We are currently working on a Linux log onboarding use case using Cribl Edge/File Monitor and forwarding the processed events to ADX/Sentinel.
We have already built a pipeline that can parse some common Linux authentication events, especially from auth.log/sshd, such as SSH successful login, invalid user attempts, failed login attempts, sudo activity, and session open/close events.
However, our broader requirement is to parse and normalize multiple standard Linux log paths, including:
/var/log/messages
/var/log/secure
/var/log/cron
/var/log/maillog
/var/log/boot.log
/var/log/dmesg
/var/log/btmp
/var/log/wtmp
/var/log/lastlog
/var/log/audit/audit.log
I wanted to check with the community:
- Has anyone implemented a reusable Linux OS log parsing pipeline in Cribl for these standard paths?
- Are there any community packs, templates, Grok libraries, or reference pipelines available for Linux authentication, audit, cron, secure, messages, btmp/wtmp/lastlog, etc.?
- For File Monitor-based collection, what is the recommended approach to normalize these logs without creating many separate Grok functions for every message variation?
- Has anyone successfully mapped these Linux OS logs into ADX/Sentinel or another SIEM with a reusable parsing strategy?
Any guidance, sample pipelines, packs, or best-practice recommendations would be highly appreciated.