Trace intrusions through your Linux audit logs.
What it does
Investigates Linux audit logs to identify intrusion indicators and reconstruct a timeline of attacker activity.
When to use it
Use for suspected Linux-host compromise, privilege escalation, persistence, critical-file tampering, or incident timeline reconstruction.
How to use it
Give it a Linux-host intrusion investigation; it checks audit configuration, deploys monitoring rules, and builds a chronological account of attacker activity.
Uses
What you need · 7
Requires a Linux system and root or sudo access to configure audit rules and query logs.
Requires the auditd package installed, its daemon running, deployed audit rules, and audit-log storage with sufficient retention.
Access · 7
This skill
central SIEM
Forwards audit logs to SIEM
/etc/audit/rules.d/intrusion.rules
Adds persistent intrusion monitoring rules