diff --git a/datasets/emerging_threats/php2shell/audit.log b/datasets/emerging_threats/php2shell/audit.log
new file mode 100644
index 00000000..9e570639
--- /dev/null
+++ b/datasets/emerging_threats/php2shell/audit.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f62743727283a3e9859d7b38ff1882e06d88e56d1619dc73e60fc041a30cdf3c
+size 4625
diff --git a/datasets/emerging_threats/php2shell/php2shell.yml b/datasets/emerging_threats/php2shell/php2shell.yml
index ab2f4c90..dcaad36e 100644
--- a/datasets/emerging_threats/php2shell/php2shell.yml
+++ b/datasets/emerging_threats/php2shell/php2shell.yml
@@ -52,3 +52,7 @@ datasets:
   path: /datasets/emerging_threats/php2shell/apache_segfault_error.log
   sourcetype: apache:error
   source: /var/log/apache2/error.log
+- name: audit
+  path: /datasets/emerging_threats/php2shell/audit.log
+  sourcetype: auditd
+  source: auditd