Security monitoring provides real-time visibility into user activity, system changes, and security-critical events. This helps detect unauthorized access, configuration tampering, and compliance violations.

This overview covers the currently supported security features: Cloud SIEM Audit Logs, Kubernetes Self-Hosted Audit Logs, File Integrity Monitoring, and the Sensitive Data Classifier.

Once events are flowing in, detection rules turn them into actionable signals. See Detection Rules and Signals Overview to learn how signals are generated and how to build your own rules.

Linux Audit Logs

Linux Audit Logs provide detailed visibility into system-level activity on Linux hosts. They help monitor user actions, authentication events, privilege escalations, and sensitive system changes.

Linux audit logs are typically generated by the auditd subsystem and are essential for security monitoring, incident investigation, and compliance requirements.

Features

  • Centralized collection of Linux audit logs
  • Monitoring of user authentication and privilege escalation
  • Detection of suspicious command execution and system activity
  • Tracking access to sensitive files and system resources
  • Correlation of security events across hosts and services

Setup

Kubernetes – Self-Hosted Audit Logs

Kubernetes audit logs capture all interactions with the Kubernetes API server. They provide visibility into who performed an action, what resource was accessed, and when the operation occurred.

Self-hosted clusters such as K3s, Kubernetes, and on-prem clusters can forward audit logs to the SIEM pipeline for centralized security monitoring.

Features

  • Tracks all API server requests (create, update, delete, exec, etc.)
  • Identifies users, service accounts, and source IPs
  • Detects privilege escalations and suspicious operations
  • Monitors configuration changes and resource lifecycle events
  • Enables forensic investigation and compliance auditing

Example Security Events

Examples of events captured through Kubernetes audit logs include:

  • Pod creation or deletion
  • Deployment changes
  • Secrets access attempts
  • Role or ClusterRole modifications
  • Container exec access
  • Anonymous or unauthorized API access

Supported Environments

  • Kubernetes
  • K3s
  • Self-hosted clusters
  • On-prem Kubernetes deployments

Setup

File Integrity Monitoring (FIM)

File Integrity Monitoring tracks changes to critical files and directories, including creation, modification, renaming, and deletion. It is essential for detecting tampering, unauthorized changes, and policy violations.

Features

  • Real-time monitoring of critical system files
  • Detects malicious or unexpected modifications
  • Tracks user/process responsible for change
  • Baseline comparison & drift detection
  • Compliance-friendly change reporting

Setup

Detection Rules and Signals

Detection rules continuously evaluate the security events collected from your data sources. When activity matches a rule, Atatus generates a signal an actionable alert your team can triage, investigate, and resolve.

Features

  • Built-in, MITRE ATT&CK–mapped detection library, maintained by Atatus
  • Custom detection rules with threshold, anomaly, new value, impossible travel, and static match methods
  • Severity levels and risk scoring for prioritization
  • Signal triage workflow with statuses, assignment, grouping, and suppression
  • Notifications via Slack, Microsoft Teams, Email, and PagerDuty

Learn more

Sensitive Data Classifier

The Sensitive Data Classifier scans your logs as they arrive and masks values that should not be stored in plain text, such as credit card numbers, email addresses, and authentication tokens. Matching happens in the ingest pipeline, so sensitive values are masked before anything is written to storage.

Features

  • 35 built-in library rules covering payment cards, PII, credentials, and network data
  • Custom rules using your own regular expressions
  • Four match actions: hash, redact, partially redact, or tag only
  • Keyword proximity checks to cut down on false positives
  • Scanning and sampling controls for Logs, with support for more telemetry planned
  • Sensitive data tags for searching, dashboarding, and alerting on findings

Learn more