#auditd
LightNews LightNews
vpierre06.bsky.social
🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security
ndaal_open_source / ndaal_public_auditd · GitLab
Best Practice Auditd Configuration
gitlab.com
September 30, 2026 at 6:12 AM
lea-linux.org
auditd + copyfail :
Weston Walker @westonlwalker You can detect Copy Fail exploitation with the following auditd rules: -a always,exit -F arch=b64 -S bind -F a2=88 -F key=alg_bind -a always,exit -F arch=b64 -S setsockopt -F a1=279 -F key=alg_setsockopt The exploit binds to this saddr once for each 4 bytes of the shellcode. So, if you see like 30-40 of these, it's probably a bad guy.
May 2, 2026 at 1:03 AM
vpierre06.bsky.social
Track unauthorized compute utilization by monitoring binary execution of legacy and rogue miners like `minerd`.

Rules:
-a always,exit -F arch=b64 -F path=/usr/bin/minerd -F perm=x -F key=T1496_Resource_Hijacking

Detect unauthorized ..

#ndaal #auditd #linux #opensource

gitlab.com/ndaal_open_s...
ndaal_open_source / ndaal_public_auditd · GitLab
Best Practice Auditd Configuration
gitlab.com
September 30, 2026 at 6:10 AM
lu.is
you have to audit multiple models and prompts against each other for this sort of thing.

And granite in my auditd (for a different very text-centric problem) was basically dead last.
October 5, 2026 at 2:47 PM
tazwake.bsky.social
Auditd Incident Response: Rules That Matter

Auditd runs on most Linux servers and records almost nothing useful by default. This guide covers rules worth having, protecting the configuration, and querying the results with ausearch and aureport.
Auditd Incident Response: Rules That Matter
Auditd runs on most Linux servers and records almost nothing useful by default. This guide covers rules worth having, protecting the configuration, and querying the results with ausearch and aureport.
www.halkynconsulting.co.uk
August 26, 2026 at 4:11 PM
tazwake.bsky.social
In #FOR577 today, we are talking about issues trying to read auditd logs when you dont have access to good tools.

Although there is no one-size-fits-all solution, I've found that deploying an Elastic docker container and ingesting data really speeds things up.

www.linkedin.com/pulse/linux-...
Linux DFIR - Rapid Audit Log Ingestion with Elasticsearch
A guide to using Elasticsearch and Kibana containers to rapidly analyse complex Linux logs, such as the auditd log files.
www.linkedin.com
November 20, 2024 at 7:12 PM
vpierre06.bsky.social
🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security
ndaal_open_source / ndaal_public_auditd · GitLab
Best Practice Auditd Configuration
gitlab.com
September 23, 2026 at 3:02 PM
bearstech.com
Chasse à la menace sur Linux, utiliser Sysmon et auditd et détecter des webshells.
-> pberba.github.io/sec...
April 8, 2024 at 12:30 PM
vpierre06.bsky.social
🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security
Sign in · GitLab
GitLab.com
gitlab.com
September 23, 2026 at 7:19 PM
kostastsale.bsky.social
💥EDR-Telemetry Linux results update

We are getting closer to the release now, aiming for it within the next two weeks. So far, we have tested:

❗️Non-EDRs for comparison purposes only:
Sysmon-for-Linux✅
Auditd (config: https://buff.ly/3Zmx8Hh)✅

♦️EDRs
CrowdStrike✅
Elastic✅
Continuing...👇
November 24, 2024 at 5:48 PM
vpierre06.bsky.social
🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security
Sign in · GitLab
GitLab.com
gitlab.com
September 25, 2026 at 1:25 PM
cybercod.bsky.social
Great update! An actively maintained, best-practice auditd rule set is invaluable for Linux #security. Thanks for sharing this #opensource resource!
September 23, 2026 at 3:19 PM
golangch.bsky.social
An alternative to the auditd daemon that ships with many Linux distros.
#golang

github.com/slackhq/go-...
GitHub - slackhq/go-audit: go-audit is an alternative to the auditd daemon that ships with many distros
go-audit is an alternative to the auditd daemon that ships with many distros - slackhq/go-audit
github.com
April 11, 2025 at 5:14 AM
hackmag.com
🟢 Linux Audit Basics: Setting Up auditd to Log Critical Security Events

🗨️ The Linux Audit subsystem lets you track security-relevant activity based on preconfigured rules and generates log recor…

#unix
Linux Audit Basics: Setting Up auditd to Log Critical Security Events
Read more
hackmag.com
March 29, 2026 at 3:20 AM
badsectorlabs.com
FreeBPX RCE (@chudyPB), badpie (@dtmsecurity), macOS auditd malloc woes (@jfmeee), Spotlight TCC leak (@patrickwardle), WSUS relaying (@Coontzy1), pyLDAPGui (@ZephrFish), and more!

blog.badsectorlabs.com/last-week-in...
Last Week in Security (LWiS) - 2025-09-15
FreeBPX RCE (@chudyPB), badpie (@dtmsecurity), macOS auditd malloc woes (@jfmeee), Spotlight TCC leak (@patrickwardle), WSUS relaying (@Coontzy1), pyLDAPGui (@ZephrFish), and more!
blog.badsectorlabs.com
September 16, 2025 at 2:31 PM
glitterbean.wehavecookies.social.ap.brid.gy
ndaal_public_auditd https://kitploit.com/en/tools/gitlab/ndaal_open_source/ndaal_public_auditd
ndaal_public_auditd — Best-practice Linux Auditd rule set with 14,956 MITRE ATT&CK-mapped rules, Ansible deployment role, and lint/test tooling for security monitoring and compliance auditing. | Kitploit
Best-practice Linux Auditd rule set with 14,956 MITRE ATT&CK-mapped; rules, Ansible deployment role, and lint/test tooling for security monitoring and compliance auditing.
kitploit.com
October 2, 2026 at 9:01 PM
chiefgyk3d.com
Planning my PDS server with these tools in a couple weeks:

CrowdSec/Fail2Ban
IPSet
SSH keys
Auto updates
UFW
Hardening
Backups
Exploring: Tripwire, Auditd, Logwatch.
Long-term: Building a SIEM for future projects.

What tools would you add for a secure setup? #Cybersecurity #InfoSec #Bluesky
November 21, 2024 at 7:37 PM
r-netsec.bsky.social
Threat Detection Engineering and Incident Response with AuditD and Sentinel along how to understand and use AuditD
Threat Detection Engineering and Incident Response with AuditD and Sentinel along how to understand and use AuditD
medium.com
May 19, 2024 at 4:39 PM
surcouf.bsky.social
#SELinux est en train de me rendre chèvre...
Impossible d'exécuter simplement nginx (permission denied) avec un utilisateur confiné (sysadm_u)...
Et aucun message d'erreur dans auditd, évidemment...
January 10, 2025 at 11:18 AM
zyekhabdul.zyekh.com
Linux Auditd Blueprint: Real-Time Kernel Event Tracking & Security Auditing

Security guide for configuring Linux Audit Framework (auditd) to log exe...

[ Read Full Article -> ] https://zyekh.com/blog/auditd-kernel-event-monitoring-and-dfir-logging.html

#Cybersecurity #Auditddfir
Linux Auditd Blueprint: Real-Time Kernel Event Tracking & Security Auditing
August 15, 2026 at 3:03 AM
romeosidvicious.willkill.us
Or the smtp logs or auditd logs showing the commands run. And this dude thinks that multiple women, who aren't geeks, managed to forge SMS messages which is way harder than anything we're discussing.
June 10, 2026 at 7:05 PM
timb.me.uk
https://github.com/Neo23x0/auditd/pull/180 to detect raw sockets and BPF filters was merged....
Update with raw socket rules by timb-machine · Pull Request #180 · Neo23x0/auditd
These are the raw socket rules extracted from https://github.com/CiscoCXSecurity/presentations/blob/master/Auditd%20for%20the%20newly%20threatened.pdf.
github.com
May 23, 2026 at 8:32 AM
julien.hommet.net
#Talos 1.10 de sortie !
Liste des mises à jour : github.com/siderolabs/t...

En bref : k8s 1.33, boot en uefi(systemd) par défaut, plus de cgroup v1, les extensions sont devenues des « boot assets »
Release v1.10.0 · siderolabs/talos
Talos 1.10.0 (2025-04-30) Welcome to the v1.10.0 release of Talos! Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues. auditd Kernel parameter t...
github.com
April 30, 2025 at 10:06 PM
jiridh.bsky.social
Tuurlijk dat kunnen w er ook nog wel bij hebben.
Een trainee.

Die gaat een ansible role maken voor auditd :)
Die gaat leren.
- Ansible
- Linux audit
- Logging.

Naast wat rand zakken als git ;)
April 7, 2025 at 12:51 PM
stephenfroeber.bsky.social
On Linux, you could do something like:
sudo auditctl -w ~/.zsh_history -p war -k zsh_history_watch

And then to view those logs later for troubleshooting:
ausearch -k zsh_history_watch

On MacOS, you could do something similar with: www.unix.com/man-page/osx...
auditd(8) [osx man page]
The auditd daemon responds to requests from the audit(8) utility and notifications from the kernel. It manages the resulting audit log files and specified log file locations. The options are as follow...
www.unix.com
November 6, 2024 at 6:05 PM