linux-logging

Safe auditd rollout for Linux fleets: plain rules and configs, POSIX scripts, and an Ansible collection.

This file includes the commands for Linux logs monitoring in an organization required by a SOC Analyst to monitor and analyze Brute Force Attempts, Commands Execution, Locate Attacking IP's etc.

Configured a Splunk Universal Forwarder on a remote Ubuntu system to forward syslog and authentication logs to a central Splunk indexer. Includes setup steps, search queries, and incident response observations. Part of the 30-Day SOC Challenge.