MISSION LAB

Audit Logging & Monitoring

< Shield House

MISSION OBJECTIVES

0/8 Complete

    AUDIT LOGGING INTEL

    MISSION BRIEFING

    A SOC 2 audit is scheduled for next week. The auditors will check that your Linux systems have proper audit logging: who accessed what, when, and whether critical files are monitored. Configure auditd to pass the compliance check.

    Audit Commands

    auditctl -l
    List current audit rules
    auditctl -w /path -p rwxa -k keyname
    Watch a file/dir for access
    ausearch -k keyname
    Search by key tag
    ausearch -m USER_AUTH
    Search by message type
    aureport --auth
    Authentication report
    aureport --summary
    Overall audit summary
    systemctl status auditd
    Check audit daemon status
    Why This Matters
    The Linux audit framework (auditd) provides kernel-level event logging. It records syscalls, file access, user actions, and security events. SOC 2 Type II, HIPAA, and PCI DSS all require comprehensive audit logging. Without it, you cannot prove who did what.