LOADING N0PERM…
Query tool for the Linux audit daemon logs (/var/log/audit/audit.log). Allows targeted incident response based on key, syscall, UID, or file path.
A standard LINUX utility used across offensive reconnaissance, packet forensics, and defensive system administration.
Direct visibility into network interfaces, protocol frames, access controls, or filesystem structures without graphical overhead.
During live system triage, initial reconnaissance, forensic capture inspection, or baseline configuration auditing.
# Ships with auditd package
sudo apt install auditdAudit trail investigation:
- Search by rule key tag: sudo ausearch -k identity_tampering --interpret
- Search recent failed syscalls: sudo ausearch -sv no -ts recent
- Search by effective user ID: sudo ausearch -ui 0 -ts today --interpret
- Extract executable names from audit events: sudo ausearch -k elevated_exec --raw | aureport -x