Edit

Microsoft Sysmon For Linux connector for Microsoft Sentinel

  • Article

Sysmon for Linux provides detailed information about process creations, network connections and other system events. [Sysmon for linux link:]. The Sysmon for Linux connector uses Syslog as its data ingestion method. This solution depends on ASIM to work as expected. Deploy ASIM to get the full value from the solution.

Connector attributes

Connector attribute Description
Log Analytics table(s) Syslog (Sysmon)
Data collection rules support Workspace transform DCR
Supported by Microsoft Corporation

Query samples

Top 10 Events by ActingProcessName

vimProcessCreateLinuxSysmon
         
| summarize count() by ActingProcessName
          
| top 10 by count_

Vendor installation instructions

This data connector depends on ASIM parsers based on a Kusto Functions to work as expected. Deploy the parsers

The following functions will be deployed:

  • vimFileEventLinuxSysmonFileCreated, vimFileEventLinuxSysmonFileDeleted

  • vimProcessCreateLinuxSysmon, vimProcessTerminateLinuxSysmon

  • vimNetworkSessionLinuxSysmon

Read more

  1. Install and onboard the agent for Linux

Typically, you should install the agent on a different computer from the one on which the logs are generated.

Syslog logs are collected only from Linux agents.

  1. Configure the logs to be collected

Configure the facilities you want to collect and their severities.

  1. Under workspace advanced settings Configuration, select Data and then Syslog.
  2. Select Apply below configuration to my machines and select the facilities and severities.
  3. Click Save.

Next steps

For more information, go to the related solution in the Azure Marketplace.