Linux Servers Integration Guide🔗
Connectivity Requirements🔗
| Source | Destination | Port/Protocol |
|---|---|---|
| Linux server | Taegis™ XDR Collector (mgmt IP) | UDP/514 |
Data Provided from Integration🔗
| Normalized Data | Out-of-the-Box Detections | Vendor-Specific Detections | |
|---|---|---|---|
| Non-Microsoft-based servers (processes like sudo/su/sshd/named) | Management | Auth, DNS |
Note
XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Detection Rules to generate detections based on normalized data from a data source.
Logging Configuration Instructions🔗
Linux servers must be configured to send logs — whether DNS, SSH, or sudo — via syslog to the XDR Collector.
Please refer to the vendor’s site for purchasing and configuration guidance.
An example of logging instructions:
- BIND Logging
- SSH Logging
- Sudoers Manual — The sudo project's own reference for logging-related
Defaultsoptions.
Sudo can log command activity two ways: directly to syslog, or to a local log file that a separate agent then forwards to the XDR Collector. Both are supported by XDR. See Sample logs for the exact format each one produces, and use the Sudoers Manual linked above for the authoritative list of logging-related configuration options.
Sample logs🔗
Depending on configuration, sudo emits one of two supported single-line formats: directly to syslog, or to a local log file that a separate agent then forwards to the XDR Collector.
Multi-line or wrapped log entries are not supported
XDR Collector parses one syslog message per event and does not reassemble a log entry that arrives split across multiple messages. Some logging configurations wrap or otherwise emit a single event across more than one line, which will prevent that event from being parsed correctly. If your logs don't resemble either single-line format shown above, consult your distribution's or vendor's logging documentation.
Sudo command activity using a syslog plugin (writes directly to syslog) sample log
Logfile plugin sample log
Jul 30 13:31:01 ABC-123 sudo: Jul 30 13:31:01 2019 : root : HOST=ABC-123 ; PWD=/ ; USER=root ; COMMAND=/sbin/dmidecode --string chassis-type
Note
A logfile plugin (for example, Defaults logfile=...) is typically forwarded to the XDR Collector by a separate log-shipping agent rather than sudo itself. This format embeds its own date, including year, and uses HOST= in place of TTY= when the command runs without a controlling terminal, such as from an unattended script or agent.