ACS (SLES 9) Modules Management Pack

Microsoft.ACS.Linux.SLES.9 :: 7.5.1005.0 (Management Pack)

This is the management pack to collect auditable syslogs from UNIX/Linux (SLES 9) computer and write them to Security Event Log.

Summary

The SUSE Linux Enterprise Server 9 ACS Management Pack provides the means of collecting auditable syslogs from SUSE Linux Enterprise Server 9 Operating Systems and write them to the Windows Security Event Log.

Management Pack Elements

Show Management Pack References

TypeDefinitions

EntityTypes

ClassType (1)

Monitoring

Discovery (1)
Rule (15)

Classes (1)

System.Entity

System.ConfigItem

System.LogicalEntity

System.LocalApplication

Microsoft.Unix.LocalApplication

Microsoft.ACS.Unix.ACSEndPoint

Microsoft.ACS.Linux.SLES.9.ACSEndPoint

	DisplayName	ID	Base Class	Abstract	Hosted	Singleton	Group	Extension	Accessibility
	SLES 9 ACS Endpoint	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	Microsoft.ACS.Unix.ACSEndPoint	False	True	False	False	False	Public

Discoveries (1)

	DisplayName	ID	Target	Enabled
	Discover SUSE Linux Enterprise Server 9 ACS Endpoint	Microsoft.ACS.Linux.SLES.9.ACSEndPoint.Discovery	Microsoft.ACS.Unix.ACSEndPoint	True

Rules (15)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	Adding Group (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Adding.Group	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Adding User (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Adding.User	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Failed Console Login (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Console.Failed	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Invalid Console Login (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Console.Invalid	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Deleting User (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Deleting.User	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Failed Password Change (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Password.Change.Failed	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Maximum Tried Password Change (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Password.Change.Maximum.Tries	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Failed ssh login (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Ssh.Failed	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Invalid ssh login (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Ssh.Invalid	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Successful ssh login (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Ssh.Succeeded	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Failed su (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Su.Failed	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Successful su (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Su.Succeeded	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Failed sudo (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Sudo.Failed	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Invalid sudo (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Sudo.Invalid	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False
	Successful sudo (SUSE Linux Enterprise Server 9)	Microsoft.ACS.Linux.SLES.9.Sudo.Succeeded	Microsoft.ACS.Linux.SLES.9.ACSEndPoint	EventCollection	True	False