mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-10 11:12:51 +01:00
58 lines
1.1 KiB
JSON
58 lines
1.1 KiB
JSON
{
|
|
"policy_id": "endpoints-initial",
|
|
"package": {
|
|
"name": "system",
|
|
"version": ""
|
|
},
|
|
"name": "system-endpoints",
|
|
"namespace": "default",
|
|
"inputs": {
|
|
"system-logfile": {
|
|
"enabled": true,
|
|
"streams": {
|
|
"system.auth": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"paths": [
|
|
"/var/log/auth.log*",
|
|
"/var/log/secure*"
|
|
]
|
|
}
|
|
},
|
|
"system.syslog": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"paths": [
|
|
"/var/log/messages*",
|
|
"/var/log/syslog*"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"system-winlog": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"preserve_original_event": false
|
|
},
|
|
"streams": {
|
|
"system.application": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"tags": []
|
|
}
|
|
},
|
|
"system.security": {
|
|
"enabled": true,
|
|
"vars": {
|
|
"tags": []
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"system-system/metrics": {
|
|
"enabled": false
|
|
}
|
|
}
|
|
}
|