# Neo23x0/auditd

Best Practice Auditd Configuration

Repository: https://github.com/Neo23x0/auditd
Canonical: https://ross.abutalabs.com/products/auditd
Language: Shell
License: Apache-2.0
License Family: permissive
Last push: 2026-05-04T12:02:04+00:00

## Health v2 (maintenance only)
Score: 84/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 80, release rhythm 80, longevity 100
- inputs: {"age_days": 2899, "days_push": 121, "days_rel": 134, "gap_med": 0, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1899, forks 311 (observed 2026-08-28T04:05:51.378602+00:00)

## What it is
A best-practice auditd ruleset for Linux that provides a broad, portable baseline of security-relevant audit telemetry. It is designed to load out-of-the-box on major distributions while leaving detection logic to Sigma rules or SIEM analytics.

## Use cases
- set up linux auditd rules for security monitoring
- collect audit telemetry for a SIEM
- harden linux hosts with audit logging
- detect privilege escalation attempts on linux
- monitor execve and socket creation events
- baseline audit configuration across multiple distros

## When to choose
- you need a maintained, portable auditd baseline that works across major Linux distributions
- you want broad host telemetry to feed Sigma rules or a SIEM rather than hard-coded detections
- you need coverage of kernel, PAM, sudo, SSH, and privilege-abuse activity with minimal tuning

## When to avoid
- you need targeted detections rather than raw telemetry collection
- high-volume events like execve and socket creation would overwhelm your log pipeline without tuning
- you are not on Linux or do not use the kernel audit subsystem

## Facets
- artifact type: infra-config
- maturity: active
- function: security, monitoring, logging, configuration-management
- domain: security, operating-systems, monitoring
- platform: cli
- tags: auditd, audit-rules, linux-audit, threat-detection, siem, sigma, hardening, telemetry, devops, linux

## Member repositories
- Neo23x0/auditd (main) score 84

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:51.378602+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:12:07.031395+00:00, confidence not recorded.
  - readme: https://github.com/Neo23x0/auditd (fetched 2026-08-28T04:05:51.378602+00:00, sha d09275f22444)
- Data as of 2026-08-30T08:39:29.467469+00:00.