diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index 34321b61161b..0d062d7f15e0 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -1,5 +1,139 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
 
+env:
+  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_ARM_64: "core-ubuntu-2004-aarch64"
+  IMAGE_WIN_2016: "family/core-windows-2016"
+  IMAGE_WIN_2019: "family/core-windows-2019"
+  IMAGE_WIN_2022: "family/core-windows-2022"
+  IMAGE_RHEL9: "family/core-rhel-9"
+
 steps:
-  - label: "Example test"
-    command: echo "Hello!"
+  - group: "Audtibeat Mandatory Testing"
+    key: "mandatory-tests"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "audtibeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
+
+    steps:
+      - label: ":ubuntu: Unit Tests"
+        command:
+          - ".buildkite/audtibeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "audtibeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+        artifact_paths:
+          - "audtibeat/build/*.xml"
+          - "audtibeat/build/*.json"
+
+      - label: ":rhel: Unit Tests"
+        command:
+          - ".buildkite/audtibeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "audtibeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_RHEL9}"
+        artifact_paths:
+          - "audtibeat/build/*.xml"
+          - "audtibeat/build/*.json"
+
+      - label: ":windows:-{{matrix.image}} Unit Tests"
+        command: ".buildkite/audtibeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "audtibeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "{{matrix.image}}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        matrix:
+          setup:
+            image:
+              - "${IMAGE_WIN_2016}"
+              - "${IMAGE_WIN_2022}"
+        artifact_paths:
+          - "audtibeat/build/*.xml"
+          - "audtibeat/build/*.json"
+
+      - label: ":linux: Crosscompile"
+        command:
+          - ".buildkite/audtibeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "audtibeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "family/core-rhel-9"
+        artifact_paths:
+          - "audtibeat/build/*.xml"
+          - "audtibeat/build/*.json"
+
+  - group: "Extended Testing"
+    key: "extended-tests"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "audtibeat extended tests"
+
+    steps:
+      - label: ":linux: ARM64 Unit Tests"
+        key: "arm-extended"
+#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "audtibeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+        command:
+          - ".buildkite/audtibeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "audtibeat/Extended: Unit Tests ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+        artifact_paths: "audtibeat/build/*.xml"
+
+      - label: ":mac: MacOS Unit Tests"
+        key: "macos-extended"
+#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "audtibeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
+        command:
+          - ".buildkite/audtibeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "audtibeat/Extended: MacOS Unit Tests"
+        agents:
+          provider: "orka"
+          imagePrefix: "generic-13-ventura-x64"
+        artifact_paths: "audtibeat/build/*.xml"
+
+  - group: "Windows Extended Testing"
+    key: "extended-tests-win"
+#    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "audtibeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
+
+    steps:
+      - label: ":windows: Win 2019 Unit Tests"
+        key: "win-extended-2019"
+        command: ".buildkite/audtibeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "audtibeat/Extended: Win-2019 Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_WIN_2019}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        artifact_paths:
+          - "audtibeat/build/*.xml"
+          - "audtibeat/build/*.json"
+
+  - group: "Packaging"
+    key: "packaging"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
+    depends_on:
+      - "mandatory-tests"
+      - "extended-tests"
+      - "extended-tests-win"
+
+    steps:
+      - label: Package pipeline
+        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
diff --git a/.buildkite/auditbeat/scripts/crosscompile.sh b/.buildkite/auditbeat/scripts/crosscompile.sh
new file mode 100755
index 000000000000..77ec98783a8d
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/crosscompile.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo ":: Executing Crosscompile ::"
+cd auditbeat
+make -C auditbeat crosscompile
diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
new file mode 100755
index 000000000000..8dbf3aaed1e4
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+changeset="^auditbeat/
+    ^go.mod
+    ^pytest.ini
+    ^dev-tools/
+    ^libbeat/
+    ^testing/
+    ^\.buildkite/auditbeat/"
+
+if are_files_changed "$changeset"; then
+  cat <<-EOF
+    steps:
+      - label: ":ubuntu: Packaging Linux X86"
+        key: "package-linux-x86"
+        command:
+          - ".buildkite/audtibeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "audtibeat/Packaging: Linux X86"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+
+      - label: ":linux: Packaging Linux ARM"
+        key: "package-linux-arm"
+        env:
+          PLATFORMS: "linux/arm64"
+          PACKAGES: "docker"
+        command:
+          - ".buildkite/audtibeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "audtibeat/Packaging: ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+EOF
+fi
diff --git a/.buildkite/auditbeat/scripts/package.sh b/.buildkite/auditbeat/scripts/package.sh
new file mode 100755
index 000000000000..dfa602a0c24b
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/package.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+
+echo ":: Evaluate Auditbeat Changes ::"
+
+echo ":: Start Packaging ::"
+cd auditbeat
+umask 0022
+mage package
diff --git a/.buildkite/auditbeat/scripts/unit-tests.sh b/.buildkite/auditbeat/scripts/unit-tests.sh
new file mode 100755
index 000000000000..099cf8ef4c23
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/unit-tests.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/linux-env.sh
+source .buildkite/env-scripts/macos-env.sh
+
+echo ":: Execute Unit Tests ::"
+sudo chmod -R go-w auditbeat/
+
+cd auditbeat
+umask 0022
+mage build unitTest
diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index 0a1567e53cd5..268d0acf07ed 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -6,8 +6,7 @@ source .buildkite/env-scripts/env.sh
 source .buildkite/env-scripts/util.sh
 source .buildkite/env-scripts/win-env.sh
 
-
-if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" ]]; then
+if [[ ( "$BUILDKITE_PIPELINE_SLUG" == "filebeat" || "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" ) ]]; then
   if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
     install_python_win
   fi