This commit is contained in:
MatiG
2021-03-02 08:42:50 +02:00
parent cc84a032d2
commit 964c0b5ff7

View File

@ -68,7 +68,7 @@ Microsoft Defender for Endpoint utilized `audit` framework from linux to track n
service auditd start
```
**On SLES 12 and 15** systems, SYSCALL auditing in `auditd` is disabled by default and can explain missing events.
**On SLES** systems, SYSCALL auditing in `auditd` might be disabled by default and can be accounted for missing events.
1. To validate that SYSCALL auditing is not disabeld, list the current audit rules: