Activate P-Linux (Obsolete)

197837

OpenText OpenText Community

App Support Tiers

OpenText SUPPORTED

Support via OpenText Software Support, with a ticket filed against the associated product.

PARTNER

OpenText offers a content partnership program for select partners. Support for Partner Content offerings is provided by the partner and not by OpenText of the OpenText community.

OpenText COMMUNITY

OpenText Community Content is provided by OpenText for the benefit of customers, support for it is not available via OpenText Software Support but through specific community content forums.

COMMUNITY

Community Contributed Content is provided by OpenText customers and supported by them.

EARLY ACCESS

Show less ...Show more

The downloads referenced under the "Cybersecurity Early Access" category are made available to subscribers to mitigate time-critical issues but have not undergone formal quality and performance testing associated with official OpenText/Cybersecurity product releases. OpenText has a multi-stage Quality Assurance process. During Stage 1 we conduct a resource analysis, field mapping, ensure content level 1 functionality and analysis in our sandbox environment. Stage 2 is a complete validation including production validation. This package has cleared Stage 1 validation and therefore should be deployed with the appropriate pre-production validation. OpenText strongly recommends that any downloaded content is first checked and tested thoroughly in a non-production environment before committing to production. We welcome feedback and, should any content be shown to be faulty, detrimental or carry an incorrect claim of authorship, we shall endeavor to remove or correct such content as promptly as reasonably possible once notified and validated.

OpenText | OpenText Community

The P-Linux package contains resources that support L1 & L2 Host Monitoring and L1 & L2 Entity Monitoring Use Cases and User Stories.

1,393 downloads

Product compatibility

Description

The P-Linux package offers an easy way to monitor both host and entity related individual incidents. Furthermore, it offers the flexibility to integrate the product's events with either Activate L1 Indicator and Monitoring packages or the existing non-Activate contents for further detection and investigation.

This package supports the following Use Cases and User Stories:

L1 Host Monitoring

System Errors
System Changes

L1 Entity Monitoring

Account Anomalies
Entity Authentication
Entity Management

Minimum Requirements

Activate Base - Version 2.5.1.0 and later.

Suggested apps

FREE

New

OpenText

NetIQ Privileged Account Manager

OpenText

This NetIQ Sentinel Collector provides data-capture capabilities for NetIQ Privileged Account Manager and related products.

FREE

New

OpenText

Data Generator

OpenText

Generates test data at a specified rate. This connector does not require a data source.

New

Community

Airlock WAF

Ergon Informatik AG

Airlock Suite deals with the issues of filtering and authentication in one complete and coordinated solution – setting standards for usability and services. Airlock Suite is protecting more than 30.000 back-ends and 15 million identities around the globe.

FREE

New

OpenText COMMUNITY

L3-Base - Threat and Impact Analysis (Obsolete)

OpenText

This package contains the supporting resources (active lists and rules) for tracking the activity of systems, user accounts, service accounts, system accounts, etc., across the ArcSight Attack Life Cycle phases for this method.

Qualys QualysGuard

OpenText

This NetIQ Sentinel Collector provides data-capture capabilities for Qualys QualysGuard and related products.

FREE

New

OpenText COMMUNITY

Which Tor

OpenText

An Integration command which check if IP address belongs to Tor or not

Playbook-Check IP Reputation from Multiple Sources

OpenText

A Playbook for Check IP Reputation from Multiple Sources Usecase

Cisco Aironet

OpenText

This Novell Sentinel Collector provides data-capture capabilities for Cisco Aironet and related products.

FREE

New

OpenText COMMUNITY

Playbook-Command and Control Traffic-4

OpenText

A Playbook for Command and Control Traffic Usecase

169

Releases

Release

Size

Date

Updated for 8.3.2 parsers 1.3.2.0_8.3.2.1

82.1 KB

Jul 21, 2022

More info Less info

Product compatibility

SmartConnector

Version 8.3

Release notes

The parser overrides have been updated to work with the 8.3.2 production parsers.

Languages

English

Files

Add parser overrides for 7.1.0.1-7.11.1 and 7.13.1 1.3.2.0

161.9 KB

Nov 8, 2019

More info Less info

Product compatibility

OpenText Enterprise Security Manager

Version 6.11.0 · 6.9.1

Version 7.0 · 7.2 · 7.3 · 7.1 · 7.4 · 7.5 · 7.6 · 7.7 · 7.8

Release notes

Added updated parser overrides, one for 7.10.1-7.11.1 and one for 7.13.1

Languages

English

Files

P-Linux 1.3.1.0

120.8 KB

May 25, 2018

More info Less info

Product compatibility

SmartConnector

Version 8.1 · 8.2 · 8.3

Release notes

Fix account lockout detection and expand SmartConnector support to latest versions

Parser overrides
- Add override for SmartConnector parser release 7.8.1
- Removed support for syslog parsers7.6.1-7.6.3
- Expanded 7.7.3 override to include parsers through 7.8.0.
- Changes made to syslog override to support lockout detection.
- Removed signature blocks from overrides
User Account Lockout detection
- Added ruleLinux User Account Lockout. This catches both faillock and tally2 lockouts.
- Added filters:
  - Linux User Account Lockout
  - Linux Syslog User Account Pam_tally2 User Login Attempts
  - Linux Syslog User Account Pam_faillock Lockout
  - Changed filter Linux Syslog User Password Logon to handle the login program
Renamed filterLinux Auditd User Account Locked with Passwd to Linux Auditd User Account Disabled with Passwd
Change sourceProcessId to destinationProcessId in several rules for consistency with other rules
- Linux User Account Deleted
- Linux User Account UID Changed
- Linux User Account Created

Languages

English

Files

P-Linux 1.3.0.0

116.9 KB

Apr 10, 2018

More info Less info

Product compatibility

OpenText Enterprise Security Manager

Version 6.8 · 6.11.0 · 6.9.1

Release notes

This release is based on a new parser override for Linux Audit events. This new override takes advantage of the merging capabilities of the production Linux Auditd parser and better maps the events to ArcSight fields, providing for more consistent ESM content.

Languages

English

Files

Resources

Documentation

Activate Wiki

Change Log and Discussion Forum

Activate Framework

Install Guide

Activate License

Marketplace

Marketplace

Activate P-Linux (Obsolete)

Product compatibility

CATEGORY

Description

Minimum Requirements

Suggested apps

NetIQ Privileged Account Manager

Data Generator

Airlock WAF

L3-Base - Threat and Impact Analysis (Obsolete)

Qualys QualysGuard

Which Tor

Playbook-Check IP Reputation from Multiple Sources

Cisco Aironet

Playbook-Command and Control Traffic-4

Releases

Resources

Sign in

Marketplace

Activate P-Linux (Obsolete)

App Support Tiers

Product compatibility

CATEGORY

Description

Minimum Requirements

Suggested apps

NetIQ Privileged Account Manager

Data Generator

Airlock WAF

L3-Base - Threat and Impact Analysis (Obsolete)

Qualys QualysGuard

Which Tor

Playbook-Check IP Reputation from Multiple Sources

Cisco Aironet

Playbook-Command and Control Traffic-4

Releases

Resources

Unsubscribe from notifications

Marketplace Terms of Service

Your download has begun