diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 31296d9c2a69..35e32f3f2b8b 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -55,6 +55,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - auditd: Prevent mapping explosion when truncated EXECVE records are ingested. {pull}30382[30382]
 - elasticsearch: fix duplicate ingest when using a common appender configuration {issue}30428[30428] {pull}30440[30440]
 
+- Fix ECS version string in threatintel to be consistent with other modules and add event.timezone. {issue}30499[30499] {pull}30570[30570]
+- Add default paths value to MySQL Enterprise module to prevent issues with pipeline installations {pull}30598[30598]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml b/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml
index e6341e1da266..b216500d2987 100644
--- a/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml
+++ b/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml
@@ -1,6 +1,9 @@
 module_version: 1.0
 
 var:
+  - name: paths
+    default:
+      - /home/user/mysqlauditlogs/audit.*.log
   - name: tags
     default: [mysqlenterprise-audit]
   - name: input