← detection engineer

Linux & Cloud Telemetry — auditd, eBPF, CloudTrail, K8s Audit

beginner 4h

Read auditd rules, eBPF traces, and cloud audit logs across AWS, Azure, GCP, and Kubernetes; articulate telemetry trade-offs.

After this module you will

  • › Configure and interpret auditd rules on Linux
  • › Explain what eBPF tools (Falco, Tetragon) observe that auditd cannot
  • › Parse AWS CloudTrail management vs data events and multi-region trail design
  • › Navigate Azure Activity logs and GCP Audit Logs
  • › Identify suspicious sequences in Kubernetes audit logs

Lessons

1 Linux Primer — syslog, journald, and auditd
25 min
2 eBPF for Security — Falco, Tetragon, and What Syscalls Don't Show
25 min
3 AWS CloudTrail Anatomy — Management Events, Data Events, Multi-Region Trails
25 min
4 Azure Activity & Defender Logs, GCP Audit Logs
20 min
5 Kubernetes Audit Logs — verb, resource, user, sourceIPs
25 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →