Cyber Security: Configuring Infrastructure Sources
Overview
The module's rules expect a specific set of events from each source. If an audit subcategory is disabled, a log is not recorded, or an event lacks required fields, a rule will not receive the data and will not trigger even during an attack. Configure the sources before connecting data collection.
Configuration Scope
| Source | Configuration |
|---|---|
| Windows | advanced audit policy, command line in process creation events, PowerShell logging, Sysmon, and log sizes |
| Active Directory | audit policy on all domain controllers, system access control lists (SACLs) on directory objects, and certificate services auditing |
| Microsoft IIS | logging to ETW events and IIS log channels |
| Linux | kernel audit subsystem rules |
| nginx | access log format |
| Kubernetes | audit policy and kube-apiserver audit log settings |
After configuring the sources, connect data collection as described in Connecting and Configuring Data Collection.
Documents Included with the Module
Requirements for each source, settings, commands, and verification methods are provided in the "Configuring Audit on Sources" document included with the module.