Skip to content
Sign In
Telemetry

linux:auditd SYSCALL:socket

SYSCALL record for socket

Log source
Linux audit framework (auditd)
Host type
Linux
Tier, host type
Recommended
Techniques
4
Rules depending on it
none

Why this tier

By role

RoleTierBasis
Linux serverRecommended
Linux web server, internet-facingRecommended

Techniques it helps detect

Rules that depend on it

No vendor rule names this event or source directly.

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.