OVALFileLinker from SCAP Security Guide ssg: [0, 1, 80], python: 3.10.12 5.11.2 2025-11-23T12:44:14 Record Any Attempts to Run apparmor_parser Ubuntu 22.04 Audit rules about the information on the use of apparmor_parser is enabled. Test if auditctl is in use for audit rules Ubuntu 22.04 Test if auditctl is in use for audit rules. Test if augenrules is enabled for audit rules Ubuntu 22.04 Test if augenrules is enabled for audit rules. ^/etc/audit/rules\.d/.*\.rules$ ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/sbin\/apparmor_parser(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ 1 /etc/audit/audit.rules ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/sbin\/apparmor_parser(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ 1 /usr/lib/systemd/system/auditd.service ^ExecStartPost=\-\/sbin\/auditctl.*$ 1 /usr/lib/systemd/system/auditd.service ^(ExecStartPost=\-\/sbin\/augenrules.*$|Requires=augenrules.service) 1