3

I have to write alerts in SIEM Tool. Do we have any events code for Unix as we have in Windows.

If yes, where can I find that?

If not, on what basis can we write alerts for unix flavours or machines? It would be needed for auditing, application or network based alerts.

2

Do we have any Events code for Unix as we have in Windows.

nope. what you have is a bunch of software that writes logfiles, but these logfiles do not follow any standard.

If Not, On what basis can we write alerts for unix flavours or machines . for Auditing,application or network based alerts.

network-based attacks are usually detected by a NIDS like snort, suricata, bro (open source) or whatever commercial IDS you use. any decent SIEM should have connectors for these kind of alert-systems.

the same applies for hostbased-intrusion with tools like OSSEC or other opens-source stuff that works on logfile-analaysis. for any serious NIDS/HIDS and SIEM you'll find connectors and ways to inject events from that system into the SIEM

1
  • If I want to write a rule for suppose authentication failure so on what basis we will write. As I have come across some events ID like 83,85,32 etc but I dont know exactly what event id's are these and where to find information on this.
    – santosh407
    Jul 18 '15 at 19:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.