Endpoint / Security event

Syslog

Linux syslog messages including auth, cron, daemon, and security-relevant facility logs. This record covers rows that match no source in shared-table-sources.json

Analytics Data lake Primary Secondary Primary · Analytics365 days retention

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

How the matrix works

C4 Endpoint and operating system activity

Endpoint and operating system activity: process, script, logon, service, scheduled task, registry, file

ACSC

1. Endpoint detection and response (EDR) logs
5. Microsoft Windows endpoints logs
6. Virtualisation system logs
13. Linux endpoint auditing logs
14. Apple MacOS endpoint logs

CISA

2. Operating systems2a-2j All listed operating system event types

MITRE data sources

Process: Process Creation
User Account: Authentication

T1 Near-real-time detection

Generic detections need near-real-time matching on single events.

Lake supported in the Azure Monitor table feature matrix

Sources in this table

17 sources share Syslog. Each has its own classification, and the record on this page covers only rows that match none of them.

Source	Filter	Classification	Tier	Retention
Barracuda CloudGen Firewall (Syslog)	`ProcessName =~ "box_Firewall_Activity"`	Primary	Data lake	180 days
Cisco ISE (Syslog)	`(ProcessName has "CSCO" or ProcessName has "CISE")`	Primary	Data lake	365 days
Cisco Web Security Appliance (Syslog)	`ProcessName =~ "cisco_wsa"`	Primary	Data lake	180 days
CTERA (Syslog)	`ProcessName =~ "gw-audit"`	Primary	Data lake	180 days
ESET PROTECT (Syslog)	`ProcessName =~ "ERAServer"`	Primary	Analytics	365 days
Exabeam (Syslog)	`ProcessName contains "Exabeam"`	Primary	Analytics	365 days
Forescout (Syslog)	`ProcessName =~ "ACTIONidentity"`	Primary	Analytics	365 days
GitLab access (Syslog)	`Facility =~ "local7" and ProcessName =~ "GitLab-Access-Logs"`	Primary	Data lake	180 days
GitLab application (Syslog)	`Facility =~ "local7" and ProcessName =~ "GitLab-Application-Logs"`	Secondary	Data lake	90 days
GitLab audit (Syslog)	`Facility =~ "local7" and ProcessName =~ "GitLab-Audit-Logs"`	Primary	Analytics	365 days
Linux authentication (Syslog)	`(Facility =~ "auth" or Facility =~ "authpriv")`	Primary	Analytics	365 days
McAfee ePolicy Orchestrator (Syslog)	`ProcessName contains "EPOEvents"`	Primary	Analytics	365 days
McAfee Network Security Platform (Syslog)	`ProcessName =~ "SyslogAlertForwarderNSP"`	Primary	Analytics	365 days
OpenVPN (Syslog)	`ProcessName =~ "openvpn"`	Primary	Data lake	365 days
Squid proxy (Syslog)	`ProcessName contains "squid"`	Primary	Data lake	180 days
Symantec Endpoint Protection (Syslog)	`ProcessName =~ "SymantecServer"`	Primary	Analytics	365 days
VMware ESXi (Syslog)	`(ProcessName has "vpxd-main" or ProcessName has "vmkwarning" or ProcessName has "hostd-probe")`	Primary	Data lake	365 days

Build the split rule for Syslog

A table has one split rule. Select the sources you collect to combine them into one condition. Rows that match stay in Analytics and are mirrored to the data lake. All other rows go to Syslog_SPLT.

I also collect sources that are not listed. They follow the Syslog record: Analytics, 365 days.

Syslog retention
Syslog_SPLT retention

Retention is set per table. The values are the highest recommendation among the selected sources on each side. Data lake sources without a split hint keep no rows in Analytics.

Fields detections use

High-value fields

ComputerFacilityHostIPProcessIDProcessNameSeverityLevelSyslogMessageTimeGeneratedType

Most used in public rules

TimeGenerated40
SyslogMessage37
Computer33
ProcessName30
HostIP15
Facility13
Type10
SourceSystem9
CollectorHostName4
ProcessID3
_ResourceId2
SeverityLevel2

Parsers that read this table

McAfeeEPOEvent24 rules
VMwareESXi24 rules
CiscoWSAEvent21 rules
CiscoISEEvent20 rules
DigitalGuardianDLPEvent20 rules
OracleDatabaseAuditEvent20 rules
IllumioSyslogAuditEvents6 rules
GitLabAudit5 rules
CiscoSyslogUTD4 rules
PulseConnectSecure3 rules
ESETPROTECT2 rules
SophosXGFirewall2 rules
SymantecEndpointProtection2 rules
SymantecProxySG2 rules
SymantecVIP2 rules
GitLabAccess1 rules
GitLabApp1 rules
Infoblox_dnsclient1 rules
Veeam_GetSecurityEvents1 rules

Split hints

Rows to keep in Analytics with a split rule. On a shared table, these apply only to rows that match no source.

Keep auth, authpriv (login events), kern (kernel), and high-severity messages in Analytics

Facility in ("auth", "authpriv", "kern") or SeverityLevel in ("emerg", "alert", "crit", "err")

Sources for this recommendation

Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.