Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

[Deprecated] Microsoft Sysmon For Linux

View on GitHub ↗Original file ↗

Description

[Sysmon for Linux](https://github.com/Sysinternals/SysmonForLinux) provides detailed information about process creations, network connections and other system events. [Sysmon for linux link:]. The Sysmon for Linux connector uses [Syslog](https://aka.ms/sysLogInfo) as its data ingestion method. This solution depends on ASIM to work as expected. [Deploy ASIM](https://aka.ms/DeployASIM) to get the full value from the solution.
Declared status
1
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Syslog (Sysmon)

Declared permissions

write permission is required.
Workspace
Workspace

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

>This data connector depends on ASIM parsers based on a Kusto Functions to work as expected. [Deploy the parsers](https://aka.ms/ASimSysmonForLinuxARM) The following functions will be deployed: - vimFileEventLinuxSysmonFileCreated, vimFileEventLinuxSysmonFileDeleted - vimProcessCreateLinuxSysmon, vimProcessTerminateLinuxSysmon - vimNetworkSessionLinuxSysmon [Read more](https://aka.ms/AboutASIM)
1. Install and onboard the agent for Linux
Typically, you should install the agent on a different computer from the one on which the logs are generated. > Syslog logs are collected only from **Linux** agents.
Choose where to install the agent:
Install agent on Azure Linux Virtual Machine
Select the machine to install the agent on and then click **Connect**.
Install agent on a non-Azure Linux Machine
Download the agent on the relevant machine and follow the instructions.
2. Configure the logs to be collected
Configure the facilities you want to collect and their severities. 1. Under workspace advanced settings **Configuration**, select **Data** and then **Syslog**. 2. Select **Apply below configuration to my machines** and select the facilities and severities. 3. Click **Save**.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules11
Anomaly found in Network Session Traffic (ASIM Network Session schema)MediumDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumExcessive number of failed connections from a single source (ASIM Network Session schema)MediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighPort scan detected (ASIM Network Session schema)MediumPossible Phishing with CSL and Network SessionsMediumPotential beaconing activity (ASIM Network Session schema)LowTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)Medium
Solutions1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
MicrosoftSysmonForLinux
Additional source files 2Solutions/Microsoft Sysmon For Linux/Data Connectors/SysmonForLinux.jsonsource ↗Solutions/Microsoft Sysmon For Linux/Data/Solution_Linux.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.