ACS (RedHat 7) Modules Management Pack

Microsoft.ACS.Linux.RHEL.7 :: 10.19.1008.0 (Management Pack)

This is the management pack to collect auditable syslogs from UNIX/Linux (RedHat 7) computer and write them to Security Event Log.

Summary

The Red Hat Enterprise Linux Server release 7 ACS Management Pack provides the means of collecting auditable syslogs from Red Hat Enterprise Linux Server release 7 Operating Systems and write them to the Windows Security Event Log.

Management Pack Elements

Show Management Pack References

TypeDefinitions

EntityTypes

ClassType (1)

Monitoring

Discovery (1)
Rule (17)

Classes (1)

System.Entity

System.ConfigItem

System.LogicalEntity

System.LocalApplication

Microsoft.Unix.LocalApplication

Microsoft.ACS.Unix.ACSEndPoint

Microsoft.ACS.Linux.RHEL.7.ACSEndPoint

	DisplayName	ID	Base Class	Abstract	Hosted	Singleton	Group	Extension	Accessibility
	RHEL 7 ACS Endpoint	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	Microsoft.ACS.Unix.ACSEndPoint	False	True	False	False	False	Public

Discoveries (1)

	DisplayName	ID	Target	Enabled
	Discover Red Hat Enterprise Linux Server release 7 ACS Endpoint	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint.Discovery	Microsoft.ACS.Unix.ACSEndPoint	True

Rules (17)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	Adding Group (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Adding.Group	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Adding User (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Adding.User	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Adding User to Group (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Adding.User.To.Group	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Failed Console Login (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Console.Login.Failed	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Successful Console Login (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Console.Login.Succeeded	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Deleting Group (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Deleting.Group	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Deleting User (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Deleting.User	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Deleting User from Group (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Deleting.User.From.Group	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Failed Password Change (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Password.Change.Failed	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Successful Password Change (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Password.Change.Succeeded	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Failed ssh login (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Ssh.Failed	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Successful ssh login (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Ssh.Succeeded	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Failed su (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Su.Failed	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Successful su (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Su.Succeeded	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Failed sudo (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Sudo.Failed	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Invalid sudo (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Sudo.Invalid	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False
	Successful sudo (Red Hat Enterprise Linux Server 7)	Microsoft.ACS.Linux.RHEL.7.Sudo.Succeeded	Microsoft.ACS.Linux.RHEL.7.ACSEndPoint	EventCollection	True	False