auditd (Linux Audit Daemon) rules aggregated on disk

via /etc/audit/audit.rules by default

Operating System

via /etc/audit/audit.rules by default

Use MQL in cnspec shell or policy:

auditd.rules

Min version: 9.0.0

Relationships

Operating System

5 resources · 4 relationships·Click to select, expand fields to see properties.

Field	Type	Description
`controls`	[]auditd.rule.control	all controls for auditd
`files`	[]auditd.rule.file	all file rules
`path`	string	path to folder to look up rules
`syscalls`	[]auditd.rule.syscall	all syscall rules

auditd (Linux Audit Daemon) configuration

auditd.config MQL resource for querying Operating System infrastructure with cnquery and cnspec.

auditd (Linux Audit Daemon) rule

auditd.rule MQL resource for querying Operating System infrastructure with cnquery and cnspec.