On Linux nodes
# Install and enable auditd
zypper install -y audit || dnf install -y audit || apt-get update && apt-get install -y auditd audispd-plugins
systemctl enable --now auditd
# Add monitoring rules
cat > /etc/audit/rules.d/50-file-monitoring.rules <<'EOF'
-w /etc/ssl/ -p wa -k etc_ssl_changes
-w /etc/passwd -p wa -k etc_passwd_changes
EOF
# Load rules
augenrules --load
auditctl -l
# Verify events
ausearch -k etc_ssl_changes -i
ausearch -k etc_passwd_changes -i