feat: enabled auditd

2025-09-05 22:35:09 +01:00 · 2025-09-05 22:35:09 +01:00 · 1fa89834d0
commit 1fa89834d0
parent 0075fca986
1 changed files with 7 additions and 0 deletions
--- a/applications/itd/splunk/module.nix
+++ b/applications/itd/splunk/module.nix
@ -62,6 +62,13 @@ in {
       "a /home/*/.bash_history    - - - - u:splunk:r"
    ];

+    security.auditd = {
+        enable = true;
+        settings = {
+            log_group = cfg.user.group;
+        };
+    };
+
    # set up the core files
    systemd.services."${name}_prestart" = {
      wantedBy = [