Add note about EOE records

threathunters-io · Oct 15, 2021 · 7e0b0f5 · 7e0b0f5
1 parent 41b6c7f
commit 7e0b0f5
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -24,6 +24,14 @@ Refer to [JSON-based log format](json-format.md) for a description of the log fo
 
 We developed this tool because we were not content with feature sets and performance characteristics of existing projects and products. Please refer to [Performance](performance.md) for details.
 
+## A word about audit rules
+
+A good starting point for an audit ruleset is <https://github.com/Neo23x0/auditd>, but generally speaking, any ruleset will do. _LAUREL_ will currently not work properly if _End Of Event_ record are not suppressed, so rules like
+
+> `-a always,exclude -F msgtype=EOE`
+
+should be removed.
+
 ## Build from source…
 
 _LAUREL_ is written in Rust. To build it, a reasonably recent Rust compiler (we currently use 1.48), `cargo`, and the