auditd rules

[small-greenfinger]

Are all of auditd rules required to write config in audit.rules?

[frack113]

I'm only use one time auditd but look at https://github.com/Neo23x0/auditd

[nasbench]

Are all of auditd rules required to write config in audit.rules?

If you're using a service like the default auditd on CentOS or similar. Then the rules are located on audit.rules and are read from the location /etc/audit/rules.d/audit.rules. If you use elastic then you might use a tool like auditbeat which will replace auditd as the client for the logs and the location of the rules can be set from a config file.

Whatever you choose the location of the rules is documented in the docs and SIGMA is independent of that.

To give you a quick explanation. The auditd rules found in the SigmaHQ repository use a log source called service: auditd. This log source is mapped to different backends here are a couple of examples.

• Hawk Config
• ECS Auditd
• ECS Auditbeat

During rule conversion, SIGMA will convert the rules based on these fields and it has nothing to do with the configuration of auditd on a system.

So you can use whatever you like just make sure that everything is set up correctly.

Hope this helps.