Blog Post

Microsoft Sentinel Blog
15 MIN READ

Ingesting Auditd (configured for PAM TTY Session Key Logging) into Azure Sentinel

RinUre's avatar
RinUre
Icon for Microsoft rankMicrosoft
Mar 19, 2020
  One of Azure Sentinel's key strength's is its ability to ingest data whether that data lives On-Prem or in the cloud. For this use-case, I will show you how incredibly easy it is to instal...
Updated Nov 02, 2021
Version 3.0
detection
investigation
microsoft sentinel
security
RinUre's avatar
Icon for Microsoft rankMicrosoft
Joined January 09, 2020
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is an industry-leading SIEM & AI-first platform powering agentic defense across the entire security ecosystem.

rurno's avatar
rurno
Copper Contributor
Jul 24, 2020

The github repo is no longer maintaned, but is continuing over at https://github.com/bfuzzy1/auditd-attack instead.

 

With auoms offered as well as an option to handle auditd logs in Linux, what is the preferred, "Microsoft", way to do it?

 

auoms requiring OMS is a bit of a no go in some scenarios, so this could be the best approach.