linux:auditd SYSCALL:fsetxattr
SYSCALL record for fsetxattr
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
DISA STIG (linux)
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Recommended | DISA STIG (linux) |
| Linux web server, internet-facing | Recommended | DISA STIG (linux) |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| DISA STIG: Audit rules (auditd)Red Hat Enterprise Linux 9 V2R10 (2026-10-05) | Names this event | RHEL-09-654025 (linux): setxattr;fsetxattr;lsetxattr;removexattr;fremovexattr;lremovexattr key perm_mod |