# Ensure file deletion events by users are collected

Necessity: Monitoring file deletion events is crucial for security and system integrity. It provides a clear audit trail for who deleted or renamed files, which is essential for investigating unauthorized activity, tracking malicious actions (e.g., ransomware deleting files), or diagnosing accidental data loss. Without this logging, an attacker or rogue insider could remove critical system files or sensitive data, leaving administrators with no record of the event, severely hindering incident response and forensic analysis.

Auditing and Remediation: The audit script queries the live auditd rule set to verify that the specific rules for tracking file deletion syscalls are active. The remediation script ensures these rules are added to a persistent configuration file, guaranteeing that the system will monitor these actions even after a reboot. The rules are specified for both 32-bit and 64-bit architectures to ensure comprehensive coverage.

Recommended State Rationale: A state of 'Configured' is recommended for all levels (Basic, Moderate, Strict) because this is a foundational security control. There is no graduated scale for its implementation; it is either active or it is not. Its presence is mandated by security benchmarks like the CIS CentOS Linux Benchmark. The value of this control lies in its binary state of being enabled, providing an essential layer of accountability and visibility into system operations.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the active auditd rules using `auditctl -l`. The script must check for the presence of rules that monitor file deletion syscalls (`unlink`, `unlinkat`, `rename`, `renameat`) for both 32-bit and 64-bit architectures, specifically for user IDs (auid) of 1000 or greater. The script must output only the string 'Configured' if the required rules exist, and 'Not Configured' otherwise.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state (e.g., 'Configured'). If the argument is 'Configured', the script must add the following rules to a persistent auditd configuration file in `/etc/audit/rules.d/`: `-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=-1 -F key=delete` and `-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=-1 -F key=delete`. The script must return only `true` on success or `false` on failure.

