<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Configuring Auditd Rules

## auditctl Commands

| Command | Description |
|---|---|
| `auditctl -l` | List active rules |
| `auditctl -s` | Show audit status (enabled, PID, lost events) |
| `auditctl -w /path -p rwxa -k key` | Add file watch rule |
| `auditctl -a always,exit -S syscall -k key` | Add syscall rule |
| `auditctl -D` | Delete all rules |
| `augenrules --load` | Load rules from /etc/audit/rules.d/ |

## ausearch Commands

| Command | Description |
|---|---|
| `ausearch -k keyname -i` | Search by key (interpreted) |
| `ausearch -m EXECVE -i` | Search by message type |
| `ausearch -ua 1000 -i` | Search by user ID |
| `ausearch -f /etc/shadow -i` | Search by file path |
| `ausearch --success no -i` | Failed syscalls only |

## aureport Commands

| Command | Description |
|---|---|
| `aureport --summary` | Overall summary |
| `aureport --auth --summary` | Authentication summary |
| `aureport --login --summary` | Login summary |
| `aureport --file --summary` | File access summary |
| `aureport --executable --summary` | Executable summary |

## Agent Script

```bash
# List rule templates
node agent.js list

# Generate rules for categories
node agent.js generate --categories identity cron ssh priv_esc --immutable

# Check auditd status
node agent.js status

# Search audit events
node agent.js search --key identity --start today
```
