Part 2: Threat Detection Engineering and Incident Response with AuditD and Sentinel — Combine Events by ID with Laurel before sending to Sentinel as JSON.

Continuing our build out, we now switch over to combining our AuditD logs with Laurel to build better detections by having all our information combined in one log event entry.

[https://medium.com/@truvis.thornton/part-2-threat-detection-engineering-and-incident-response-with-auditd-and-sentinel-combine-a3384e1164e6](https://medium.com/@truvis.thornton/part-2-threat-detection-engineering-and-incident-response-with-auditd-and-sentinel-combine-a3384e1164e6)

auditd blueteamsec build detection detection engineering detections engineering entry event events incident incident response information json laurel log logs response sentinel switch threat threat detection threat detection engineering