Skip to main content

Linux Events Collection

Linux is an operating system for servers, desktops, cloud, and IoTs

Linux Events Collection

This pack includes XSIAM content.

Collect Events from Vendor

In order to use the collector, you can use one of the following options to collect events from the vendor:

In either option, you will need to configure the vendor and product for this specific collector.

Broker VM

You will need to use the information described here.\
You can configure the specific vendor and product for this instance.

  1. Navigate to Settings -> Configuration -> Data Broker -> Broker VMs.
  2. Right-click, and select Syslog Collector -> Configure.
  3. When configuring the Syslog Collector, set:
    • vendor as linux
    • product as linux
  • Pay attention: Timestamp parsing is configured for mmm dd HH:MM:SS format in UTC timezone.
    This can be done by running the following command on the relevant Linux server:
    sudo timedatectl set-timezone UTC

XDRC (XDR Collector)

You will need to use the information described here.\
You can configure the vendor and product by replacing [vendor]_[product]_raw with linux_linux_raw
When configuring an XDR collector profile, you should use a yml that will be used, among other things, to configure the vendor and product. This example demonstrates how to set it, specifically for the Ubuntu Linux product:

- type: filestream
  enabled: true
    - /var/log/syslog
    - /var/log/auth.log
    - /var/log/messages
    - /var/log/secure
    - add_fields:
          vendor: linux
          product: linux

Please note: The above configuration uses the default location of the logs. In case your linux saves the logs under a different location, you would need to change it in the yaml (under the paths field).




Cortex XSIAM


CertificationRead more
Supported ByCortex
CreatedJune 10, 2022
Last ReleaseJanuary 16, 2024

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.