From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Smith, Gary R" Subject: BSides Portland - The Linux Audit Framework Date: Thu, 22 Oct 2015 15:53:22 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5000976228961573805==" Return-path: Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.31]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t9MFrS35008767 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 22 Oct 2015 11:53:28 -0400 Received: from Emailgw01.pnnl.gov (emailgw01.pnnl.gov [192.101.109.61]) by mx1.redhat.com (Postfix) with ESMTPS id 7F5A4C0A5165 for ; Thu, 22 Oct 2015 15:53:26 +0000 (UTC) Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============5000976228961573805== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_D24E54819F53garysmithpnnlgov_" --_000_D24E54819F53garysmithpnnlgov_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hello All, I was at the BSides Portland security conference last weekend and I gave a = presentation called =93The Linux Audit Framework=94 there. I have put up th= e slides from the presentation on slideshare. I have also put up a file tha= t implements the Center for Internet Security RHEL 6 Benchmark for audit ru= les. In addition, I have put up a document that is =93Smith=92s Audit Cheat= Sheet=94. It is what audit commands to run by analysts during first, secon= d and third shift. The presentation slides are at: http://www.slideshare.net/GarySmith99/the-l= inux-audit-framework The CIS audit rules are at: http://www.slideshare.net/GarySmith99/linux-aud= itrules The =93Cheat Sheet=94 are at: http://www.slideshare.net/GarySmith99/audit-c= ommands-by-shift I hope you find them useful. Best regards, Gary Smith --_000_D24E54819F53garysmithpnnlgov_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable
Hello All,

I was at the BSides Portland security conference last weekend and I ga= ve a presentation called =93The Linux Audit Framework=94 there. I have put = up the slides from the presentation on slideshare. I have also put up a fil= e that implements the Center for Internet Security RHEL 6 Benchmark for audit rules. In addition, I have put up a do= cument that is =93Smith=92s Audit Cheat Sheet=94. It is what audit commands= to run by analysts during first, second and third shift.


I hope you find them useful.

Best regards,

Gary Smith

--_000_D24E54819F53garysmithpnnlgov_-- --===============5000976228961573805== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============5000976228961573805==--