Glossary: Logs and Data Sources for Investigations

auditctl

The Linux command that adds rules to the audit system. Alex used it to watch reads of /srv/shop/exports/customers.csv: -w names the file, -p r records reads and -k tags each record with a key.