##
## SPDX-FileCopyrightText: 2024 Splunk, Inc.
## SPDX-License-Identifier: LicenseRef-Splunk-8-2021
##
##

###### Globals ######
[eventtype=nix_security]
os = enabled
unix = enabled

[eventtype=nix_errors]
error = enabled

[eventtype=interfaces]
inventory = enabled
network = enabled

###### DHCP ######
[eventtype=dhcpd_server]
dhcp = enabled
network = enabled
session = enabled
unix = enabled

[eventtype=dhcpd_start]
start = enabled

[eventtype=dhcpd_unable_unexpected]
error = enabled

[eventtype=dhcpd_server_dhcprelease]
end = enabled


###### Scripted Inputs ######
[eventtype=cpu]
os = enabled
resource = enabled
report = enabled
unix = enabled
cpu = enabled
avail = enabled
performance = enabled
oshost = enabled

[eventtype=cpu_anomalous]
anomalous = enabled

[eventtype=df]
df = enabled
host = enabled
check = enabled
success = enabled
storage = enabled
performance = enabled
oshost = enabled

[eventtype=iostat]
report = enabled
resource = enabled
iostat = enabled
performance = enabled
cpu = enabled
storage = enabled
success = enabled
oshost = enabled

[eventtype=nfsiostat]
storage = enabled
performance = enabled

[eventtype=lsof]
report = enabled
lsof = enabled
resource = enabled
file = enabled
success = enabled

[eventtype=netstat]
report = enabled
netstat = enabled
os = enabled
cpu = enabled
success = enabled
listening = enabled
port = enabled

[eventtype=ps]
performance = enabled
cpu = enabled
success = enabled
ps = enabled
oshost = enabled
process = enabled

[eventtype=top]
top = enabled
os = enabled
success = enabled
process = enabled

[eventtype=time]
report = enabled
os = enabled
success = enabled
time = enabled

[eventtype=vmstat]
report = enabled
vmstat = enabled
resource = enabled
success = enabled
cpu = enabled
memory = enabled
performance = enabled
oshost = enabled

[eventtype=bandwidth]
network = enabled
resource = enabled
success = enabled
performance = enabled
oshost = enabled

[eventtype=hardware]
inventory = enabled
oshost = enabled
cpu = enabled
memory = enabled

# For ESS:
os = enabled
avail = enabled
unix = enabled

###### System Logs ######

#### Account Management
[eventtype=useradd]
account = enabled
management = enabled
add = enabled
change = enabled

[eventtype=useradd-suse]
account = enabled
management = enabled
add = enabled
change = enabled

[eventtype=userdel]
account = enabled
management = enabled
delete = enabled
change = enabled

[eventtype=groupadd]
management = enabled
add = enabled
change = enabled

[eventtype=groupadd-suse]
management = enabled
add = enabled
change = enabled
account = enabled

[eventtype=groupdel]
management = enabled
delete = enabled
change = enabled

[eventtype=linux-password-change]
account = enabled
management = enabled
password = enabled
modify = enabled
change = enabled

[eventtype=linux-password-change-failed]
account = enabled
management = enabled
password = enabled
modify = enabled
change = enabled


#### acpi
[eventtype=nix_acpi]
os = enabled
unix = enabled
power = enabled


#### agpgart
[eventtype=nix_agpgart]
os = enabled
unix = enabled
graphics = enabled


#### apm
[eventtype=nix_apm]
os = enabled
unix = enabled
power = enabled


#### auditd
[eventtype=auditd]
os = enabled
unix = enabled
resource = enabled
file = enabled

[eventtype=auditd_modify]
modify = enabled


#### Authentication

## ksu
[eventtype=ksu_authentication]
authentication = enabled

[app=ksu]
local = enabled
privileged = enabled

[app=ksudo]
local = enabled
privileged = enabled

## login
[eventtype=login_authentication]
authentication = enabled

## pam
[eventtype=pam_unix_authentication]
authentication = enabled

## passwd
[eventtype=passwd-auth-failure]
application = enabled
authentication = enabled

## rlogin
[eventtype=rlogin_too_many_failures]
application = enabled
attack = enabled
watchlist = enabled

[eventtype=remote_login_failure]
application = enabled
authentication = enabled
remote = enabled

[eventtype=remote_login_allowed]
application = enabled
authentication = enabled
remote = enabled

## sshd
[eventtype=sshd_authentication]
authentication = enabled
remote = enabled

[eventtype=ssh_open]
communicate = enabled
connect = enabled

[eventtype=ssh_close]
access = enabled
stop = enabled
logoff = enabled

[eventtype=ssh_disconnect]
access = enabled
stop = enabled
logoff = enabled

[eventtype=failed_login]
authentication = enabled

[eventtype=Failed_SU]
authentication = enabled

## su
[eventtype=su_authentication]
authentication = enabled

[app=su]
local = enabled
privileged = enabled

[app=sudo]
local = enabled
privileged = enabled

[eventtype=su_failed]
authentication = enabled

[eventtype=su_session]
session = enabled

[eventtype=su_root_session]
session = enabled
privileged = enabled

## Telnet

[app=wksh]
cleartext = enabled


#### automount
[eventtype=nix_automount]
os = enabled
unix = enabled


#### Config
[eventtype=nix_config_change]
os = enabled
unix = enabled
host = enabled
configuration = enabled
modify = enabled


#### Console
[eventtype=nix_console]
os = enabled
unix = enabled


#### cron
[eventtype=nix_cron]
os = enabled
unix = enabled


#### CUPS
[eventtype=nix_cups_access]
os = enabled
unix = enabled
access = enabled
printer = enabled

[eventtype=nix_cups_error]
os = enabled
unix = enabled
printer = enabled

[eventtype=nix_cups_page]
os = enabled
unix = enabled
printer = enabled


#### dhclient
[eventtype=nix_dhclient]
os = enabled
unix = enabled


#### DMA
[eventtype=nix_dma]
os = enabled
unix = enabled
memory = enabled
access = enabled


#### Firewall
[eventtype=iptables_firewall_accept]
os = enabled
unix = enabled
host = enabled
firewall = enabled
communicate = enabled
success = enabled

[eventtype=iptables_firewall_deny]
os = enabled
unix = enabled
host = enabled
firewall = enabled
communicate = enabled
failure = enabled


#### FTP
[eventtype=nix_ftp_xferlog]
os = enabled
unix = enabled
ftp = enabled
transfer = enabled

[eventtype=nix_ncftpd_logins]
os = enabled
unix = enabled
ftp = enabled
authentication = enabled


#### Fingerprinting
[eventtype=nix_fingerprinting]
os = enabled
unix = enabled


#### gconfd
[eventtype=nix_gconfd]
os = enabled
unix = enabled

[eventtype=nix_gconfd_error]
error = enabled

[eventtype=nix_gconfd_exiting]
stop = enabled

[eventtype=nix_gconfd_starting]
start = enabled


## gdm
[eventtype=nix_gdm]
os = enabled
unix = enabled


#### gpm
[eventtype=nix_gpm]
os = enabled
unix = enabled


#### FreeBSD
[eventtype=freebsd_refresh_na_answer]
os = enabled
unix = enabled

[eventtype=freebsd_refresh_retry_exceeded]
os = enabled
unix = enabled


#### hald
[eventtype=nix_hald]
os = enabled
unix = enabled


#### hpiod
[eventtype=hpiod_Linux_syslog]
os = enabled
unix = enabled


#### kernel
[eventtype=nix_kernel_attached]
os = enabled
unix = enabled
kernel = enabled


#### kill
[eventtype=nix_process_kill]
os = enabled
unix = enabled
process = enabled
stop = enabled


#### mDNSResponder
[eventtype=nix_mDNSResponder]
os = enabled
unix = enabled
dns = enabled


#### named
[eventtype=nix_named1]
os = enabled
unix = enabled
dns = enabled

[eventtype=nix_named2]
os = enabled
unix = enabled
dns = enabled


#### OSX
[eventtype=osx_crash_log]
os = enabled
unix = enabled
error = enabled


#### Netlabel
[eventtype=nix_netlabel]
os = enabled
unix = enabled
kernel = enabled


#### PCI
[eventtype=nix_pci]
os = enabled
unix = enabled


#### Plug-n-play
[eventtype=nix_pnp]
os = enabled
unix = enabled


#### POP3
[eventtype=nix_popper]
os = enabled
unix = enabled
mail = enabled


#### postfix
[eventtype=nix_postfix]
os = enabled
unix = enabled


#### Prelink
[eventtype=nix_prelink]
os = enabled
unix = enabled


#### RPC
[eventtype=nix_rpc_statd]
os = enabled
unix = enabled


#### RPM
[eventtype=nix_rpm]
os = enabled
unix = enabled
update = enabled


#### Runlevel
[eventtype=nix_runlevel_change]
os = enabled
unix = enabled
configuration = enabled
modify = enabled


#### SNMPD
[eventtype=snmpd]
os = enabled
unix = enabled
snmp = enabled

[eventtype=snmpd_failure]
failure = enabled


#### scrollkeeper
[eventtype=nix_scrollkeeper]
os = enabled
unix = enabled


## Shutdown
[eventtype=nix_halt]
os = enabled
unix = enabled
stop = enabled

[eventtype=nix_restart]
os = enabled
unix = enabled
stop = enabled


#### smartd
[eventtype=nix_smartd]
os = enabled
unix = enabled


#### Time
[eventtype=nix_timesync]
report = enabled
time = enabled
synchronize = enabled
success = enabled

os = enabled
performance = enabled

[eventtype=nix_timesync_failure]
report = enabled
time = enabled
synchronize = enabled
failure = enabled

os = enabled
performance = enabled

#### Update
[eventtype=nix_yum_update]
report = enabled
update = enabled
success = enabled


#### udevd
[eventtype=nix_udevd]
os = enabled
unix = enabled
kernel = enabled


#### USB
[eventtype=nix_usb]
os = enabled
unix = enabled
usb = enabled


#### userhelper
[eventtype=nix_userhelper]
os = enabled
unix = enabled


#### Open ports
[eventtype=openPorts]
unix = enabled
report = enabled
os =  enabled


###### BEGIN CONTENT IMPORTED FROM TA-deploymentapps ######

# Stanzas in this section are legacy configuration stanzas
# intended to support parsing of data created by scripts in
# TA-deploymentapps, which has since been retired. Systems that use
# Splunk_TA_nix on the search head but which may be searching data
# from forwarders on which the older scripts are still in use should
# be able to search new and old data seamlessly.

###### Scripted Inputs ######

## Global
[eventtype=aix_scripted_input]
check = enabled
report = enabled

[eventtype=hpux_scripted_input]
check = enabled
report = enabled

[eventtype=linux_scripted_input]
check = enabled
report = enabled

[eventtype=osx_scripted_input]
check = enabled
report = enabled

[eventtype=solaris_scripted_input]
check = enabled
report = enabled

[eventtype=unix_scripted_input]
check = enabled
report = enabled

## CPUTime
[eventtype=cputime]
os = enabled
avail = enabled
cpu = enabled
performance = enabled
oshost = enabled

[eventtype=cputime_anomalous]
anomalous = enabled


## Disk
[eventtype=freediskspace]
os = enabled
avail = enabled
disk = enabled
performance = enabled
oshost = enabled
storage = enabled

[eventtype=freediskspace_anomalous]
anomalous = enabled


## Listening Ports
[eventtype=listeningports]
os = enabled
config = enabled
report = enabled


## Local Processes

[eventtype=localprocesses_anomalous]
anomalous = enabled


## Memory
[eventtype=memory]
os = enabled
avail = enabled
memory = enabled
performance = enabled
oshost = enabled

[eventtype=memory_anomalous]
anomalous = enabled


## SELinux Config
[eventtype=selinuxconfig]
application = enabled
config = enabled
selinux = enabled

[selinux=disabled]
insecure = enabled


## Service
[eventtype=service]
os = enabled
config = enabled
service = enabled
report = enabled

[eventtype=service_runlevel_anomalous]
anomalous = enabled

[app=ntpd]
time = enabled
synchronize = enabled

[app=%2Fnetwork%2Fntp%3Adefault]
time = enabled
synchronize = enabled

[app=yum-updatesd]
automatic = enabled
update = enabled


## SSHD Config
[eventtype=sshdconfig]
application = enabled
config = enabled
ssh = enabled

[eventtype=sshd_insecure]
insecure = enabled


## Update
[eventtype=update]
os = enabled
info = enabled
system = enabled
update = enabled

[eventtype=update_status]
status = enabled


## Uptime
[eventtype=uptime]
os = enabled
info = enabled
report = enabled
uptime = enabled
performance = enabled

[eventtype=uptime_anomalous]
anomalous = enabled


## User Accounts
[eventtype=useraccounts]
os = disabled
config = enabled
user = enabled
inventory = enabled

[eventtype=useraccounts_anomalous]
anomalous = enabled

[shell=%2Fbin%2Fbash]
interactive = enabled

[shell=%2Fbin%2Fsh]
interactive = enabled

[shell=%2Fusr%2Fbin%2Fbash]
interactive = enabled

[shell=%2Fusr%2Fbin%2Fpfksh]
interactive = enabled

[shell=%2Fusr%2Fbin%2Fpfsh]
interactive = enabled


## Version
[eventtype=nix_version]
os = enabled
info = enabled
report = enabled
system = enabled
version = enabled
inventory = enabled
oshost = enabled
cpu = enabled
memory = enabled


## VSFTDP Config
[eventtype=vsftpd_config]
application = enabled
config = enabled
ftp = enabled
cleartext = enabled

[eventtype=vsftpd_config_anonymous]
anonymous = enabled

###### END CONTENT IMPORTED FROM TA-deploymentapps ######
