v2.4.4 audit sources

Change-Id: I9315a7408817db51edf084fb4d27fbb492785084
Signed-off-by: Ashlee Young <ashlee@wildernessvoice.com>

1 files changed, 61 insertions, 0 deletions

diff --git a/framework/src/audit/audisp/plugins/prelude/audisp-prelude.conf b/framework/src/audit/audisp/plugins/prelude/audisp-prelude.conf
new file mode 100644
index 00000000..ae499a86
--- /dev/null
+++ b/framework/src/audit/audisp/plugins/prelude/audisp-prelude.conf
@@ -0,0 +1,61 @@
+#
+# This file controls the configuration of the audit based 
+# intrusion detection system, audisp-prelude.
+#
+
+profile = auditd
+
+detect_avc = yes
+avc_action = idmef
+
+detect_logins = yes
+login_action = idmef
+#login_acct_exceptions =
+
+detect_login_fail_max = yes
+login_fail_max_action = idmef
+#login_fail_max_acct_exceptions =
+
+detect_login_session_max = yes
+login_session_max_action = idmef
+#login_session_max_acct_exceptions =
+
+detect_login_location = yes
+login_location_action = idmef
+#login_location_acct_exceptions =
+
+detect_login_time = yes
+login_time_action = idmef
+#login_time_acct_exceptions =
+
+detect_abend = yes
+abend_action = idmef
+
+detect_promiscuous = yes
+promiscuous_action = idmef
+
+detect_mac_status = yes
+mac_status_action = idmef
+
+detect_group_auth = yes
+group_auth_action = idmef
+
+detect_watched_acct = yes
+watched_acct_action = idmef
+watched_accounts = 1-499
+
+detect_watched_syscall = yes
+watched_syscall_action = idmef
+
+detect_watched_file = yes
+watched_file_action = idmef
+
+detect_watched_exec = yes
+watched_exec_action = idmef
+
+detect_watched_mk_exe = yes
+watched_mk_exe_action = idmef
+
+detect_tty = no
+tty_action = idmef
+