Azure Sentinel integrate with Linux logs

[bluelogik]

Hello everyone,

I would like to see if there is a way to query "Event Log Cleared" on Linux system(s), in particular, what the events look like when/after being cleared? For example, for Windows, its EventID 1102, so I am curious to find out if there is something similar for Linux systems.

Thank you! 

[#2]

@bluelogik : logs are stored in files in Linux and I believe the "1102" for Linux would be a file delete event for those files (usually in /var/log). How to monitor file activity events in Linux is a large topic and would depend on your Linux distro. A good starting point is this.

[#3]

@Ofer_Shezaf thank you! 

[#4]

@bluelogik : Were you able to develop any similar template for linux ?