Auditd
auditd collects kernel-level audit events and security-relevant system activity.
Why it matters
- Creates tamper-resistant trails for critical operations.
- Supports investigations by linking who did what and when.
- Helps satisfy compliance and governance controls.
Operational notes
- Define focused audit rules for high-value events.
- Ship and retain audit logs centrally.
- Pair audit data with SIEM or EDR correlation.