Forum Discussion
Solved
MDE for Linux and audit logs
Just confirming that MDE for Linux will ingest events from the audit logs based on the following statement from Microsoft's documentation:
System events captured by rules added to /etc/audit/rules.d/ will add to audit.log...We need to monitor file access and our Linux admin has configured the audit rules to record that information and with that, I just want to verify that the MDE for Linux agent will ingest those events.
Thx
- You are correct. MDE for Linux leverages and configures auditd rules on the device for the purpose of providing EPP & EDR functionality. Thank you!
4 Replies
- Daniel Simpson
Microsoft
You are correct. MDE for Linux leverages and configures auditd rules on the device for the purpose of providing EPP & EDR functionality. Thank you!- TYVM for the reply
- Daniel SimpsonHi Jeff. Let me follow up on that for you. Should have an answer soon.
- TYVM!
