// the take
A single best-practice audit.rules file for Linux auditd that aims to work out of the box across major distros while covering a broad swath of security-relevant syscalls — process creation, privilege escalation primitives, network/firewall config changes, and more. It's for security engineers and sysadmins who want a solid auditd baseline to pair with Sigma rules or SIEM content, not a plug-and-play detection tool.
Deliberately keeps detection logic out of the ruleset and leaves it to downstream Sigma/SIEM tooling, which avoids the usual trap of a 2000-line rules file full of brittle hardcoded alerts. It's genuinely maintained, not just starred and abandoned — the AF_ALG/Copy Fail (CVE-2026-31431) coverage landed within days of the vulnerability's disclosure. CI actually loads both a portable and a strict copy of the rules on Ubuntu rather than just linting syntax. Coverage includes syscall surfaces most baseline configs skip: ptrace, memfd_create, bpf, io_uring, userfaultfd, namespaces.
UID_MIN=1000 is hardcoded directly into the rules and has to be manually found/replaced per host — no templating, so it's an easy thing to forget when rolling out across a fleet with mixed distros. The -i flag silently ignores rule load failures by design, meaning a broken or missing rule can fail quietly in production unless you remember to test the strict variant first. High-volume telemetry like execve and socket creation is left explicitly untuned, so you inherit auditd's classic log-volume problem with no included mitigation. It's one raw rules file with no packaging (rpm/deb) or config-management role (ansible/puppet), so fleet-wide deployment and updates are entirely on you.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →