---
name: "auditd-linux-audit-daemon-rules"
description: "Monitor critical system calls, file modifications, and privileged execution with auditd."
metadata:
  author: "Linux Audit Project"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "configure auditd rules"
  - "monitor file changes auditd"
  - "search audit logs ausearch"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Linux auditd Syscall Monitoring & Rules

Configures Linux Audit Daemon (/etc/audit/audit.rules): tracking file changes (/etc/passwd, /etc/shadow), monitoring execve execution, filtering events by UID, and searching logs with ausearch/aureport.

## When to Invoke
Invoke this skill whenever you need to:
- configure auditd rules
- monitor file changes auditd
- search audit logs ausearch

## Execution SOP & Rules
1. Define audit rules in /etc/audit/rules.d/audit.rules: -w /etc/shadow -p wa -k shadow_changes.
2. Monitor syscalls with -a always,exit -F arch=b64 -S execve -k command_execution.
3. Search specific audit tags with ausearch -k shadow_changes -ts today.
4. Generate high-level compliance summaries using aureport --summary.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.