diff --git a/data_sources/Linux_Auditd_Add_User.yml b/data_sources/Linux_Auditd_Add_User.yml
new file mode 100644
index 0000000000..44e7291a71
--- /dev/null
+++ b/data_sources/Linux_Auditd_Add_User.yml
@@ -0,0 +1,32 @@
+name: Linux Auditd Add User
+id: 5a25984a-2789-400a-858b-d75c923e06b1
+version: 1
+date: '2024-08-08'
+author: Teoderick Contreras, Splunk
+description: Data source object for Linux Auditd Add User Type
+source: /var/log/audit/audit.log
+sourcetype: linux:audit
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
+fields:
+- msg
+- type
+- pid
+- uid
+- auid
+- ses
+- subj
+- msg
+- op
+- id
+- exe
+- hostname
+- addr
+- terminal
+- res
+- UID
+- AUID
+- ID
+example_logs: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"'
\ No newline at end of file
diff --git a/data_sources/Linux_Auditd_Execve.yml b/data_sources/Linux_Auditd_Execve.yml
new file mode 100644
index 0000000000..667c1d03cc
--- /dev/null
+++ b/data_sources/Linux_Auditd_Execve.yml
@@ -0,0 +1,18 @@
+name: Linux Auditd Execve
+id: 9ef6364d-cc67-480e-8448-3306829a6a24
+version: 1
+date: '2024-08-08'
+author: Teoderick Contreras, Splunk
+description: Data source object for Linux Auditd Execve Type
+source: /var/log/audit/audit.log
+sourcetype: linux:audit
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
+fields:
+- msg
+- type
+- msg
+- argc
+example_logs: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so" a2="./prog"'
\ No newline at end of file
diff --git a/data_sources/Linux_Auditd_Path.yml b/data_sources/Linux_Auditd_Path.yml
new file mode 100644
index 0000000000..54d4a987aa
--- /dev/null
+++ b/data_sources/Linux_Auditd_Path.yml
@@ -0,0 +1,32 @@
+name: Linux Auditd Path
+id: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d
+version: 1
+date: '2024-08-08'
+author: Teoderick Contreras, Splunk
+description: Data source object for Linux Auditd Path Type
+source: /var/log/audit/audit.log
+sourcetype: linux:audit
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
+fields:
+- msg
+- type
+- item
+- name
+- inode
+- dev
+- mode
+- ouid
+- ogid
+- rdev
+- nametype
+- cap_fp
+- cap_fi
+- cap_fe
+- cap_fver
+- cap_frootid
+- OUID
+- OGID
+example_logs: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"'
\ No newline at end of file
diff --git a/data_sources/Linux_Auditd_Proctitle.yml b/data_sources/Linux_Auditd_Proctitle.yml
new file mode 100644
index 0000000000..c83e782bbe
--- /dev/null
+++ b/data_sources/Linux_Auditd_Proctitle.yml
@@ -0,0 +1,17 @@
+name: Linux Auditd Proctitle
+id: 5a25984a-2789-400a-858b-d75c923e06b1
+version: 1
+date: '2024-08-08'
+author: Teoderick Contreras, Splunk
+description: Data source object for Linux Auditd Proctitle Type
+source: /var/log/audit/audit.log
+sourcetype: linux:audit
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
+fields:
+- proctitle
+- msg
+- type
+example_logs: 'type=PROCTITLE msg=audit(1722944427.844:4146): proctitle=63686D6F640037373700312E7368'
\ No newline at end of file
diff --git a/data_sources/Linux_Auditd_Service_Stop.yml b/data_sources/Linux_Auditd_Service_Stop.yml
new file mode 100644
index 0000000000..497dca82ef
--- /dev/null
+++ b/data_sources/Linux_Auditd_Service_Stop.yml
@@ -0,0 +1,30 @@
+name: Linux Auditd Service Stop
+id: 5a25984a-2789-400a-858b-d75c923e06b1
+version: 1
+date: '2024-08-08'
+author: Teoderick Contreras, Splunk
+description: Data source object for Linux Auditd Service Stop Type
+source: /var/log/audit/audit.log
+sourcetype: linux:audit
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
+fields:
+- msg
+- type
+- pid
+- uid
+- auid
+- ses
+- subj
+- msg
+- comm
+- exe
+- hostname
+- addr
+- terminal
+- res
+- UID
+- AUID
+example_logs: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"'
\ No newline at end of file
diff --git a/data_sources/Linux_Auditd_Syscall.yml b/data_sources/Linux_Auditd_Syscall.yml
new file mode 100644
index 0000000000..389b6153e6
--- /dev/null
+++ b/data_sources/Linux_Auditd_Syscall.yml
@@ -0,0 +1,53 @@
+name: Linux Auditd Syscall
+id: 4dff7047-0d43-4096-bb3f-b756c889bbad
+version: 1
+date: '2024-08-08'
+author: Teoderick Contreras, Splunk
+description: Data source object for Linux Auditd Syscall Type
+source: /var/log/audit/audit.log
+sourcetype: linux:audit
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
+fields:
+- msg
+- type
+- msg
+- arch
+- syscall
+- success
+- exit
+- a1
+- a2 
+- a3
+- items
+- ppid
+- pid
+- auid
+- uid
+- gid
+- euid
+- suid
+- fsuid
+- egid
+- sgid
+- fsgid
+- tty
+- ses
+- comm
+- exe
+- subj
+- key
+- ARCH
+- SYSCALL
+- AUID
+- UID
+- GID
+- EUID
+- SUID
+- FSUID
+- EGID
+- SGID
+- FSGID
+example_logs: 'type=SYSCALL msg=audit(1723035666.627:3663): arch=c000003e syscall=59 success=yes exit=0 a0=556a6d697a58 a1=556a6d68ad00 a2=556a6d69c980 a3=0 items=2 ppid=1300 pid=1301 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="lsmod" exe="/usr/bin/kmod" subj=unconfined key="rootcmd" ARCH=x86_64 SYSCALL=execve AUID="ubuntu" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"'
\ No newline at end of file