1
Task 1 of 5
Loading...
AUDIT LOG DRILL
Scenario
A compliance audit is underway. The security team needs you to extract specific events from the audit logs using ausearch and aureport. Time is ticking.
0 completed
0%
Solution Cheat Sheet
Task 1 — Failed authentication attempts
ausearch -m USER_AUTH --success no
Task 2 — Authentication report
aureport --auth
Task 3 — File access audit
ausearch -f /etc/shadow
Task 4 — Executable report
aureport -x
Task 5 — User activity search
ausearch -ua jdoe
