Custom Wazuh rules for Auditd

Custom Wazuh rules for Auditd provide a tailored method to enhance Wazuh’s capabilities to detect Linux command executions. This will also help the security team to detect critical security events, track user activities, and ensure regulatory compliance.

Auditd syscall rule

We can create a Wazuh rule to detect any system call (syscall) events, as written here:

  <rule id="200200" level="3">
    <decoded_as>auditd-syscall</decoded_as>
    <description>Auditd: System Calls Event </description>
    <group>syscall,</group>
  </rule>

Here, we have the following:

• <decoded_as>auditd-syscall</decoded_as>: This represents a requisite to trigger the rule. It will be triggered only if the event has been decoded by a specific decoder. In this case, it is auditd-syscall.

Auditd...