Configuring rsyslog settings

To send notifications in the Common Export Format (CEF), enter:

hostname (config) # fenotify rsyslog default format cef

To send notifications in the comma-separated values (CSV) format, enter:

hostname (config) # fenotify rsyslog default format csv

To send notifications in the Log Extended Event Format (LEEF) (default), enter:

hostname (config) # fenotify rsyslog default format leef

To send notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:

hostname (config) # fenotify rsyslog default format xml-concise

To send notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:

hostname (config) # fenotify rsyslog default format xml-extended

To send notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:

hostname (config) # fenotify rsyslog default format xml-normal

To send notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:

hostname (config) # fenotify rsyslog default format json-concise

To send notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:

hostname (config) # fenotify rsyslog default format json-extended

To send notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:

hostname (config) # fenotify rsyslog default format json-normal

To send notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:

hostname (config) # fenotify rsyslog default format text-concise

To send notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:

hostname (config) # fenotify rsyslog default format text-extended

To send notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:

hostname (config) # fenotify rsyslog default format text-normal

To receive a daily notification for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog default delivery daily-per-source

To receive an hourly notification for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog default delivery hourly-per-source

To receive a notification every minute for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog default delivery per-1min-per-source

To receive a notification every 5 minutes for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog default delivery per-5min-per-source

To receive information about each event, sent when the event is triggered, enter:

hostname (config) # fenotify rsyslog default delivery per-event

To indicate that action must be taken immediately (severity 1), enter:

hostname (config) # fenotify rsyslog default send-as alert

To indicate that the notification contains critical conditions (severity 2), enter:

hostname (config) # fenotify rsyslog default send-as crit

To indicate that the notification contains debug-level messages (severity 7), enter:

hostname (config) # fenotify rsyslog default send-as debug

To indicate an emergency (the system is unusable) (severity 0), enter:

hostname (config) # fenotify rsyslog default send-as emerg

To indicate that the notification contains error conditions (severity 3), enter:

hostname (config) # fenotify rsyslog default send-as error

To indicate that the notification contains informational messages (severity 6), enter:

hostname (config) # fenotify rsyslog default send-as info

To indicate normal but significant conditions (severity 5), enter:

hostname (config) # fenotify rsyslog default send-as notice

To indicate that the notification contains warning conditions (severity 4), enter:

hostname (config) # fenotify rsyslog default send-as warning