Splunk Technology Add-on
TA-baseline
Security posture
Free for personal use · commercial license required
Security
mokutil · getenforce · aa-status · bootctl
Why TA-baseline exists
Security posture is per-host and silently drifts. TA-baseline continuously verifies SecureBoot, kernel lockdown, module policy, MAC mode and auditd liveness, then alerts on deviation.
What it collects
- SecureBoot and lockdown state
- Module loading policy
- SELinux/AppArmor mode and auditd liveness
Runs on stock tools
No daemons, no agents, no exotic collectors - it shells out to well-known CLIs or reads sysfs, and parses the result into Splunk events.
External tools used: mokutil · getenforce · aa-status · bootctl.