Linux auditd Detection Ruleset
A production-ready auditd configuration for Linux security monitoring that works out-of-the-box across major distributions.
What is Linux auditd Detection Ruleset?
Neo23x0/auditd is a production-ready configuration for Linux's auditd daemon that provides comprehensive security monitoring out of the box. It solves the problem of creating effective audit rules by offering a balanced configuration that captures security-relevant activity without generating excessive log data. The configuration is designed to work across all major Linux distributions and covers common security use cases.
System administrators, security engineers, and DevOps professionals responsible for securing Linux servers who need reliable audit logging without extensive configuration effort.
Developers choose this configuration because it provides a battle-tested, well-documented starting point that balances security visibility with system performance, saving hours of research and tuning while ensuring critical security events are captured.
Overview
Best Practice Auditd Configuration
Use Cases
Best For
- Setting up security monitoring on new Linux servers quickly
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
