Анализ Linux audit logs для обнаружения вторжений

★ 8.4 · security

analyzing-linux-audit-logs-for-intrusion is a Claude Code skill that uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity on individual Linux hosts. It covers audit rule configuration — including monitoring of /etc/passwd, /etc/shadow, SSH authorized keys, kernel module loading, and process execution from /tmp or /dev/shm — as well as log querying, attack timeline reconstruction, and integration with SIEM platforms. The skill activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection. It is well suited for forensic investigations, incident response, and compliance auditing against CIS, STIG, or PCI-DSS baselines that require syscall-level monitoring.