ACS (Universal Linux) Modules Management Pack

Microsoft.ACS.Linux.Universal :: 7.6.1064.0 (Management Pack)

This is the management pack to collect auditable syslogs from Universal Linux computers and write them to Security Event Log.

Summary

The Universal Linux ACS Management Pack provides the means of collecting auditable syslogs from Universal Linux Operating Systems and write them to the Windows Security Event Log.

Management Pack Elements

Show Management Pack References

TypeDefinitions

EntityTypes

ClassType (1)

Monitoring

Discovery (1)
Rule (17)

Classes (1)

System.Entity

System.ConfigItem

System.LogicalEntity

System.LocalApplication

Microsoft.Unix.LocalApplication

Microsoft.ACS.Unix.ACSEndPoint

Microsoft.ACS.Linux.Universal.ACSEndPoint

	DisplayName	ID	Base Class	Abstract	Hosted	Singleton	Group	Extension	Accessibility
	Universal Linux ACS Endpoint	Microsoft.ACS.Linux.Universal.ACSEndPoint	Microsoft.ACS.Unix.ACSEndPoint	False	True	False	False	False	Public

Discoveries (1)

	DisplayName	ID	Target	Enabled
	Discover Universal Linux ACS Endpoint	Microsoft.ACS.Linux.Universal.ACSEndPoint.Discovery	Microsoft.ACS.Unix.ACSEndPoint	True

Rules (17)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	Adding Group (Universal Linux)	Microsoft.ACS.Linux.Universal.Adding.Group	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Adding User (Universal Linux)	Microsoft.ACS.Linux.Universal.Adding.User	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Adding User to Group (Universal Linux)	Microsoft.ACS.Linux.Universal.Adding.User.To.Group	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Failed Console Login (Universal Linux)	Microsoft.ACS.Linux.Universal.Console.Login.Failed	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Successful Console Login (Universal Linux)	Microsoft.ACS.Linux.Universal.Console.Login.Succeeded	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Deleting Group (Universal Linux)	Microsoft.ACS.Linux.Universal.Deleting.Group	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Deleting User (Universal Linux)	Microsoft.ACS.Linux.Universal.Deleting.User	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Deleting User from Group (Universal Linux)	Microsoft.ACS.Linux.Universal.Deleting.User.From.Group	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Failed Password Change (Universal Linux)	Microsoft.ACS.Linux.Universal.Password.Change.Failed	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Successful Password Change (Universal Linux)	Microsoft.ACS.Linux.Universal.Password.Change.Succeeded	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Failed ssh login (Universal Linux)	Microsoft.ACS.Linux.Universal.Ssh.Failed	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Successful ssh login (Universal Linux)	Microsoft.ACS.Linux.Universal.Ssh.Succeeded	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Failed su (Universal Linux)	Microsoft.ACS.Linux.Universal.Su.Failed	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Successful su (Universal Linux)	Microsoft.ACS.Linux.Universal.Su.Succeeded	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Failed sudo (Universal Linux)	Microsoft.ACS.Linux.Universal.Sudo.Failed	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Invalid sudo (Universal Linux)	Microsoft.ACS.Linux.Universal.Sudo.Invalid	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False
	Successful sudo (Universal Linux)	Microsoft.ACS.Linux.Universal.Sudo.Succeeded	Microsoft.ACS.Linux.Universal.ACSEndPoint	EventCollection	False	False