Auditd

The Auditd scan answers two questions in one run: Is audit logging set up correctly on this host? and What notable activity has it recorded since the last scan?

Supports: NIST 800-53 AU-2 (Event Logging), AU-6 (Audit Record Review, Analysis, and Reporting), and AU-12 (Audit Record Generation).

Configuration checks

Each scan verifies that:

• The audit service is running.
• Reef’s recommended audit rules are loaded. Any missing rule groups are reported individually.
• The audit configuration is locked (-e 2), so it cannot be changed without a reboot.
• The kernel has not dropped any audit events.

Notable events

Reef reviews every audit event recorded since the previous scan and highlights activity worth a closer look, including:

• Account, permission, and security-policy changes
• sudo commands
• Repeated failed logins (possible brute-force attempts)
• Other suspicious system activity, tagged with the matching MITRE ATT&CK technique

Noisy, repetitive events are grouped by type and user rather than listed one at a time. Each scan picks up exactly where the last one stopped, so no event is counted twice or skipped. On the very first scan, Reef reviews the last 10 minutes of activity.

The ruleset

Reef ships an adapted version of the widely used Neo23x0 “Best Practice” auditd ruleset. You choose how Reef uses it:

• Report only (default). With REEF_AUDIT_MANAGE=false, the scan reports which rule groups are missing and how to load them. Reef makes no changes to the host.
• Managed. With REEF_AUDIT_MANAGE=true, the agent loads Reef’s ruleset onto the host during every Auditd scan. The rules stay active until the next reboot. To keep them after a reboot, add - "/etc/audit:/host/etc/audit:rw" to the agent’s volumes in docker-compose.yml. Reef then saves the rules to /etc/audit/rules.d/reef.rules.

To customize the ruleset, edit audit.rules and restart the web and worker containers.

Options