Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
running as a sub system and as it’s own user Send logs to Sentinel Lets add the following to /etc/ryslog.conf $ModLoad imfile $InputFileName /var/log/laurel/audit.log $InputFileTag AuditD: $InputFileStateFile audit_log $InputFileSeverity info $InputFileFacility local6 $InputRunFileMonitor Restart