Detect when the Audit daemon starts

This use case demonstrates how Wazuh detects when the Linux Audit daemon (auditd) starts. Monitoring Audit daemon startup events helps administrators verify that the auditing service is running and provides visibility into service restarts that may occur during system maintenance or after an unexpected interruption.

Ubuntu endpoint

Perform the following actions to test the configuration:

1. Start the Audit daemon:

   # systemctl start auditd
   

2. Verify that the service has started:

   # systemctl status auditd
   

Navigate to Threat Intelligence > Threat Hunting > Findings on the Wazuh dashboard to view the generated finding: