Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
is useful in combination with audit rules such as: # -w <path> -p x -k <key> # e.g.: -w /usr/bin/dpkg -p x -k software_mgmt label-keys = [ "software_mgmt" ] # Labels can be attached to or removed from processes that run certain # programs. The file program file path (SYSCALL.exe or /proc/pid/exe) #