An XCCDF Rule
auditd
augenrules
.rules
/etc/audit/rules.d
-w -p wa -k logins
auditctl
/etc/audit/audit.rules