@cwurm wrote:
Editors like Nano and Vim are creating swap files under the hood while you are editing a file. This is to prevent accidental data loss, and also to prevent simultaneous competing edits. That's what Auditbeat FIM is picking up. You can read a bit more about swap files here.
If you don't want Auditbeat to collect information about swap files you could exclude those files. But I would say it's actually useful information to have.