Azure Security Center can detect cyber attacks in Linux using auditd

Azure Security Center is able to detect suspicious processes, login attempts, and other activities that indicate a Linux server is under attack or has been breached. This is done using auditd with both cloud and on-premise servers.

https://azure.microsoft.com/en-gb/blog/azure-security-center-previews-new-threat-detections-for-linux/