Hello,
I wanted to bring something up. Currently, we have the ability to add a custom
"tag" or key to filesystem auditing rules. I got to thinking that this should
also be done for syscall auditing. This way, admins can set a rule with a
custom key and search for it later. (I have to write the search code.)
Besides being useful, I think this should be done for symmetry between
syscall & filesystem auditing as well.
-Steve