Windows & Linux Server Audit logs native Integration

[Rajat_Kulkarni]

Chronicle recently included the Native (One-click) integration for Windows and Linux Audit logging, I did try this with installing OPs agent on the VM but no success.

Has anyone tried this? do we need to enable anything else apart from OPs agent?

Below are the export filters included for this integrations.

•  WINEVTLOG:
  • log_id("winevt.raw")
  • log_id("windows_event_log")
• NIX_SYSTEM:
  • log_id("syslog")
  • log_id("authlog")
  • log_id("securelog")
• LINUX_SYSMON:
  • log_id("sysmon.raw")
• AUDITD:
  • log_id("audit_log")

Thank you for the replies.