linux:server
Linux server
Internal Linux servers.
- Host type
- Linux
- Standards scope
- linux
- Minimum events
- 13
- Recommended events
- 80
- Log sources
- 12
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | Recommended | 0 | 811 |
| Elastic Defend endpoint events | Recommended | 0 | 1,081 |
| Microsoft Defender for Endpoint device tables | Recommended | 0 | 379 |
| SentinelOne Singularity telemetry | Recommended | 0 | 459 |
Minimum
13 events meet the minimum bar for this role: an ATT&CK analytic names each one, and either a standard in the role's scope requires it or at least the platform's threshold of vendor rules depends on it. Grouped by log source; the source heading carries the cost class.
Linux audit framework (auditd)11 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| EXECVEProgram execution arguments | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 5 | Splunk 17, Sigma 145 | M-26-14, CISA/ASD, NSA/ASD, ACSC |
| PATHPath record | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 10 | Splunk 7 | M-26-14, STIG |
| SYSCALL:chmodSYSCALL record for chmod | 7 | none | STIG | |
| SYSCALL:creatSYSCALL record for creat | 6 | none | STIG | |
| SYSCALL:execveSYSCALL record for execve | 136 | Splunk 17, Sigma 145 | STIG, NSA/ASD | |
| SYSCALL:openSYSCALL record for open | 50 | none | M-26-14, STIG | |
| SYSCALL:openatSYSCALL record for openat | 8 | none | STIG | |
| SYSCALL:renameSYSCALL record for rename | 10 | none | STIG | |
| SYSCALL:rmdirSYSCALL record for rmdir | 1 | none | STIG | |
| SYSCALL:unlinkSYSCALL record for unlink | 8 | none | M-26-14, STIG | |
| SYSCALL:unlinkatSYSCALL record for unlinkat | 2 | none | STIG |
Sysmon for Linux2 events · Free tool
Recommended
80 more events meet one of the three criteria. Each source opens on its own.
Linux audit framework (auditd)63 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| ACCESS | 1 | none | ||
| CWDCurrent working directory | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 0 | Splunk 7 | |
| PROCTITLEProcess title | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 0 | Splunk 13 | |
| SERVICE_STOPService stop | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 0 | Splunk 5 | |
| SYSCALLSystem call record | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 0 | Splunk 13 | |
| SYSCALL:adduserSYSCALL record for adduser | 1 | none | ||
| SYSCALL:chownSYSCALL record for chown | 0 | none | STIG | |
| SYSCALL:connectSYSCALL record for connect | 20 | none | M-26-14 | |
| SYSCALL:createSYSCALL record for create | 2 | none | ||
| SYSCALL:delete_moduleSYSCALL record for delete_module | 0 | none | STIG | |
| SYSCALL:dlopenSYSCALL record for dlopen | 1 | none | ||
| SYSCALL:dmesgSYSCALL record for dmesg | 1 | none | ||
| SYSCALL:eximSYSCALL record for exim | 1 | none | ||
| SYSCALL:exit_groupSYSCALL record for exit_group | 1 | none | ||
| SYSCALL:fchmodSYSCALL record for fchmod | 0 | none | STIG | |
| SYSCALL:fchmodatSYSCALL record for fchmodat | 0 | none | STIG | |
| SYSCALL:fchownSYSCALL record for fchown | 0 | none | STIG | |
| SYSCALL:fchownatSYSCALL record for fchownat | 0 | none | STIG | |
| SYSCALL:fcntlSYSCALL record for fcntl | 1 | none | ||
| SYSCALL:fileSYSCALL record for file | 1 | none | ||
| SYSCALL:finit_moduleSYSCALL record for finit_module | 0 | none | STIG | |
| SYSCALL:firmware_updateSYSCALL record for firmware_update | 1 | none | ||
| SYSCALL:flockSYSCALL record for flock | 1 | none | ||
| SYSCALL:forkSYSCALL record for fork | 1 | none | ||
| SYSCALL:fremovexattrSYSCALL record for fremovexattr | 0 | none | STIG | |
| SYSCALL:fsetxattrSYSCALL record for fsetxattr | 0 | none | STIG | |
| SYSCALL:ftruncateSYSCALL record for ftruncate | 0 | none | STIG | |
| SYSCALL:groupmodSYSCALL record for groupmod | 1 | none | ||
| SYSCALL:init_moduleSYSCALL record for init_module | 0 | none | STIG | |
| SYSCALL:ioctlSYSCALL record for ioctl | 2 | none | ||
| SYSCALL:kexec_loadSYSCALL record for kexec_load | 1 | none | ||
| SYSCALL:lchownSYSCALL record for lchown | 0 | none | STIG | |
| SYSCALL:lremovexattrSYSCALL record for lremovexattr | 0 | none | STIG | |
| SYSCALL:lsetxattrSYSCALL record for lsetxattr | 0 | none | STIG | |
| SYSCALL:mknodSYSCALL record for mknod | 1 | none | ||
| SYSCALL:mmapSYSCALL record for mmap | 4 | none | ||
| SYSCALL:mountSYSCALL record for mount | 1 | none | ||
| SYSCALL:mprotectSYSCALL record for mprotect | 2 | none | ||
| SYSCALL:open_by_handle_atSYSCALL record for open_by_handle_at | 0 | none | STIG | |
| SYSCALL:pam_authenticateSYSCALL record for pam_authenticate | 1 | none | ||
| SYSCALL:passwdSYSCALL record for passwd | 1 | none | ||
| SYSCALL:postfixSYSCALL record for postfix | 1 | none | ||
| SYSCALL:process_vm_writevSYSCALL record for process_vm_writev | 1 | none | ||
| SYSCALL:ptraceSYSCALL record for ptrace | 7 | none | ||
| SYSCALL:readSYSCALL record for read | 12 | none | ||
| SYSCALL:removexattrSYSCALL record for removexattr | 0 | none | STIG | |
| SYSCALL:renameatSYSCALL record for renameat | 0 | none | STIG | |
| SYSCALL:sbinSYSCALL record for sbin | 1 | none | ||
| SYSCALL:sendmailSYSCALL record for sendmail | 1 | none | ||
| SYSCALL:sendtoSYSCALL record for sendto | 3 | none | ||
| SYSCALL:setifflagsSYSCALL record for setifflags | 1 | none | ||
| SYSCALL:setxattrSYSCALL record for setxattr | 0 | none | STIG | |
| SYSCALL:socketSYSCALL record for socket | 4 | none | ||
| SYSCALL:sshdSYSCALL record for sshd | 1 | none | ||
| SYSCALL:truncateSYSCALL record for truncate | 0 | none | STIG | |
| SYSCALL:umountSYSCALL record for umount | 0 | none | STIG | |
| SYSCALL:umount2SYSCALL record for umount2 | 0 | none | STIG | |
| SYSCALL:usermodSYSCALL record for usermod | 1 | none | ||
| SYSCALL:usrSYSCALL record for usr | 1 | none | ||
| SYSCALL:writeSYSCALL record for write | 32 | none | ||
| USER_AUTHUser authentication | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 1 | none | |
| USER_CMDUser command | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 1 | none | M-26-14 |
| USER_LOGINUser login | auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools. | 2 | none | M-26-14 |
osquery (Linux)14 events · Free tool
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| crontab | 1 | none | ||
| elf_info | 2 | none | ||
| event-based | 2 | none | ||
| file_events | 8 | none | ||
| file_events.path | 1 | none | ||
| file_metadata | 1 | none | ||
| hardware_events | 1 | none | ||
| hash | 2 | none | ||
| process_events | 3 | none | ||
| process_events.command_line | 1 | none | ||
| scheduled/real-time | 1 | none | ||
| socket_events | 1 | none | ||
| systemd_timers | 1 | none | ||
| yara_matches | 1 | none |
Sysmon for Linux3 events · Free tool
What an EDR replaces in this minimum set, and what it does not
An EDR is a process, network, file, registry and module sensor; it is not an audit log. For each product the dataset models: the minimum events it fully stands in for, the ones it reports only a subset of, and the ones it does not cover.
| Product | Replaces | Partly | Does not |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | 4 | 0 | 9 |
| Microsoft Defender for Endpoint device tables | 4 | 0 | 9 |
| Elastic Defend endpoint events | 3 | 3 | 7 |
| SentinelOne Singularity telemetry | No public event-level documentation was read for this product, so no comparison is made. | ||
What CrowdStrike Falcon sensor telemetry (FDR event_simpleName) does not replace (9 events)
What Microsoft Defender for Endpoint device tables does not replace (9 events)
What Elastic Defend endpoint events does not replace (7 events)
The EDR path
Sensor events an EDR product emits for this role. They are an alternative way to collect what an OS event carries, and each inherits its ATT&CK standing from the OS event it fully stands in for. The counts above are for the OS path.
Log sources on this role
- CrowdStrike Falcon sensor telemetry (FDR event_simpleName)
- Elastic Defend endpoint events
- Microsoft Defender for Endpoint device tables
- Other EDR telemetry (Endgame, Carbon Black, product not stated)
- SentinelOne Singularity telemetry
- Linux audit framework (auditd)
- eBPF tracing (Tracee, Tetragon, Falco)
- EDR telemetry on Linux
- osquery (Linux)
- Other Linux sources (procfs, FIM, package logs, shell history)
- syslog / journald (auth, secure, messages, cron)
- Sysmon for Linux