Auditd for the Masses - Philipp Krenn - Hack in Paris - 2018

This course teaches learners how to utilize the Linux Audit daemon to write audit records and access them using ausearch and aureport. It covers the challenges of parsing and centralizing these records and introduces Elastic's Auditbeat as a solution to ship records to a centralized location for easy visualization. Participants will learn to detect changes to critical files, identify security policy violations, and discover security breaches using interactive dashboards. The course also demonstrates combining Auditd events with logs for enhanced security monitoring. The intended audience for this course includes individuals interested in Linux security, system administrators, and cybersecurity professionals. The teaching method includes a combination of theoretical explanations, live demonstrations, and practical examples.