Neo23x0/auditd resource

Health v2 · maintenance only

Adoption not part of the score

1899 stars · 311 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A best-practice auditd ruleset for Linux that provides a broad, portable baseline of security-relevant audit telemetry. It is designed to load out-of-the-box on major distributions while leaving detection logic to Sigma rules or SIEM analytics.

Use cases

• set up linux auditd rules for security monitoring
• collect audit telemetry for a SIEM
• harden linux hosts with audit logging
• detect privilege escalation attempts on linux
• monitor execve and socket creation events
• baseline audit configuration across multiple distros

When to choose

• you need a maintained, portable auditd baseline that works across major Linux distributions
• you want broad host telemetry to feed Sigma rules or a SIEM rather than hard-coded detections
• you need coverage of kernel, PAM, sudo, SSH, and privilege-abuse activity with minimal tuning

When to avoid

• you need targeted detections rather than raw telemetry collection
• high-volume events like execve and socket creation would overwhelm your log pipeline without tuning
• you are not on Linux or do not use the kernel audit subsystem

Facets

infra-config · maturity active

security monitoring logging configuration-management security operating-systems monitoring cli auditd audit-rules linux-audit threat-detection siem sigma hardening telemetry devops linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Neo23x0/auditd")