Monitoring Linux system calls

System call monitoring provides visibility into interactions between user-space applications and the Linux kernel. By monitoring system calls, organizations can detect security-relevant activities such as process execution, file access, privilege escalation, authentication events, and changes to system configuration.

On Linux systems, Wazuh integrates with the Linux Audit framework (Auditd) to collect system call events generated by the operating system. The Wazuh agent forwards these events to the Wazuh manager, where they are decoded, normalized, and evaluated against built-in detection rules in the Wazuh indexer. During event processing, Wazuh uses Key-Value Databases (KVDBs) to enrich and normalize audit events before applying detection logic.

Wazuh includes a comprehensive set of built-in detection rules for Linux Audit events. These rules detect suspicious activities such as authentication anomalies, privilege escalation attempts, abnormal process termination, changes to user accounts, audit subsystem tampering, SELinux policy events, and other security-relevant behaviors. Where applicable, detections include MITRE ATT&CK mappings and compliance mappings to help analysts investigate alerts and meet regulatory requirements.

System call monitoring enables organizations to:

• Monitor authentication and user account activity.

• Detect privilege escalation attempts and changes to user privileges.

• Identify process execution and termination.

• Monitor access to sensitive files and directories.

• Detect modifications to the Linux Audit configuration.

• Monitor SELinux security events.

• Detect suspicious network interface activity, such as enabling promiscuous mode.

• Support threat detection, incident investigation, and compliance reporting.