In the /usr/share/doc/audit-version_number/ directory of your CentOS machine, you'll see some premade rule sets for different scenarios. Once you install auditd on Ubuntu, you'll have audit rules for it too, but the location is different for Ubuntu 16.04 and Ubuntu 17.10.  On Ubuntu 16.04, the rules are in the /usr/share/doc/auditd/examples/ directory. On Ubuntu 17.10, they're in the /usr/share/doc/auditd/examples/rules/ directory. In any case, some of the rule sets are common among all three of these distros. Let's look on the CentOS machine to see what we have there:

[donnie@localhost rules]$ pwd
/usr/share/doc/audit-2.7.6/rules
[donnie@localhost rules]$ ls -l
total 96
-rw-r--r--. 1 root root  163 Aug  4 17:29 10-base-config.rules
-rw-r--r--. 1 root root  284 Apr 19  2017 10-no-audit.rules
-rw-r--r--. 1 root root   93 Apr 19  2017 11-loginuid.rules
-rw-r--r--. 1 root root  329 Apr 19  2017 12-cont-fail.rules
-rw-r--r--. 1 root root  323 Apr 19  2017 12-ignore-error.rules
-rw-r--r--. 1 root root  516 Apr 19  2017 20-dont-audit.rules
-rw-r--r--. 1 root root  273 Apr 19  2017 21-no32bit.rules
-rw-r--r--. 1 root root  252 Apr 19  2017 22-ignore-chrony.rules
-rw-r--r--. 1 root root 4915 Apr 19  2017 30-nispom.rules
-rw-r--r--. 1 root root 5952 Apr 19  2017 30-pci-dss-v31.rules
-rw-r--r--. 1 root root 6663 Apr 19  2017 30-stig.rules
-rw-r--r--. 1 root root 1498 Apr 19  2017 31-privileged.rules
-rw-r--r--. 1 root root  218 Apr 19  2017 32-power-abuse.rules
-rw-r--r--. 1 root root  156 Apr 19  2017 40-local.rules
-rw-r--r--. 1 root root  439 Apr 19  2017 41-containers.rules
-rw-r--r--. 1 root root  672 Apr 19  2017 42-injection.rules
-rw-r--r--. 1 root root  424 Apr 19  2017 43-module-load.rules
-rw-r--r--. 1 root root  326 Apr 19  2017 70-einval.rules
-rw-r--r--. 1 root root  151 Apr 19  2017 71-networking.rules
-rw-r--r--. 1 root root   86 Apr 19  2017 99-finalize.rules
-rw-r--r--. 1 root root 1202 Apr 19  2017 README-rules
[donnie@localhost rules]$

The three files I want to focus on are the nispom, pci-dss, and stig files. Each of these three rule sets is designed to meet the auditing standards of a particular certifying agency. In order, these rules sets are:

• nispom: The National Industrial Security Program—you'll see this rule set used at either the U.S. Department of Defense or its contractors
• pci-dss: Payment Card Industry Data Security Standard—if you work in the banking or financial industries, or even if you're just running an online business that accepts credit cards, you'll likely become very familiar with this
• stig: Security Technical Implementation Guides—if you work for the U.S. Government or possibly other governments, you'll be dealing with this one

To use one of these rules sets, copy the appropriate files over to the /etc/audit/rules.d/ directory:

[donnie@localhost rules]$ sudo cp 30-pci-dss-v31.rules /etc/audit/rules.d
[donnie@localhost rules]$

Then, restart the auditd daemon to read in the new rules.

For Red Hat or CentOS:

sudo service auditd restart

For Ubuntu:

sudo systemctl restart auditd

Of course, there's always the chance that a particular rule in one of these sets might not work for you or that you might need to enable a rule that's currently disabled. If so, just open the rules file in your text editor, and comment out what doesn't work or uncomment what you need to enable.

Even though auditd is very cool, bear in mind that it only alerts you about potential security breaches. It doesn't do anything to harden the system against them. 

That pretty much wraps it up for our discussion of the auditd system. Give it a go and see what you think.