velociraptor VS auditd

However, what you are trying to do has already been done. For collections look at velociraptor's offline collector https://github.com/Velocidex/velociraptor. For processing check out Log2Timeline (plaso) https://github.com/log2timeline/plaso.

https://github.com/Velocidex/velociraptor - purchased recently but still a great tool

Lastly, by using the “Linux Auditing System” the system administrator can investigate what happens in the system for the purpose of debugging or in case of a security incident. We can also use the “auditctl” utility get/add/delete rules as part of Linux's kernel audit system (https://linux.die.net/man/8/auditctl). Also, there are great examples for “audit.rules” in GitHub (one example is https://github.com/Neo23x0/auditd/blob/master/audit.rules).

2) There are many opensource solutions, and you hit on all the important ones. Think creativitly, and test all your controls. hit your boxes with Metaspoilt and atomic redteam. These tools will help you verify that you have the proper controls in place, and that you are able to detect attacks (successful, and failed). Run auditd with Florian Roth's rule set on your linux boxes (https://github.com/Neo23x0/auditd/blob/master/audit.rules ), and sysmon (https://github.com/olafhartong/sysmon-modular) on windows.

Linux: AuditD with customized configurations script for your environment

However, the auditd repo from Florian Roth is like a golden standard for auditd config.

Enabled auditd - with the rules from - https://github.com/Neo23x0/auditd

I don't think that the addon can do this for you. But, as a good start, check out Florian Roths auditd config (https://github.com/Neo23x0/auditd).