Integration and Adaptation of Open-Source Monitoring Tools for Detecting Anomalous User Activity in Astra Linux Special Edition

Objective. Development and evaluation of a method for integrating open-source monitoring tools for detecting abnormal activity in Astra Linux Special Edition, taking into account the built-in protection mechanisms. Method . Integration of Wazuh, OSSEC, Suricata and audit tools.d; adaptation of the rules to the specifics of Astra Linux; testing based on MITRE ATT&CK techniques; analysis according to GOST R 59548-2022 and NIST SP 800-92 standards. Result. A methodology for integrating and adapting open-source monitoring tools (Wazuh, Suricata, OSSEC) to detect abnormal user activity in the special-purpose operating system Astra Linux Special Edition. Adaptation of event correlation rules to the built-in OS protection mechanisms (mandatory control, Parsec audit) and integration with external threat analysis platforms (VirusTotal, URLhaus). Conclusion. This methodology ensures effective detection of abnormal activity in Astra Linux. Adaptation of open-source software enabled compliance with security requirements. The system demonstrates high accuracy with minimal false positives. It is recommended for organizations migrating to domestic special-purpose operating systems.