diff --git a/auditd/server/ciscat.yml b/auditd/server/ciscat.yml
new file mode 100644
index 0000000..dc4baa7
--- /dev/null
+++ b/auditd/server/ciscat.yml
@@ -0,0 +1,3 @@
+classes:
+- service.auditd.server
+- service.auditd.rules.ciscat