Syslog monitor listens for Syslog messages on the devices to which it is assigned.

Note: For more information about Syslog facilities and levels of severity, see RFC5424 (page 9 for facilities and page 10 for levels of severity).

Provide a unique name and description for the monitor, then click (WUG17.0N-IMG-ADD_CREDENTIAL_DISCOVERY) to launch the Rules Expression Editor to create an expression, test it, and compare it to potential payloads.

Important: If you define multiple payload Match On expressions, each expression is considered individually (think "or" operator).

See Also

Passive Monitors

Windows Event Log