Linux detection engineering with Auditd

This guide explains how to deploy and manage Linux Auditd and Elastic's Auditd Manager, how to write and troubleshoot Auditd rules, and illustrates detection/hunting examples (UDP reverse shells, Meterpreter file reads, FTP/RDP brute force, RWX memory regions) and ES|QL queries to increase Unix/Linux visibility and detection capabilities.