📢 Read the latest Release Notes to learn what's new on Hunters! 💡

Dell Isilon Integration

  • Published on Nov 3, 2026
Prev Next

TL;DR

Supported data types 3rd party detection Hunters detection IOC search Search Table name Log format Collection method
Dell Isilon (PowerScale) Audit Config Logs ✅ ✅ ✅ dell_isilon_audit_config_logs Nested JSON/Text S3

Overview

Dell EMC Isilon (now PowerScale) is a scale-out network-attached storage (NAS) platform widely used for enterprise file storage. Isilon generates system audit logs that record configuration-management API activity performed against the cluster, such as administrative requests to the OneFS REST API (e.g., cluster node patch/upgrade operations). These logs are emitted in a syslog-like format (RFC 5424-style, with a facility identifier of "audit_config") and are typically forwarded via syslog collection pipelines (e.g., Cribl or similar log shippers) that wrap the raw syslog text or a parsed syslog structure in a JSON envelope before delivery to S3. Integrating these logs into Hunters provides an audit trail of administrative and configuration changes made on critical storage infrastructure, supporting insider-threat detection, change-management verification, and forensic investigation of unauthorized cluster modifications.

Supported data types

Dell Isilon (PowerScale) Audit Config Logs

Table name: dell_isilon_audit_config_logs

This data type contains audit records of configuration-management activity performed against the Isilon/PowerScale cluster through its OneFS REST API. Each record captures the requesting host, process, source/remote address, the API URI and HTTP method invoked, and any associated arguments, enabling detection of unauthorized or unexpected administrative and configuration changes on the storage cluster.

Expected format

Logs are expected in nested JSON/text format: one JSON object per line, with the audit_config syslog message under the message field.

{"message": "1 2026-01-04T01:00:06.000000-06:00 HOST-A01(id01) audit_config 5246 - - request: 7769; uid: ; sid: ; remote_addr: ; uri: /4/local/upgrade/cluster/nodes/all/patch/sync; method: POST; args[1/1]: {}", "source_ip": "10.22.14.101"}

Records whose syslog header was already split into separate fields by the log shipper are also supported:

{"extradata": "-", "host": "HOST-A01(id01)", "ident": "audit_config", "message": "request: 7740; uid: ; sid: ; remote_addr: ; uri: /4/local/upgrade/cluster/nodes/all/patch/sync; method: POST; args[1/1]: {}", "msgid": "-", "pid": "5246", "source_ip": "10.22.14.101"}
💡Note

The event time is read from the syslog header inside message. Records in the second format carry no timestamp, so keep the full syslog line in message when your log shipper allows it.

Send data to Hunters

Hunters supports the collection of Dell Isilon audit config logs using S3.

To connect Dell Isilon logs:

  1. Configure your Isilon/PowerScale cluster (or an intermediary syslog collection pipeline, such as Cribl, used to forward the cluster's audit_config syslog stream) to deliver the audit configuration logs into an AWS S3 bucket.
  2. Once logs are in S3, follow the steps in this section.