Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

Syslog via Legacy Agent

Voir sur GitHub ↗Fichier original ↗

Description

Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to the workspace. [Learn more >](https://aka.ms/sysLogInfo)
Statut déclaré
1
Auteur / éditeur déclaré
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

Syslog

Permissions déclarées

write permission is required.
Workspace
Workspace

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

1. Install and onboard the agent for Linux
You can collect Syslog events from your local machine by installing the agent on it. You can also collect Syslog generated on a different source by running the installation script below on the local machine, where the agent is installed. > Syslog logs are collected only from **Linux** agents.
Choose where to install the agent:
Install agent on Azure Linux Virtual Machine
Select the machine to install the agent on and then click **Connect**.
Install agent on a non-Azure Linux Machine
Download the agent on the relevant machine and follow the instructions.
2. Configure the logs to be collected
Configure the facilities you want to collect and their severities. 1. Select the link below to open your workspace **agents configuration**, and select the **Syslog** tab. 2. Select **Add facility** and choose from the drop-down list of facilities. Repeat for all the facilities you want to add. 3. Mark the check boxes for the desired severities for each facility. 4. Click **Apply**.

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques127
Adding User or Group FailedLowApplication Group DeletedInformationalApplication Group Settings UpdatedInformationalArchive Repository DeletedHighArchive Repository Settings UpdatedLowAttempt to Delete Backup FailedHighAttempt to Update Security Object FailedHighBackup Proxy DeletedInformationalBackup Repository DeletedHighBackup Repository Settings UpdatedLowCloud Gateway DeletedInformationalCloud Gateway Pool DeletedInformationalCloud Gateway Pool Settings UpdatedInformationalCloud Gateway Settings UpdatedInformationalCloud Replica Permanent Failover Performed by TenantHighConfiguration Backup Job FailedMediumConfiguration Backup Job Settings UpdatedInformationalConnection to Backup Repository LostHighCredential Record DeletedHighCredential Record UpdatedHighDetaching Backups StartedInformationalEncryption Password AddedInformationalEncryption Password ChangedHighEncryption Password DeletedHighExternal Repository DeletedHighExternal Repository Settings UpdatedInformationalFailed AzureAD logons but success logon to hostMediumFailed host logons but success logon to AzureADMediumFailed logon attempts in authprivMediumFailover Plan DeletedLowFailover Plan FailedLowFailover Plan Settings UpdatedInformationalFailover Plan StartedHighFailover Plan StoppedMediumFile Server DeletedHighFile Server Settings UpdatedInformationalFile Share DeletedHighFour-Eyes Authorization DisabledHighFour-Eyes Authorization Request CreatedHighFour-Eyes Authorization Request ExpiredMediumFour-Eyes Authorization Request RejectedInformationalGeneral Settings UpdatedInformationalGlobal Network Traffic Rules DeletedLowGlobal VM Exclusions AddedHighGlobal VM Exclusions ChangedHighGlobal VM Exclusions DeletedLowHost DeletedLowHost Settings UpdatedInformationalHypervisor Host DeletedInformationalHypervisor Host Settings UpdatedInformationalInfoblox - TI - Syslog Match Found - URLMediumInvalid Code for Multi-Factor Authentication EnteredHighJob DeletedHighJob No Longer Used as Second DestinationHighKMS Key Rotation Job FinishedInformationalKMS Server DeletedHighKMS Server Settings UpdatedHighLicense ExpiredHighLicense ExpiringInformationalLicense Grace Period StartedHighLicense Limit ExceededMediumLicense RemovedHighLicense Support ExpiredHighLicense Support ExpiringLowMalware Activity DetectedHighMalware Detection Exclusions List UpdatedMediumMalware Detection Session FinishedInformationalMalware Detection Settings UpdatedHighMulti-Factor Authentication DisabledHighMulti-Factor Authentication for User DisabledHighMulti-Factor Authentication Token RevokedMediumMulti-Factor Authentication User LockedHighMultiple Password Reset by userLowNDMP Server DeletedInformationalNRT Squid proxy events related to mining poolsLowObject Marked as CleanInformationalObject Storage DeletedHighObject Storage Settings UpdatedLowObjects Added to Malware Detection ExclusionsHighObjects Deleted from Malware Detection ExclusionsInformationalObjects for Job DeletedHighObjects for Protection Group ChangedInformationalObjects for Protection Group DeletedHighPreferred Networks DeletedInformationalPRODAFT USTA - TI map URL to SyslogMediumProtection Group DeletedHighProtection Group Settings UpdatedInformationalRecovery Token DeletedLowRestore Point Marked as CleanInformationalRestore Point Marked as InfectedHighScale-Out Backup Repository DeletedHighScale-Out Backup Repository Settings UpdatedLowService Provider DeletedInformationalService Provider UpdatedInformationalSFTP File transfer above thresholdMediumSFTP File transfer folder count above thresholdMediumSquid proxy events for ToR proxiesLowSquid proxy events related to mining poolsLowSSH - Potential Brute ForceLowSSH Credentials ChangedHighStorage DeletedHighStorage Settings UpdatedInformationalSubtenant DeletedHighSubtenant UpdatedInformationalSureBackup Job FailedHighTape Erase Job StartedHighTape Library DeletedInformationalTape Media Pool DeletedInformationalTape Media Vault DeletedInformationalTape Medium DeletedHighTape Server DeletedInformationalTenant Password ChangedHighTenant Quota ChangedInformationalTenant Quota DeletedInformationalTenant Replica StartedInformationalTenant Replica StoppedHighTenant State ChangedInformationalTI map Domain entity to SyslogMediumTI Map Domain entity to SyslogMediumTI Map URL Entity to Syslog DataMediumTI Map URL Entity to Syslog DataMediumUser or Group AddedHighUser or Group DeletedHighVirtual Lab DeletedLowVirtual Lab Settings UpdatedLowWAN Accelerator DeletedInformationalWAN Accelerator Settings UpdatedInformational
Solutions1
Workbooks6

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
Syslog
Autres fichiers source 2Solutions/Syslog/Data Connectors/template_Syslog.jsonsource ↗Solutions/Syslog/Data/Solution_syslog.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.