metrics:
- auditd:
# General Options
resolve_ids: true # Map UID/GID → usernames
failure_mode: silent # Kernel audit failure mode: silent | log | panic
backlog_limit: 8196 # Max buffered audit messages
rate_limit: 0 # Kernel audit rate limit (messages/sec)
include_raw_message: false # Include unparsed raw audit records
include_warnings: false # Include audit subsystem warnings
# keep_null: false # Publish fields with null values
# Audit Rules: External Files
audit_rule_files:
- '${path.config}/audit.rules.d/*.conf'
# Inline Audit Rules
audit_rules: |
## Define audit rules here.
## Use -w for file watches and -a/-A for syscall audits.
## Example: Detect 32-bit syscall usage on 64-bit hosts
# -a always,exit -F arch=b32 -S all -F key=32bit-abi
## Example: Monitor process executions
# -a always,exit -F arch=b64 -S execve,execveat -k exec
## Example: Monitor network syscall activity
# -a always,exit -F arch=b64 -S accept,bind,connect -k external-access
## Example: Monitor identity file changes
# -w /etc/passwd -p wa -k identity
# -w /etc/group -p wa -k identity
# -w /etc/gshadow -p wa -k identity
## Example: Unauthorized file access attempts
# -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat \
# -F exit=-EACCES -k access
# -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat \
# -F exit=-EPERM -k access
