Detection And Response For Linux Without EDR

The speaker, who runs detection engineering for a logistics company's fleet of more than 10,000 Linux servers, starts from a practical problem: standard system logs miss most attacker activity, including web shells, reverse shells and rootkits. Raw Linux audit records are hard to use at scale because their values are hex-encoded and each event spans several lines, which makes them awkward for a SIEM to parse.

To address this, the team built Laurel, an open-source plugin that consumes audit output and merges each event into structured JSON lines. It adds process parent-child tracking, process labeling to reduce false positives in busy enterprise environments, and captures selected environment variables to spot user-space preload rootkits. The talk also covers why the team evaluated commercial EDR products and dropped them, citing Windows-oriented designs that mishandled Linux concepts such as numeric user IDs and non-Unicode filenames. For response, the team adopted Velociraptor to run live queries like process and network listings without relying on tools on the host that could be compromised.

The closing discussion covered performance, where the speaker said Laurel compared favorably with auditd and Sysmon for Linux in synthetic process-spawn tests. Questions also touched on eBPF, which the team has not adopted yet because of older kernels in long-support enterprise systems. The takeaway is that a well-configured audit subsystem, with its output structured and enriched properly, can deliver useful detection coverage without an EDR agent.