022"
+  IMAGE_RHEL9: "family/core-rhel-9"
+  IMAGE_MACOS_X86_64: "generic-13-ventura-x64"
+
 steps:
-  - label: "Example test"
-    command: echo "Hello!"
+  - group: "Auditbeat Mandatory Testing"
+    key: "mandatory-tests"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
+
+    steps:
+      - label: ":ubuntu: Unit Tests"
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+      - label: ":rhel: Unit Tests"
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_RHEL9}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+      - label: ":windows:-{{matrix.image}} Unit Tests"
+        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "{{matrix.image}}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        matrix:
+          setup:
+            image:
+              - "${IMAGE_WIN_2016}"
+              - "${IMAGE_WIN_2022}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+      - label: ":linux: Crosscompile"
+        command:
+          - ".buildkite/auditbeat/scripts/crosscompile.sh"
+        env:
+          GOX_FLAGS: "-arch amd64"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+
+  - group: "Extended Testing"
+    key: "extended-tests"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for extended support"
+
+    steps:
+      - label: ":linux: ARM64 Unit Tests"
+        key: "arm-extended"
+        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: Unit Tests ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+        artifact_paths: "auditbeat/build/*.xml"
+
+      - label: ":mac: MacOS Unit Tests"
+        key: "macos-extended"
+        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: MacOS Unit Tests"
+        agents:
+          provider: "orka"
+          imagePrefix: "${IMAGE_MACOS_X86_64}"
+        artifact_paths: "auditbeat/build/*.xml"
+
+  - group: "Windows Extended Testing"
+    key: "extended-tests-win"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
+
+    steps:
+      - label: ":windows: Win 2019 Unit Tests"
+        key: "win-extended-2019"
+        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: Win-2019 Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_WIN_2019}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+  - group: "Packaging"
+    key: "packaging"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
+    depends_on:
+      - "mandatory-tests"
+
+    steps:
+      - label: Package pipeline
+        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
diff --git a/.buildkite/auditbeat/scripts/crosscompile.sh b/.buildkite/auditbeat/scripts/crosscompile.sh
new file mode 100755
index 000000000000..866d6be42239
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/crosscompile.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo "--- Executing Crosscompile"
+make -C auditbeat crosscompile
diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
new file mode 100755
index 000000000000..021240589923
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/util.sh
+
+changeset="^auditbeat/
+^go.mod
+^pytest.ini
+^dev-tools/
+^libbeat/
+^testing/
+^\.buildkite/auditbeat/"
+
+if are_files_changed "$changeset"; then
+  cat <<-EOF
+    steps:
+      - label: ":ubuntu: Packaging Linux X86"
+        key: "package-linux-x86"
+        env:
+          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
+        command:
+          - ".buildkite/auditbeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "Auditbeat/Packaging: Linux X86"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+
+      - label: ":linux: Packaging Linux ARM"
+        key: "package-linux-arm"
+        env:
+          PLATFORMS: "linux/arm64"
+          PACKAGES: "docker"
+        command:
+          - ".buildkite/auditbeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "Auditbeat/Packaging: ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+EOF
+fi
diff --git a/.buildkite/auditbeat/scripts/package.sh b/.buildkite/auditbeat/scripts/package.sh
new file mode 100755
index 000000000000..71872ca15a35
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/package.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo "--- Docker Version: $(docker --version)"
+
+echo "--- Start Packaging"
+cd auditbeat
+umask 0022
+mage package
+
diff --git a/.buildkite/auditbeat/scripts/unit-tests-win.ps1 b/.buildkite/auditbeat/scripts/unit-tests-win.ps1
new file mode 100644
index 000000000000..200627d518f0
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/unit-tests-win.ps1
@@ -0,0 +1,51 @@
+$ErrorActionPreference = "Stop" # set -e
+$GoVersion = $env:GOLANG_VERSION # If Choco doesn't have the version specified in .go-version file, should be changed manually
+
+# Forcing to checkout again all the files with a correct autocrlf.
+# Doing this here because we cannot set git clone options before.
+function fixCRLF() {
+    Write-Host "--- Fixing CRLF in git checkout --"
+    git config core.autocrlf false
+    git rm --quiet --cached -r .
+    git reset --quiet --hard
+}
+
+function withGolang() {
+    Write-Host "--- Install golang $GoVersion --"
+    choco install golang -y --version $GoVersion
+
+    $choco = Convert-Path "$((Get-Command choco).Path)\..\.."
+    Import-Module "$choco\helpers\chocolateyProfile.psm1"
+    refreshenv
+    go version
+    go env
+}
+
+function installGoDependencies() {
+    $installPackages = @(
+        "github.com/magefile/mage"
+        "github.com/elastic/go-licenser"
+        "golang.org/x/tools/cmd/goimports"
+        "github.com/jstemmer/go-junit-report"
+        "github.com/tebeka/go2xunit"
+    )
+    foreach ($pkg in $installPackages) {
+        go install "$pkg"
+    }
+}
+
+fixCRLF
+
+$ErrorActionPreference = "Continue" # set +e
+
+Set-Location -Path auditbeat
+New-Item -ItemType Directory -Force -Path "build"
+withGolang
+installGoDependencies
+
+mage build unitTest
+
+$EXITCODE=$LASTEXITCODE
+$ErrorActionPreference = "Stop"
+
+Exit $EXITCODE
diff --git a/.buildkite/auditbeat/scripts/unit-tests.sh b/.buildkite/auditbeat/scripts/unit-tests.sh
new file mode 100755
index 000000000000..c1f5685c77fe
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/unit-tests.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo "--- Running Unit Tests"
+sudo chmod -R go-w auditbeat/
+
+cd auditbeat
+umask 0022
+mage build unitTest
diff --git a/.buildkite/env-scripts/env.sh b/.buildkite/env-scripts/env.sh
new file mode 100644
index 000000000000..4dfc01bafc34
--- /dev/null
+++ b/.buildkite/env-scripts/env.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+SETUP_GVM_VERSION="v0.5.1"
+WORKSPACE="$(pwd)"
+BIN="${WORKSPACE}/bin"
+HW_TYPE="$(uname -m)"
+PLATFORM_TYPE="$(uname)"
+REPO="beats"
+TMP_FOLDER="tmp.${REPO}"
+DOCKER_REGISTRY="docker.elastic.co"
+
+export SETUP_GVM_VERSION
+export WORKSPACE
+export BIN
+export HW_TYPE
+export PLATFORM_TYPE
+export REPO
+export TMP_FOLDER
+export DOCKER_REGISTRY
diff --git a/.buildkite/env-scripts/linux-env.sh b/.buildkite/env-scripts/linux-env.sh
new file mode 100644
index 000000000000..5e6e5f7cbf05
--- /dev/null
+++ b/.buildkite/env-scripts/linux-env.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/util.sh
+
+DEBIAN_FRONTEND="noninteractive"
+
+sudo mkdir -p /etc/needrestart
+echo "\$nrconf{restart} = 'a';" | sudo tee -a /etc/needrestart/needrestart.conf > /dev/null
+
+echo "--- PLATFORM TYPE $PLATFORM_TYPE"
+
+if [[ $PLATFORM_TYPE == "Linux" ]]; then
+  # Remove this code once beats specific agent is set up
+  if grep -q 'Ubuntu' /etc/*release; then
+    export DEBIAN_FRONTEND
+
+    echo "--- Ubuntu - Installing libs"
+    sudo apt-get update
+    sudo apt-get install -y libsystemd-dev
+    sudo apt install -y python3-pip
+    sudo apt-get install -y python3-venv
+  fi
+
+  # Remove this code once beats specific agent is set up
+  if grep -q 'Red Hat' /etc/*release; then
+    echo "--- RHL - Installing libs"
+    sudo yum update -y
+    sudo yum install -y systemd-devel
+    sudo yum install -y python3-pip
+    sudo yum install -y python3
+    pip3 install virtualenv
+  fi
+fi
+
+if [[ $PLATFORM_TYPE == Darwin* ]]; then
+  echo "--- Setting larger ulimit on MacOS"
+  # To bypass file descriptor errors like "Too many open files error" on MacOS
+  ulimit -Sn 50000
+  echo "--- ULIMIT: $(ulimit -n)"
+fi
+
+echo "--- Setting up environment"
+add_bin_path
+with_go
+with_mage
diff --git a/.buildkite/env-scripts/util.sh b/.buildkite/env-scripts/util.sh
new file mode 100644
index 000000000000..7aef69cff389
--- /dev/null
+++ b/.buildkite/env-scripts/util.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+add_bin_path() {
+    echo "Adding PATH to the environment variables..."
+    create_bin
+    export PATH="${PATH}:${BIN}"
+}
+
+with_go() {
+    local go_version="${GOLANG_VERSION}"
+    echo "Setting up the Go environment..."
+    create_bin
+    check_platform_architecture
+    retry 5 curl -sL -o ${BIN}/gvm "https://github.com/andrewkroh/gvm/releases/download/${SETUP_GVM_VERSION}/gvm-${PLATFORM_TYPE}-${arch_type}"
+    export PATH="${PATH}:${BIN}"
+    chmod +x ${BIN}/gvm
+    eval "$(gvm "$go_version")"
+    go version
+    which go
+    export PATH="${PATH}:$(go env GOPATH):$(go env GOPATH)/bin"
+}
+
+with_mage() {
+    local install_packages=(
+            "github.com/magefile/mage"
+            "github.com/elastic/go-licenser"
+            "golang.org/x/tools/cmd/goimports"
+            "github.com/jstemmer/go-junit-report"
+            "gotest.tools/gotestsum"
+    )
+    create_bin
+    for pkg in "${install_packages[@]}"; do
+        go install "${pkg}@latest"
+    done
+}
+
+create_bin() {
+    if [[ ! -d "${BIN}" ]]; then
+    mkdir -p ${BIN}
+    fi
+}
+
+check_platform_architecture() {
+# for downloading the GVM and Terraform packages
+  case "${HW_TYPE}" in
+   "x86_64")
+        arch_type="amd64"
+        ;;
+    "aarch64")
+        arch_type="arm64"
+        ;;
+    "arm64")
+        arch_type="arm64"
+        ;;
+    *)
+    echo "The current platform/OS type is unsupported yet"
+    ;;
+  esac
+}
+
+retry() {
+    local retries=$1
+    shift
+    local count=0
+    until "$@"; do
+        exit=$?
+        wait=$((2 ** count))
+        count=$((count + 1))
+        if [ $count -lt "$retries" ]; then
+            >&2 echo "Retry $count/$retries exited $exit, retrying in $wait seconds..."
+            sleep $wait
+        else
+            >&2 echo "Retry $count/$retries exited $exit, no more retries left."
+            return $exit
+        fi
+    done
+    return 0
+}
+
+are_files_changed() {
+  local changeset=$1
+
+  if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
+    return 0;
+  else
+    echo "WARN! No files changed in $changeset"
+    return 1;
+  fi
+}
+
+cleanup() {
+  echo "Deleting temporary files..."
+  rm -rf ${BIN}/${TMP_FOLDER}.*
+  echo "Done."
+}
+
+unset_secrets () {
+  for var in $(printenv | sed 's;=.*;;' | sort); do
+    if [[ "$var" == *_SECRET || "$var" == *_TOKEN ]]; then
+      unset "$var"
+    fi
+  done
+}
diff --git a/.buildkite/env-scripts/win-env.sh b/.buildkite/env-scripts/win-env.sh
new file mode 100644
index 000000000000..ccf5479b46e1
--- /dev/null
+++ b/.buildkite/env-scripts/win-env.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+echo "--- PLATFORM TYPE: ${PLATFORM_TYPE}"
+if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
+  echo "--- Installing Python on Win"
+  choco install mingw -y
+  choco install python --version=3.11.0 -y
+fi
diff --git a/.buildkite/filebeat/filebeat-pipeline.yml b/.buildkite/filebeat/filebeat-pipeline.yml
index 34321b61161b..4dfee77379c1 100644
--- a/.buildkite/filebeat/filebeat-pipeline.yml
+++ b/.buildkite/filebeat/filebeat-pipeline.yml
@@ -1,5 +1,137 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
 
 steps:
+<<<<<<< HEAD
   - label: "Example test"
     command: echo "Hello!"
+=======
+  - group: "Filebeat Mandatory Testing"
+    key: "mandatory-tests"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "filebeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
+
+    steps:
+      - label: ":ubuntu: Unit Tests"
+        command:
+          - ".buildkite/filebeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "Filebeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+          machineType: "c2-standard-16"
+        artifact_paths:
+          - "filebeat/build/*.xml"
+          - "filebeat/build/*.json"
+
+      - label: ":ubuntu: Go Integration Tests"
+        command:
+          - ".buildkite/filebeat/scripts/integration-gotests.sh"
+        notify:
+          - github_commit_status:
+              context: "Filebeat: Integration Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+          machineType: "c2-standard-16"
+        artifact_paths:
+          - "filebeat/build/*.xml"
+          - "filebeat/build/*.json"
+
+      - label: ":ubuntu: Python Integration Tests"
+        command:
+          - ".buildkite/filebeat/scripts/integration-pytests.sh"
+        notify:
+          - github_commit_status:
+              context: "Filebeat: Python Integration Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+          machineType: "c2-standard-16"
+        artifact_paths:
+          - "filebeat/build/*.xml"
+          - "filebeat/build/*.json"
+
+      - label: ":windows:-{{matrix.image}} Unit Tests"
+        command: ".buildkite/filebeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "Filebeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "{{matrix.image}}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        matrix:
+          setup:
+            image:
+              - "${IMAGE_WIN_2016}"
+              - "${IMAGE_WIN_2022}"
+        artifact_paths:
+          - "filebeat/build/*.xml"
+          - "filebeat/build/*.json"
+
+  - group: "Extended Testing"
+    key: "extended-tests"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "filebeat for extended support"
+
+    steps:
+      - label: ":linux: ARM64 Unit Tests"
+        key: "arm-extended"
+        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "filebeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+        command:
+          - ".buildkite/filebeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "Filebeat/Extended: Unit Tests ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+        artifact_paths: "filebeat/build/*.xml"
+
+      - label: ":mac: MacOS Unit Tests"
+        key: "macos-extended"
+        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "filebeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
+        command:
+          - ".buildkite/filebeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "Filebeat/Extended: MacOS Unit Tests"
+        agents:
+          provider: "orka"
+          imagePrefix: "${IMAGE_MACOS_X86_64}"
+        artifact_paths: "filebeat/build/*.xml"
+
+  - group: "Windows Extended Testing"
+    key: "extended-tests-win"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "filebeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
+
+    steps:
+      - label: ":windows: Win 2019 Unit Tests"
+        key: "win-extended-2019"
+        command: ".buildkite/filebeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "Filebeat/Extended: Win-2019 Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_WIN_2019}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        artifact_paths:
+          - "filebeat/build/*.xml"
+          - "filebeat/build/*.json"
+
+  - group: "Packaging"
+    key: "packaging"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
+    depends_on:
+      - "mandatory-tests"
+
+    steps:
+      - label: Package pipeline
+        commands: ".buildkite/filebeat/scripts/package-step.sh | buildkite-agent pipeline upload"
+>>>>>>> 31819ecf6e (Auditbeat pipeline migration to Buildkite (#37668))
diff --git a/.buildkite/filebeat/scripts/integration-gotests.sh b/.buildkite/filebeat/scripts/integration-gotests.sh
new file mode 100755
index 000000000000..d64ce7c98eb2
--- /dev/null
+++ b/.buildkite/filebeat/scripts/integration-gotests.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo "--- Executing Integration Tests"
+sudo chmod -R go-w filebeat/
+
+cd filebeat
+umask 0022
+mage goIntegTest
diff --git a/.buildkite/filebeat/scripts/integration-pytests.sh b/.buildkite/filebeat/scripts/integration-pytests.sh
new file mode 100755
index 000000000000..b51e8ae18a68
--- /dev/null
+++ b/.buildkite/filebeat/scripts/integration-pytests.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo "--- Executing Integration Tests"
+sudo chmod -R go-w filebeat/
+
+cd filebeat
+umask 0022
+mage pythonIntegTest
diff --git a/.buildkite/filebeat/scripts/package-step.sh b/.buildkite/filebeat/scripts/package-step.sh
new file mode 100755
index 000000000000..985125433cec
--- /dev/null
+++ b/.buildkite/filebeat/scripts/package-step.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/util.sh
+
+changeset="^filebeat/
+^go.mod
+^pytest.ini
+^dev-tools/
+^libbeat/
+^testing/
+^\.buildkite/filebeat/"
+
+if are_files_changed "$changeset"; then
+  cat <<-EOF
+    steps:
+      - label: ":ubuntu: Packaging Linux X86"
+        key: "package-linux-x86"
+        env:
+          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
+        command:
+          - ".buildkite/filebeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "Filebeat/Packaging: Linux X86"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+
+      - label: ":linux: Packaging Linux ARM"
+        key: "package-linux-arm"
+        env:
+          PLATFORMS: "linux/arm64"
+          PACKAGES: "docker"
+        command:
+          - ".buildkite/filebeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "Filebeat/Packaging: ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+EOF
+fi
diff --git a/.buildkite/filebeat/scripts/package.sh b/.buildkite/filebeat/scripts/package.sh
new file mode 100755
index 000000000000..0bb03250348c
--- /dev/null
+++ b/.buildkite/filebeat/scripts/package.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo "--- Start Packaging"
+cd filebeat
+umask 0022
+mage package
diff --git a/.buildkite/filebeat/scripts/unit-tests.sh b/.buildkite/filebeat/scripts/unit-tests.sh
new file mode 100755
index 000000000000..08ce9d4ea1c6
--- /dev/null
+++ b/.buildkite/filebeat/scripts/unit-tests.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo "--- Executing Unit Tests"
+sudo chmod -R go-w filebeat/
+
+umask 0022
+mage -d filebeat unitTest
diff --git a/.buildkite/hooks/post-checkout b/.buildkite/hooks/post-checkout
index e10f15de7b65..b6cc7ad60bda 100755
--- a/.buildkite/hooks/post-checkout
+++ b/.buildkite/hooks/post-checkout
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -euo pipefail
 
diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index ef38478a4327..c448a7102512 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -2,15 +2,11 @@
 
 set -euo pipefail
 
-if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" ]]; then
+if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" || "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" ]]; then
   source .buildkite/env-scripts/env.sh
   source .buildkite/env-scripts/util.sh
   source .buildkite/env-scripts/win-env.sh
 
-  if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
-    install_python_win
-  fi
-
   if [[ -z "${GOLANG_VERSION-""}" ]]; then
     export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
   fi
diff --git a/.buildkite/pull-requests.json b/.buildkite/pull-requests.json
index ad73ee69029c..f2a2b1daa698 100644
--- a/.buildkite/pull-requests.json
+++ b/.buildkite/pull-requests.json
@@ -57,8 +57,8 @@
             "set_commit_status": true,
             "build_on_commit": true,
             "build_on_comment": true,
-            "trigger_comment_regex": "^/test auditbeat$",
-            "always_trigger_comment_regex": "^/test auditbeat$",
+            "trigger_comment_regex": "^/test auditbeat(for (arm|macos|windows|extended support))?$",
+            "always_trigger_comment_regex": "^/test auditbeat(for (arm|macos|windows|extended support))?$",
             "skip_ci_labels": [  ],
             "skip_target_branches": [ ],
             "skip_ci_on_only_changed": [ ],