Lion Cipher Lab
Build a daily auditd report with aureport and a Python summary
- Cyber / Security Engineer
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The Linux audit daemon (auditd) is the kernel-level record of who did what on a system — every login, every privileged command, every touch of a file you chose to watch. It is one of the most trusted sources of truth in an incident, which is exactly why so many teams turn it on, generate gigabytes of it, and then never look at it: raw auditd output is a firehose of multi-line records that is unreadable by eye, so it silently becomes write-only. A log nobody reads catches nothing. The skill that makes auditd actually defend a system is the boring, high-value one this lab teaches: turning a day…
What you'll learn
- reading auditd logs with aureport and ausearch
- the auditd record format (type=, key=, res=)
- writing a Python log summarizer with stdlib only
- surfacing failed authentications and identity changes
- using audit rule keys to make a log searchable
- turning a noisy log into a short daily triage report
- scheduling a report and alerting on the signal
Steps in this lab
- Make sure auditd is running and watching something
- Read the native summary with aureport
- Pull a day of records with ausearch
- Write the Python summarizer
- Run it and read the report
- Schedule it, and alert only on the signal