Linux Planning

Summary

Linux and Unix hosts can be integrated with a HyperCollector in multiple ways, with the most core, most common patterns being:

1. Automated rsyslog and auditd deployment.
2. Native syslog.

The automated rsyslog and auditd deployment is an Ansible deployed pre-configured best practice syslog and audit configuration for Linux hosts. It is the functional equivalent of the Windows + Sysmon automated deployment available for Microsoft systems. This approach provides a high quality of host cyber data in a more resilient fashion.

Native syslog is a 'catch all' transport mechanism for Linux systems whereby local logs are transferred over syslog to the HyperCollector. This mechanism provides a lower quality of cyber data over an unreliable transport. However, for a system already logging locally this can be enabled by a simple configuration change, in a similar fashion to communications equipment.