Hi, May I know if we can configure the Audit command to perform whitelist of command.
eg: Block all command excepts allow a few commands (Exit, ls, cd, mkdir)
Kindly advise.
Hi Kevin Tan Hh,
We are validating this internally and will get back to you with an answer soon.
Best regards.
Hello Kevin Tan Hh,
Yes, it is possible to configure the Audit command to execute a list of commands that have been allowed to run. As described in the documentation, the administrator can register several rules with different types of actions.
When commands are registered with the Force action, only the commands in this list can be executed, and all others will be blocked. However, if a command is configured with the Force action, but is also registered with the Block or Interrupt action, it will not be executed.
For more details on this configuration, please refer to the official documentation at the following link: About Actions triggered by executing audited commands.
If you have any further questions, we are at your disposal.
Best regards.