Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
ryslogd with systemctl rsyslog restart and we will start to see the logs flow in. This makes it easier to work with as when we write alert logic rules we now have more information about the process and what is going on so we can extract meta data. Parsing the Logs We can create a parser like the