MySQL Enterprise (v1.0.12)

The modeling rules for MySQL Enterprise event collectors.

Author: Cortex XSOAR
Support: xsoar
URL: https://www.paloaltonetworks.com/cortex
Categories: Analytics & SIEM

Modeling rules (1)

MySQL Enterprise Modeling Rules

Parsing rules (1)

MySQLEnterprise Parsing Rule

XDRC Templates (1)

MySQLEnterprise

README

This pack includes XSIAM content.

MySQL Enterprise Server Configuration

Install the audit log plugin
After the audit log plugin installation verify the following two lines in the my.cnf file:

plugin-load = audit_log.so
audit_log_format=JSON

Note: In order to parse the timestamp correctly, make sure that the timestamp field is in the default time zone - UTC.
The supported time format is yyyy-MM-dd hh:mm:ss (2021-12-08 10:00:00).

XDRC (XDR Collector)

You will need to use the information described here.\
You can configure the vendor and product by replacing [vendor]_[product]_raw with mysql_enterprise_raw.\
When configuring the instance, you should use a yml that configures the vendor and product, like this example:

filebeat.inputs:
- type: filestream
  enabled: true
  json.keys_under_root: true
  json.add_error_key: true
  paths:
    - /var/lib/mysql/audit.log
  processors:
    - add_fields:
        fields:
          vendor: mysql
          product: enterprise