Auditd

<note warning>root</note>

Prérequis

apt-get install -y apt-transport-https dirmngr #openjdk-8-jdk

Installation Auditd

apt-get install -y auditd audispd-plugins

Configuration des règles

# TODO

# Lynis ?

Installation ElasticSearch

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-7.x.list apt-get update apt-get install elasticsearch

Démarrage auto /bin/systemctl daemon-reload /bin/systemctl enable elasticsearch.service