cortex XDR XQL "xdr_event_log" "var/log/secure" and "var/log/wtmp"

frank.f.lu — Wed, 27 Mar 2024 03:54:28 GMT

Dear all,

Does anyone know the log source for action_evtlog_provider_name = "var/log/wtmp"? As I know, wtmp is last log as follow:

However, I find that the result is not only wtmp log but also secure successful log in cortex XDR:

So does anyone know the real log source for "var/log/wtmp" or the mechanism? Thanks a lot!

Re: cortex XDR XQL "xdr_event_log" "var/log/secure" and "var/log/wtmp"

nsinghvirk — Tue, 02 Apr 2024 15:59:56 GMT

Thanks for reaching out on LiveCommunity!

"var/log/wtmp" contains the historical data regarding user login and logout events. For more details please refer linux documentation.