ACS (SLES 12) Modules Management Pack

Microsoft.ACS.Linux.SLES.12 :: 10.19.1008.0 (Management Pack)

This is the management pack to collect auditable syslogs from UNIX/Linux (SLES 12) computer and write them to Security Event Log.

• Show Management Pack XML
• Get Management Pack data in Excel format
• Download: Microsoft.ACS.Linux.SLES.12.mp

Management Pack Elements

Classes (1)

	DisplayName	ID	Base Class	Abstract	Hosted	Singleton	Group	Extension	Accessibility
	SLES 12 ACS Endpoint	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	Microsoft.ACS.Unix.ACSEndPoint	False	True	False	False	False	Public

Discoveries (1)

	DisplayName	ID	Target	Enabled
	Discover SUSE Linux Enterprise Server 12 ACS Endpoint	Microsoft.ACS.Linux.SLES.12.ACSEndPoint.Discovery	Microsoft.ACS.Unix.ACSEndPoint	True

Rules (21)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	Adding Group (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Adding.Group	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Adding User (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Adding.User	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Adding User to Group (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Adding.User.To.Group	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Failed Console Login (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Console.Failed	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Invalid Console Login (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Console.Invalid	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Deleting Group (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Deleting.Group	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Deleting User (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Deleting.User	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Deleting User from Group (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Deleting.User.From.Group	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Failed Password Change (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Password.Change.Failed	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Successful Password Change from root user (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Password.Change.From.Root.Succeeded	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Successful Password Change from non-root user (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Password.Change.From.User.Succeeded	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Maximum Tried Password Change (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Password.Change.Maximum.Tries	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Failed ssh login (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Ssh.Failed	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Invalid ssh login (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Ssh.Invalid	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Successful ssh login (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Ssh.Succeeded	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Failed su (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Su.Failed	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Successful su (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Su.Succeeded	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Failed sudo with one or two times try (password) (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Sudo.Conversation.Error	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Failed sudo (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Sudo.Failed	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Invalid sudo (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Sudo.Invalid	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False
	Successful sudo (SUSE Linux Enterprise Server 12)	Microsoft.ACS.Linux.SLES.12.Sudo.Succeeded	Microsoft.ACS.Linux.SLES.12.ACSEndPoint	EventCollection	True	False