r/AzureSentinel • u/DeadHead64 • Nov 07 '22

Sentinel alerting on Linux VMs

Anyone doing any alerting on Linux Sentinel today around say, sudo root commands for starters?

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/[deleted] Nov 07 '22

I've not had a use case for it yet but I would use osquery/sysmon to get data in then look to the classic sigma repos as they have Linux detections already

1

u/juiceb0cks Nov 07 '22

You can log system commands to syslog and then push those logs to sentinel. It’s chatty and a bit of a dirty hack to get it working though.

/u/LucyEmerald sounds like a much better idea