LINUX DETECTION ENGINEERING WITH AUDITD

Summary from the TLDR InfoSec newsletter

The first part in a series on Linux detection engineering from Elastic Labs, which focuses on installing and configuring auditd. The first part of the article lists installation methods for auditd and explains the types of rules that auditd supports. Control type rules configure the auditd process, file system rules watch files for read, write, and execute actions, and system call rules are the powerhouse of auditd and specify which syscalls to monitor and log. The second part focuses on how to use the Auditd Manager Elastic integration to install and configure auditd at scale and presents Elastic alerts for various scenarios.