Repository navigation

Add Linux Auditd Audit Configuration File Modification detection - #4385

Open

vahidmalekk wants to merge 2 commits into

splunk:developfrom

vahidmalekk:detection/linux-auditd-audit-config-mod

Open

Add Linux Auditd Audit Configuration File Modification detection#4385
vahidmalekk wants to merge 2 commits into
splunk:developfrom
vahidmalekk:detection/linux-auditd-audit-config-mod

Commits on Nov 2, 2026
- Add Linux Auditd Audit Configuration File Modification detection
  vahidmalekk
  committed
  2014c9f
- Rework audit config modification: CWD path reconstruction, success guard, drop syscall-name filter (address review)
  vahidmalekk
  committed
  bce7d57