Additional Syslog Data Source Information

Starting with Privilege Manager version 13.0.0, the data source dropdown when creating or editing a Syslog server task only displays data sources that are tagged as Syslog-compatible. If your organization uses custom (bespoke) data sources with Syslog, they will not appear in the data source drop-down after upgrading to v13.0.0 unless you add the pm.syslogcompatible tag to the data source's XML item definition. See Additional Syslog Data Source Information.
Existing Syslog tasks that are already configured with a custom data source will continue to function. This change only affects the drop-down selection when creating new tasks or editing the data source on existing tasks.

All build-in SysLog tasks and supported data sources declare the following fields:

• Facility

• Severity

• EventTime

• Host

• DeviceVendor

• DeviceProduct

• DeviceVersion

• Name

The other fields vary by the report.

Report	Fields
Application Control Justification Events	PolicyName, ComputerName, UserName, UserReason, FileName, FilePath, EventReceivedByServer
Application Control Policy Feedback	PolicyName, ComputerName, UserName, FileName, FilePath, EventReceivedByServer, Rating
Recently Discovered Applications Query	FileName, FileHashSha1, FIleHashSha256, FileFirstSeenByServer, Rating
Local Security Password Disclosure Events	Requesting User, RemoteIpAddress, ManagedUserName, ComputerDomain, ComputerName
Application Control Policy Feedback Restricted to Security Level	PolicyName, ComputerName, UserName, FileName, FilePath, EventReceivedByServer, Rating
Application Approval Requests Events	ApprovalTypeId, ApprovalProcessId, RequestorId, ResourceId, CreationTime, LastUpdateTime, ExpiryTime, PolicyId, UserReason, FilePath, SHA256_Hash, ApprovalStatus, ApprovalRequestId, ApproverId, ActionTime, Comment, ApprovedDuration, EventTime, UserId, UserName, UserSid, AgentId, ConsumedByProcessPath, ConsumedByProcessId
Change History	CorrelationId, ItemId, Name, UserId, UserName, Change Details