Comments
-
I would agree this would be an important feature. We are moving our whole network to a linux environment and this would be helpful.
-
I would agree that this would be a nice feature.
-
I believe there might be case open to update the connectors. #315533 just FYI. Also the case open for this FEATURE REQUEST is #317345. I was supposed to put that somewhere but i forgot until now.
-
I do also have the auditd connector setup. Right now it basically shows up everything as InternalNewToolData. Then in Extraneousinfo it will show like USER AUTH or USER ROLE CHANGE and etc... I also have sudo setup. This works good but in the Alert Name it usually shows up as File Execute. I haven't tried but I could maybe…