Update 'Home'

Home.md

@@ -153,3 +153,40 @@ then
 end
 ```
 
+
+fields:
+HOST
+APP
+UNIT
+SEVERITY
+FACILITY
+source
+
+
+System → Content Packs
+
+
+1. Pipeline rule: parse rsyslog fields
+2. Stream: Linux Syslog
+3. Dashboard: Linux Asset Detail
+4. Export all as Content Pack
+
+
+Pipeline rule:
+parse HOST, APP, UNIT, COMM, EXE, PID, SEVERITY, FACILITY
+
+Stream:
+Linux Syslog where HOST exists
+
+Dashboard:
+Linux Asset Detail with dashboard parameters:
+asset = HOST
+unit = UNIT
+
+Then widget queries:
+HOST:$asset$
+HOST:$asset$ AND UNIT:$unit$
+HOST:$asset$ AND SEVERITY:(err OR crit OR alert OR emerg)
+HOST:$asset$ AND APP:sshd
+HOST:$asset$ AND APP:sudo
+HOST:$asset$ AND APP:auditd