# Tags Linux application execution events.
application_execution
  data_type is 'bash:history:entry'
  data_type is 'docker:layer:configuration'
  data_type is 'fish:history:entry'
  data_type is 'selinux:line' AND (audit_type is 'EXECVE' OR audit_type is 'USER_CMD')
  data_type is 'shell:zsh:history'
  data_type is 'syslog:cron:task_run'
  reporter is 'sudo' AND message_body contains 'COMMAND='
  reporter is 'CROND' AND message_body contains 'CMD'

# Tags Linux log-in events.
login
  data_type is 'linux:utmp:event' AND login_type == 7
  data_type is 'selinux:line' AND audit_type is 'LOGIN'
  reporter is 'login' AND (message_body contains 'logged in' OR message_body contains 'ROOT LOGIN' OR message_body contains 'session opened')
  reporter is 'sshd' AND (message_body contains 'session opened' OR message_body contains 'Starting session')
  reporter is 'dovecot' AND message_body contains 'imap-login: Login:'
  reporter is 'postfix/submission/smtpd' AND message_body contains 'sasl_'

# Tags Linux failed log-in events.
login_failed
  data_type is 'selinux:line' AND audit_type is 'ANOM_LOGIN_FAILURES'
  data_type is 'selinux:line' AND audit_type is 'USER_LOGIN' AND message_body contains 'res=failed'
  data_type is 'syslog:line' AND message_body contains 'pam_tally2'
  (reporter is 'sshd' OR reporter is 'login' OR reporter is 'postfix/submission/smtpd' OR reporter is 'sudo') AND message_body contains 'uthentication fail'
  reporter is 'sshd' AND (message_body contains 'Access denied for user' OR message_body contains 'not allowed because')
  (reporter is 'xscreensaver' or reporter is 'login') AND message_body contains 'FAILED LOGIN'
  reporter is 'su' and message_body contains 'DENIED'
  reporter is 'nologin'

# User added.
useradd
  reporter is 'useradd' AND message_body contains 'new user'
  data_type is 'selinux:line' AND audit_type is 'ADD_USER'

# Group added.
groupadd
  reporter is 'useradd' AND message_body contains 'new group'
  data_type is 'selinux:line' AND audit_type is 'ADD_GROUP'
  reporter is 'groupadd'

# User removed.
userdel
  reporter is 'userdel' AND message_body contains 'delete user'
  data_type is 'selinux:line' AND audit_type is 'DEL_USER'

# Group removed.
groupdel
  reporter is 'userdel' AND message_body contains 'removed group'
  data_type is 'selinux:line' AND audit_type is 'DEL_GROUP'
  reporter is 'groupdel'

# Netfilter chain modifications.
firewall_change
  data_type is 'selinux:line' AND audit_type is 'NETFILTER_CFG'

# Tags Linux log-out events.
logout
  # This will also flag dead gettys that init kills during shutdown/reboot (at least with SysV init)
  data_type is 'linux:utmp:event' AND login_type == 8 AND terminal != '' AND pid != 0
  reporter is 'login' AND message_body contains 'session closed'
  reporter is 'sshd' AND (message_body contains 'session closed' OR message_body contains 'Close session')
  reporter is 'systemd-logind' AND message_body contains 'logged out'
  reporter is 'dovecot' AND message_body contains 'Logged out'
  data_type is 'selinux:line' AND audit_type is 'USER_LOGOUT'

# Tags Linux user session start events.
session_start
  reporter is 'systemd-logind' AND message_body contains 'New session'

# Tags Linux user session stop events.
session_stop
  reporter is 'systemd-logind' AND message_body contains 'Removed session'

# Tags Linux system boot events.
boot
  data_type is 'linux:utmp:event' AND login_type == 2 AND terminal is 'system boot' AND username is 'reboot'
  data_type is 'selinux:line' AND audit_type is 'SYSTEM_BOOT'

# Tags Linux system shutdown events.
shutdown
  data_type is 'linux:utmp:event' AND login_type == 1 AND (terminal is '~~' OR terminal is 'system boot') AND username is 'shutdown'
  data_type is 'selinux:line' AND audit_type is 'SYSTEM_SHUTDOWN'

# Tags Linux system run level change events.
runlevel
  data_type is 'linux:utmp:event' AND login_type == 1 AND username is 'runlevel'
  data_type is 'selinux:line' AND audit_type is 'SYSTEM_RUNLEVEL'

# Tags Linux device connection events.
device_connection
  reporter is 'kernel' AND message_body contains 'New USB device found'

# Tags Linux device disconnection events.
device_disconnection
  reporter is 'kernel' AND message_body contains 'USB disconnect'

# Tags Linux application installation events.
application_install
  data_type is 'linux:dpkg_log:entry' AND message_body contains 'status installed'

# Tags Linux service start events.
service_start
  data_type is 'selinux:line' AND audit_type is 'SERVICE_START'

# Tags Linux service stop events.
service_stop
  data_type is 'selinux:line' AND audit_type is 'SERVICE_STOP'

# Tags Linux network promiscious mode change events.
promiscuous
  data_type is 'selinux:line' AND audit_type is 'ANOM_PROMISCUOUS'
  reporter is 'kernel' AND message_body contains 'promiscuous mode'

# Tags Linux system crash events.
crash
  data_type is 'selinux:line' AND audit_type is 'ANOM_ABEND'
  reporter is 'kernel' AND message_body contains 'segfault'
