Re: CIS vs NIST

[Kevin Wilcox <wilcoxkm () APPSTATE EDU>]

On 30 April 2018 at 12:52, Valdis Kletnieks <valdis.kletnieks () vt edu> wrote:

> To the best of my knowledge, nobody's using the Linux kernel audit logs for
> near real time detection of events - it's of more use for forensic analysis of
> incidents and system/package testing.

I do. If a process is started by a user for the first time (or first
time for however long I have log data for that host), if previously
unused commands are kicked off, if commands with <x> name are started
from <y> path where it's never been seen, etc., all trigger alerts.
The same holds true for Windows process creation, powershell usage,
AppLocker stopping something (or if it would have stopped something),
etc.

kmw