Splunk Enterprise

Is there a recommended auditd configuration we can start with?

daniel333
Builder

All,

We're just getting going with auditd. We're Looking to trace back user activities and file changes.

thanks
-Daniel

tzhang_gr
New Member

There're a few templates under /usr/share/doc/audit-xxx/rules/xxx.rules

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Check the following TA for Linux auditd, https://splunkbase.splunk.com/app/4232/

There is a companion app, https://splunkbase.splunk.com/app/2642/, that will make use of the collected data for some pretty dashboards.

daniel333
Builder

I guess I am looking more for auditd rules configs. Something to get started with. Some of these configs on linux can get pretty intense.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...