Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Syslog via AMA

View on GitHub ↗Original file ↗

Description

Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to the workspace. [Learn more >](https://aka.ms/sysLogInfo)
Declared status
2
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Syslog

Declared permissions

read and write permissions.
Workspace data sources
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Enable data collection rule​
You can collect Syslog events from your local machine by installing the agent on it. You can also collect Syslog generated on a different source by running the installation script below on the local machine, where the agent is installed. > Syslog logs are collected only from **Linux** agents.
Run the following command to install and apply the Syslog collector:
> To collect logs generated on a different machine run this script on the machine where the agent is installed.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules217
Adding User or Group FailedLowApplication Group DeletedInformationalApplication Group Settings UpdatedInformationalArchive Repository DeletedHighArchive Repository Settings UpdatedLowAttempt to Delete Backup FailedHighAttempt to Update Security Object FailedHighBackup Proxy DeletedInformationalBackup Repository DeletedHighBackup Repository Settings UpdatedLowCisco WSA - Access to unwanted siteHighCisco WSA - Internet access from public IPMediumCisco WSA - Multiple attempts to download unwanted fileMediumCisco WSA - Multiple errors to resource from risky categoryMediumCisco WSA - Multiple errors to URLMediumCisco WSA - Multiple infected filesHighCisco WSA - Suspected protocol abuseMediumCisco WSA - Unexpected file typeMediumCisco WSA - Unexpected uploadsHighCisco WSA - Unexpected URLMediumCisco WSA - Unscannable file or scan errorMediumCiscoISE - Command executed with the highest privileges from new IPMediumCiscoISE - Attempt to delete local store logsMediumCiscoISE - Backup failedMediumCiscoISE - Certificate has expiredMediumCiscoISE - Command executed with the highest privileges by new userMediumCiscoISE - Device changed IP in last 24 hoursMediumCiscoISE - Device PostureStatus changed to non-compliantMediumCiscoISE - ISE administrator password has been resetMediumCiscoISE - Log collector was suspendedMediumCiscoISE - Log files deletedMediumClientDeniedAccessMediumCloud Gateway DeletedInformationalCloud Gateway Pool DeletedInformationalCloud Gateway Pool Settings UpdatedInformationalCloud Gateway Settings UpdatedInformationalCloud Replica Permanent Failover Performed by TenantHighConfiguration Backup Job FailedMediumConfiguration Backup Job Settings UpdatedInformationalConnection to Backup Repository LostHighCredential Record DeletedHighCredential Record UpdatedHighDetaching Backups StartedInformationalDigital Guardian - Bulk exfiltration to external domainMediumDigital Guardian - Exfiltration to external domainMediumDigital Guardian - Exfiltration to online fileshareHighDigital Guardian - Exfiltration to private emailHighDigital Guardian - Exfiltration using DNS protocolHighDigital Guardian - Incident with not blocked actionHighDigital Guardian - Multiple incidents from userHighDigital Guardian - Possible SMTP protocol abuseHighDigital Guardian - Sensitive data transfer over insecure channelMediumDigital Guardian - Unexpected protocolHighEncryption Password AddedInformationalEncryption Password ChangedHighEncryption Password DeletedHighExcessive Amount of Denied Connections from a Single SourceMediumExcessive Blocked Traffic Events Generated by UserMediumExcessive Denied Proxy TrafficLowExcessive Failed Authentication from Invalid InputsMediumExcessive NXDOMAIN DNS QueriesMediumExternal Repository DeletedHighExternal Repository Settings UpdatedInformationalFailed logon attempts in authprivMediumFailover Plan DeletedLowFailover Plan FailedLowFailover Plan Settings UpdatedInformationalFailover Plan StartedHighFailover Plan StoppedMediumFile Server DeletedHighFile Server Settings UpdatedInformationalFile Share DeletedHighFour-Eyes Authorization DisabledHighFour-Eyes Authorization Request CreatedHighFour-Eyes Authorization Request ExpiredMediumFour-Eyes Authorization Request RejectedInformationalGeneral Settings UpdatedInformationalGitLab - Abnormal number of repositories deletedMediumGitLab - Brute-force AttemptsMediumGitLab - External User Added to GitLabMediumGitLab - Local Auth - No MFAMediumGitLab - Personal Access Tokens creation over timeMediumGitLab - Repository visibility to PublicMediumGitLab - TI - Connection from Malicious IPMediumGitLab - User ImpersonationMediumGlobal Network Traffic Rules DeletedLowGlobal VM Exclusions AddedHighGlobal VM Exclusions ChangedHighGlobal VM Exclusions DeletedLowHost DeletedLowHost Settings UpdatedInformationalHypervisor Host DeletedInformationalHypervisor Host Settings UpdatedInformationalIllumio Enforcement Change Analytic RuleMediumIllumio Firewall Tampering Analytic RuleMediumIllumio VEN Clone Detection RuleHighIllumio VEN Deactivated Detection RuleHighIllumio VEN Offline Detection RuleHighIllumio VEN Suspend Detection RuleHighInvalid Code for Multi-Factor Authentication EnteredHighJob DeletedHighJob No Longer Used as Second DestinationHighKMS Key Rotation Job FinishedInformationalKMS Server DeletedHighKMS Server Settings UpdatedHighLicense ExpiredHighLicense ExpiringInformationalLicense Grace Period StartedHighLicense Limit ExceededMediumLicense RemovedHighLicense Support ExpiredHighLicense Support ExpiringLowMalware Activity DetectedHighMalware DetectedMediumMalware Detection Exclusions List UpdatedMediumMalware Detection Session FinishedInformationalMalware Detection Settings UpdatedHighMcAfee ePO - Agent Handler downMediumMcAfee ePO - Attempt uninstall McAfee agentMediumMcAfee ePO - Deployment failedHighMcAfee ePO - Error sending alertMediumMcAfee ePO - File added to exceptionsMediumMcAfee ePO - Firewall disabledMediumMcAfee ePO - Logging error occurredMediumMcAfee ePO - Multiple threats on same hostMediumMcAfee ePO - Scanning engine disabledLowMcAfee ePO - Spam Email detectedMediumMcAfee ePO - Task errorMediumMcAfee ePO - Threat was not blockedHighMcAfee ePO - Unable to clean or delete infected fileHighMcAfee ePO - Update failedMediumMulti-Factor Authentication DisabledHighMulti-Factor Authentication for User DisabledHighMulti-Factor Authentication Token RevokedMediumMulti-Factor Authentication User LockedHighNDMP Server DeletedInformationalNRT Squid proxy events related to mining poolsLowObject Marked as CleanInformationalObject Storage DeletedHighObject Storage Settings UpdatedLowObjects Added to Malware Detection ExclusionsHighObjects Deleted from Malware Detection ExclusionsInformationalObjects for Job DeletedHighObjects for Protection Group ChangedInformationalObjects for Protection Group DeletedHighOracleDBAudit - Connection to database from external IPMediumOracleDBAudit - Connection to database from unknown IPMediumOracleDBAudit - Multiple tables dropped in short timeMediumOracleDBAudit - New user accountLowOracleDBAudit - Query on Sensitive TableMediumOracleDBAudit - Shutdown ServerMediumOracleDBAudit - SQL injection patternsMediumOracleDBAudit - Unusual user activity on multiple tablesMediumOracleDBAudit - User activity after long inactivity timeMediumOracleDBAudit - User connected to database from new IPLowPort Scan DetectedMediumPotential DHCP Starvation AttackMediumPreferred Networks DeletedInformationalProtection Group DeletedHighProtection Group Settings UpdatedInformationalPulseConnectSecure - Large Number of Distinct Failed User LoginsMediumPulseConnectSecure - Potential Brute Force AttemptsLowRansomware Attack DetectedHighRansomware Client BlockedHighRecovery Token DeletedLowRestore Point Marked as CleanInformationalRestore Point Marked as InfectedHighScale-Out Backup Repository DeletedHighScale-Out Backup Repository Settings UpdatedLowService Provider DeletedInformationalService Provider UpdatedInformationalSFTP File transfer above thresholdMediumSFTP File transfer folder count above thresholdMediumSquid proxy events for ToR proxiesLowSquid proxy events related to mining poolsLowSSH - Potential Brute ForceLowSSH Credentials ChangedHighStorage DeletedHighStorage Settings UpdatedInformationalSubtenant DeletedHighSubtenant UpdatedInformationalSureBackup Job FailedHighTape Erase Job StartedHighTape Library DeletedInformationalTape Media Pool DeletedInformationalTape Media Vault DeletedInformationalTape Medium DeletedHighTape Server DeletedInformationalTenant Password ChangedHighTenant Quota ChangedInformationalTenant Quota DeletedInformationalTenant Replica StartedInformationalTenant Replica StoppedHighTenant State ChangedInformationalThreats detected by ESETLowUser Accessed Suspicious URL CategoriesMediumUser or Group AddedHighUser or Group DeletedHighVirtual Lab DeletedLowVirtual Lab Settings UpdatedLowVMware ESXi - Dormant VM startedMediumVMware ESXi - Low patch disk spaceMediumVMware ESXi - Low temp directory spaceMediumVMware ESXi - Multiple Failed Shell Login via SSHMediumVMware ESXi - Multiple new VMs startedMediumVMware ESXi - Multiple VMs stoppedMediumVMware ESXi - New VM startedMediumVMware ESXi - Root impersonationMediumVMware ESXi - Root loginHighVMware ESXi - Root password changedHighVMware ESXi - Shared or stolen root accountHighVMware ESXi - SSH Enable on ESXi HostHighVMware ESXi - Unexpected disk imageMediumVMware ESXi - VM stoppedMediumWAN Accelerator DeletedInformationalWAN Accelerator Settings UpdatedInformationalWebsite blocked by ESETLow
Solutions1
Workbooks6

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
SyslogAma
Additional source files 2Solutions/Syslog/Data Connectors/template_SyslogAma.jsonsource ↗Solutions/Syslog/Data/Solution_syslog.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.