auditd

Free · OSS

Host & Endpoint

The unfakeable kernel-level record of what actually happened on a Linux box.

Linux's built-in audit recorder. Captures sudo commands, file access, process starts — the unfakeable log of what actually happened on a Linux box. Already installed on most servers; CyberCLI just turns the firehose into signals.

CyberCLI pack v1.0.0 stable

updated 2026-06-06

Production-shippable. Integration test coverage + battle-tested in design-partner installs.

What it watches

Process executions (execve) — what ran, as whom, with what args
Sudo + privilege-change events
File access + modification on watched paths
User/group + credential changes
Loadable-kernel-module + capability events

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0002 · Execution TA0003 · Persistence TA0004 · Privilege Escalation TA0005 · Defense Evasion TA0007 · Discovery

See the full coverage matrix →

Every alert this connector surfaces

14 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type	dashboard renders
audit_auth_failed	Audit auth failed on auditd
audit_auth_ok	Audit auth success on auditd
audit_config_change	Audit config change on auditd
audit_identity_change	Audit identity change on auditd
audit_integrity	Audit integrity event on auditd
audit_mac_denial	Audit MAC denial on auditd
audit_mac_policy	Audit MAC policy on auditd
audit_anomaly	Audit anomaly on auditd
audit_proc_context	Audit process context on auditd
audit_seccomp	Audit seccomp event on auditd
audit_syscall_denied	Audit syscall denied on auditd
audit_syscall	Audit syscall on auditd
audit_malformed	Malformed audit log on auditd
audit_other	Audit activity on auditd

What it helps you catch

Gives you ground truth after an incident — the exact commands an attacker ran, by which user, in what order.

Catches privilege escalation by the syscall, even when the attacker cleans up other logs.

Surfaces tampering with sensitive files (sshd_config, sudoers, cron) the moment it happens.

What you'd see in CyberCLI

illustrative

CYCON 3 high

auditd

Gives you ground truth after an incident — the exact commands an attacker ran, by which user, in what order.

Routed to Warden (triage) → Knight (detection) → Scribe (record)

⛓ every step hash-chained · replayable

What CyberCLI reads from auditd

audit our math

Fields normalized

parsed from the source event

Event categories

—

with on-disk fixtures

Trust Ladder

see /trust

AI authorization range

Full field index · 19 fields ↓

.action.audit_avc_action.audit_avc_perm.audit_detail.audit_epoch.audit_event_id.audit_key.audit_login_uid_unset.audit_record_type.audit_tagged.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.event_id.event_type.rule_level.user_id

Field count + sample event auto-derived from src/cybercli/connectors/auditd/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.