Add Definition to Auditd susp_activity

[BalsamicSentry]

I'd like to suggest adding a definition field to an Auditd rule that requires specific rules to be applied.

I see that the reference and description of the rule mention that the Auditd rule is custom, but I think it would be more clear if definition was added.

This is my first issue, sorry if I do something wrong

[github-actions[bot]]

Welcome @BalsamicSentry :wave:

It looks like this is your first issue on the Sigma rules repository!

The following repository accepts issues related to false positives or 'rule ideas'.

If you're reporting an issue related to the pySigma library please consider submitting it here

If you're reporting an issue related to the deprecated sigmac library please consider submitting it here

Thanks for taking the time to open this issue, and welcome to the Sigma community! :smiley:

[swachchhanda000]

Closing as definition has been updated and merged.