Security monitoring provides real-time visibility into user activity, system changes, and security-critical events. This helps detect unauthorized access, configuration tampering, and compliance violations.

This overview covers the currently supported security features: Cloud SIEM Audit Logs, Kubernetes Self-Hosted Audit Logs, and File Integrity Monitoring.

Once events are flowing in, detection rules turn them into actionable signals. See Detection Rules and Signals Overview to learn how signals are generated and how to build your own rules.

Linux Audit Logs

Linux Audit Logs provide detailed visibility into system-level activity on Linux hosts. They help monitor user actions, authentication events, privilege escalations, and sensitive system changes.

Linux audit logs are typically generated by the auditd subsystem and are essential for security monitoring, incident investigation, and compliance requirements.

Features

  • Centralized collection of Linux audit logs
  • Monitoring of user authentication and privilege escalation
  • Detection of suspicious command execution and system activity
  • Tracking access to sensitive files and system resources
  • Correlation of security events across hosts and services

Setup

Kubernetes – Self-Hosted Audit Logs

Kubernetes audit logs capture all interactions with the Kubernetes API server. They provide visibility into who performed an action, what resource was accessed, and when the operation occurred.

Self-hosted clusters such as K3s, Kubernetes, and on-prem clusters can forward audit logs to the SIEM pipeline for centralized security monitoring.

Features

  • Tracks all API server requests (create, update, delete, exec, etc.)
  • Identifies users, service accounts, and source IPs
  • Detects privilege escalations and suspicious operations
  • Monitors configuration changes and resource lifecycle events
  • Enables forensic investigation and compliance auditing

Example Security Events

Examples of events captured through Kubernetes audit logs include:

  • Pod creation or deletion
  • Deployment changes
  • Secrets access attempts
  • Role or ClusterRole modifications
  • Container exec access
  • Anonymous or unauthorized API access

Supported Environments

  • Kubernetes
  • K3s
  • Self-hosted clusters
  • On-prem Kubernetes deployments

Setup

File Integrity Monitoring (FIM)

File Integrity Monitoring tracks changes to critical files and directories, including creation, modification, renaming, and deletion. It is essential for detecting tampering, unauthorized changes, and policy violations.

Features

  • Real-time monitoring of critical system files
  • Detects malicious or unexpected modifications
  • Tracks user/process responsible for change
  • Baseline comparison & drift detection
  • Compliance-friendly change reporting

Setup

Detection Rules and Signals

Detection rules continuously evaluate the security events collected from your data sources. When activity matches a rule, Atatus generates a signal an actionable alert your team can triage, investigate, and resolve.

Features

  • Built-in, MITRE ATT&CK–mapped detection library, maintained by Atatus
  • Custom detection rules with threshold, anomaly, new value, impossible travel, and static match methods
  • Severity levels and risk scoring for prioritization
  • Signal triage workflow with statuses, assignment, grouping, and suppression
  • Notifications via Slack, Microsoft Teams, Email, and PagerDuty

Learn more