ACS (SLES 15) Modules Management Pack

Microsoft.ACS.Linux.SLES.15 :: 10.19.1008.0 (Management Pack)

This is the management pack to collect auditable syslogs from UNIX/Linux (SLES 15) computer and write them to Security Event Log.

• Show Management Pack XML
• Get Management Pack data in Excel format
• Download: Microsoft.ACS.Linux.SLES.15.mp

Management Pack Elements

Classes (1)

	DisplayName	ID	Base Class	Abstract	Hosted	Singleton	Group	Extension	Accessibility
	SLES 15 ACS Endpoint	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	Microsoft.ACS.Unix.ACSEndPoint	False	True	False	False	False	Public

Discoveries (1)

	DisplayName	ID	Target	Enabled
	Discover SUSE Linux Enterprise Server 15 ACS Endpoint	Microsoft.ACS.Linux.SLES.15.ACSEndPoint.Discovery	Microsoft.ACS.Unix.ACSEndPoint	True

Rules (21)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	Adding Group (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Adding.Group	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Adding User (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Adding.User	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Adding User to Group (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Adding.User.To.Group	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Failed Console Login (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Console.Failed	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Invalid Console Login (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Console.Invalid	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Deleting Group (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Deleting.Group	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Deleting User (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Deleting.User	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Deleting User from Group (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Deleting.User.From.Group	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Failed Password Change (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Password.Change.Failed	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Successful Password Change from root user (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Password.Change.From.Root.Succeeded	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Successful Password Change from non-root user (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Password.Change.From.User.Succeeded	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Maximum Tried Password Change (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Password.Change.Maximum.Tries	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Failed ssh login (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Ssh.Failed	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Invalid ssh login (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Ssh.Invalid	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Successful ssh login (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Ssh.Succeeded	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Failed su (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Su.Failed	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Successful su (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Su.Succeeded	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Failed sudo with one or two times try (password) (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Sudo.Conversation.Error	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Failed sudo (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Sudo.Failed	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Invalid sudo (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Sudo.Invalid	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False
	Successful sudo (SUSE Linux Enterprise Server 15)	Microsoft.ACS.Linux.SLES.15.Sudo.Succeeded	Microsoft.ACS.Linux.SLES.15.ACSEndPoint	EventCollection	True	False