Auditd

The auditd scan reports on two different things in one run: whether the kernel audit subsystem is configured the way Reef expects, and what’s actually happened since the last check.

• Tool — auditctl -s/-l for config, ausearch -i --checkpoint for events; raw output as json.
• The kernel audit subsystem is host-global, so auditctl/ausearch running in the privileged agent act directly on the host.

Config coverage

A couple things get checked:

• Is auditd running?
• Is Reef’s ruleset loaded (a per-key coverage diff against the shipped audit.rules)
• Is -e 2 set
• Has the kernel dropped events.

Events since the last checkpoint

Account/MAC/config changes, anomalies, sudo commands, brute-force attempts, and SYSCALL records classified by a unique key referenced against a MITRE ATT&CK-tagged table. High-volume keys are rolled up per (key, actor) rather than reported one-by-one.

The ruleset

Reef ships a modified version of the Neo23x0 “Best Practice” AuditD ruleset.

• Report only (default). REEF_AUDIT_MANAGE=false: the scan tells you which rule groups aren’t loaded and how to load them.
• Managed. REEF_AUDIT_MANAGE=true: the agent runs auditctl -R to load the ruleset into the running kernel on every auditd scan. To also persist it across reboots, add - "/etc/audit:/host/etc/audit:rw" to the agent service (it then writes /etc/audit/rules.d/reef.rules).

Edit audit.rules and restart the web and worker containers, since it’s bind-mounted, to change what the coverage diff expects.

Params

The checkpoint

The agent uses ausearch --checkpoint /var/lib/reef/audit.checkpoint (an agent-state volume) to resume exactly where the last scan left off — no double-counting and no gap on clock skew or a missed run. The first run pulls the last 10 minutes; a checkpoint left over from a previous boot is detected and reset automatically.