AlienVault® USM Anywhere™

Collecting Linux System Logs

In USM Anywhere, you can centralize the collection and analysis of Linux event logs from your servers, making it easier to track the health and security of these systems.

Note: With the addition of the AlienVault Agent, USM Anywhere provides an easier implementation of HIDS, FIM, and endpoint log collection across your Linux environments in the cloud and on premises. You can choose between using either osquery or syslog to send the logs to the Agent. If you already have osquery installed and configured on your endpoints to forward events to a USM Anywhere Sensor, this method is still supported.

Using the AlienVault Agent

The AlienVault Agent provides simple installation, configuration, and management for host monitoring in USM Anywhere without requiring a lot of manual configuration and setup tasks of a third-party agent. When you install the AlienVault Agent on a Linux host, it communicates over an encryptedCryptographic transformation of data into a form that conceals the data's original meaning to prevent it from being known or used. channel to send data directly to USM Anywhere. The agent installation script configures a default set of folders, files, and registries to automatically support file integrity monitoring. You can set the configuration profile to manage the queries that USM Anywhere runs for an asset associated with a deployed agent.

This is the best choice for monitoring endpoints outside of the network or in remote locations or where deploying a sensor is impractical. Additionally, it provides the ability to query the assetAn IP-addressable host, including but not limited to network devices, virtual servers, and physical servers. for additional forensic data as part of your investigation activities. For more information about the AlienVault Agent and how you can use it to simplify your endpoint detection and response (EDR), file integrity monitoring (FIM), and rich endpoint telemetry capabilities, see The AlienVault Agent.

After you have the AlienVault Agent installed on your endpoints, you can verify the agent query events in USM Anywhere.

Select the AlienVault Agent plugin to filter the Events page

Next, you can set up log collection using one of two methods: