Best practice configuration for Linux auditd for CIS and STIG standards, enhanced with LOTL detection rules.