anom messages

[Steve Grubb]

Hello,

On Thursday, May 24, 2018 11:06:11 AM EDT Maupertuis Philippe wrote:
> The redhat security guide in annex B2 reads :
> All Audit event types prepended with ANOM are intended to be processed by
> an intrusion detection program. All Audit event types prepended with RESP
> are intended responses of an intrusion detection system in case it detects
> malicious activity on the system.
> 
> Can you point me towards an intrusion detection program able to manage
> these audit records.

It is in development but not ready to merge into the audit-userspace repo. 
This is why I added some more event types in this area a couple months ago. 
It is targeted for the audit-3.1 release along with a bunch of new audit 
rules to assist in its job. Audit 3.1 should be late summer or fall of this 
year.

-Steve