Zentral Syslogging about zentral HOT 4 CLOSED

Right now there is no filter facility for syslog out. Syslog is used as a event-store (as ES).
see commit here: 195ce29#diff-6d67768dab2607b0322de6bfa3b792f8

Depending on your organization size and requirements:
A possible solution for a monitored audit trail for login, failed login and 2FA usage -> create an events probe, use Metadata filter for all login/logout/failed-login event types, and trigger action to team-chat (slack)

from zentral.

Thank you @headmin . But what action type is it? When I try to add the action for metadata filter I see only "debug" as the action type.

from zentral.

@Kshitij29 you can define various actions in base.jsonconfig file, have a look into the tutorials section here: https://github.com/zentralopensource/zentral/wiki/tutorial-ref#episode-05---setupactions-enable-zentral-notifications-to-slack-use-slack-webhooks

from zentral.

Sure. Thanks @headmin

from zentral.