Problem Statement
Explain how Linux auditd helps incident responders and what data you would collect first.
Explanation
Auditd is the userspace component of the Linux Auditing System. With kernel audit rules, it records security-relevant events, such as file writes, privilege use, and syscalls, to an immutable log. During an incident, responders pull targeted aureport and ausearch results for key paths, sensitive syscalls, and identity changes, then correlate with endpoint and network logs. This timeline shows what changed, who did it, and when.
Code Solution
SolutionRead Only
auditctl -w /etc/passwd -p wa -k id_change ausearch -k id_change | aureport -f -i
