.png?sv=2019-07-07&sig=QITWoCPqtjL3ODvYwjWwtHbc2S0gnoiqpAcWAzsxzno%3D&spr=https%2Chttp&st=2023-09-24T20%3A47%3A31Z&se=2023-09-24T20%3A57%3A31Z&srt=o&ss=b&sp=r){kind=logo}
Syslog Server - Send Log Message
- 07 Sep 2023
- 2 Minutes to read
- Print
- DarkLight
- PDF
Syslog Server - Send Log Message
- Updated on 07 Sep 2023
- 2 Minutes to read
- Print
- DarkLight
- PDF
Article Summary
Share feedback
Thanks for sharing your feedback!
Syslog Server - Send Log Message sends a message with the action results summary to syslog and optional messages with the device data for each of the devices in the query results as a JSON file. It sends a JSON file with data about the system entity queried, for queries created on Activity logs and Fetch History using filters.
To use this action, you must enable the Use Syslog setting and configure a Syslog host and port. For more details, see Configuring Syslog Settings.
The message includes:
- The Enforcement Set name
- The triggered query
- The condition for executing the Enforcement action (if it exists)
- The number of current and previous results
See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.
General Settings
- Enforcement Set name (required) - The name of the Enforcement Set. A default value is added by Axonius. You can change the name according to your needs.
- Add description - Click to add a description of the Enforcement Set. It is recommended to describe what the Enforcement Set does.
- Run action on assets matching following query (required) - Select an asset category and a query. The Enforcement Action will be run on the assets that match the query parameters.
- A query only returns results for the asset type it was created for.
- Not all asset categories are supported for all Enforcement Actions.
- See Actions supported for Activity Logs, Adapter Fetch History and Asset Investigation Modules
- See Actions supported for Vulnerabilities.
- See Actions supported for Software.
- Action name (required) - The name of the Main action. A default value is added by Axonius. You can change the name according to your needs.
- Configure Dynamic Values - Toggle on to enter a Dynamic Value statement. See Creating Enforcement Action Dynamic Value Statements to learn more about Dynamic Value statement syntax.
Message Example
Click to see a message example
Alert - "test" for the following query has been triggered: Missing Sophos
Alert Details
The alert was triggered because: The number of entities is above 0
The number of devices returned by the query:4
The previous number of devices was:4
You can view the query and its results here: https://demo-latest.axonius.com/devices?view=Missing Sophos
Action Settings
Click to view Action Settings
- Send result details (required, default: False) - Select whether to send additional messages to syslog with the details of the results.
- If enabled, in addition to the default Syslog message, Axonius will send a JSON file with details of the results.
- If disabled, Axonius will send to Syslog only the default message.
- Message severity (required, default: info) - Select the message severity: info, warning or error.
Additional Settings
Click to view Additional Settings
Tunnel Name - For Axonius-hosted (SaaS) deployments. Select the tunnel through which to connect to perform the action.
For more details about other Enforcement Actions available, see Action Library.