Forum Discussion

bluelogik's avatar
bluelogik
Copper Contributor
May 18, 2020

Azure Sentinel integrate with Linux logs

Hello everyone, I would like to see if there is a way to query "Event Log Cleared" on Linux system(s), in particular, what the events look like when/after being cleared? For example, for Windows, it...
Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Jun 10, 2020

bluelogik : logs are stored in files in Linux and I believe the "1102" for Linux would be a file delete event for those files (usually in /var/log). How to monitor file activity events in Linux is a large topic and would depend on your Linux distro. A good starting point is this.

Resources