We leverage auditd to consume real time file creation and mutation events in supporting environments. This allows us to faster react to events on disk and for the vast majority of non-novel malware react in sub second time.

To manage installation of our auditd integration we leverage your OS' package manager, similar to the installation of the Monarx agent and Protect extensions. It requires you to first setup set up our repo and install our core application following these steps.

For example, RHEL based Operating Systems:

sudo yum install monarx-agent-auditd

Ubuntu / Debian:

sudo apt install monarx-agent-auditd