---
title: "Dell Isilon Integration"
slug: "dell-isilon"
updated: 2026-11-03T13:45:05Z
published: 2026-11-03T13:45:05Z
canonical: "docs.hunters.ai/dell-isilon"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Dell Isilon Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Dell Isilon (PowerScale) Audit Config Logs |  | ✅ | ✅ | ✅ | `dell_isilon_audit_config_logs` | Nested JSON/Text | S3 |

## Overview

Dell EMC Isilon (now PowerScale) is a scale-out network-attached storage (NAS) platform widely used for enterprise file storage. Isilon generates system audit logs that record configuration-management API activity performed against the cluster, such as administrative requests to the OneFS REST API (e.g., cluster node patch/upgrade operations). These logs are emitted in a syslog-like format (RFC 5424-style, with a facility identifier of "audit_config") and are typically forwarded via syslog collection pipelines (e.g., Cribl or similar log shippers) that wrap the raw syslog text or a parsed syslog structure in a JSON envelope before delivery to S3. Integrating these logs into Hunters provides an audit trail of administrative and configuration changes made on critical storage infrastructure, supporting insider-threat detection, change-management verification, and forensic investigation of unauthorized cluster modifications.

## Supported data types

### Dell Isilon (PowerScale) Audit Config Logs

**Table name:** `dell_isilon_audit_config_logs`

This data type contains audit records of configuration-management activity performed against the Isilon/PowerScale cluster through its OneFS REST API. Each record captures the requesting host, process, source/remote address, the API URI and HTTP method invoked, and any associated arguments, enabling detection of unauthorized or unexpected administrative and configuration changes on the storage cluster.

**Expected format**

Logs are expected in nested JSON/text format: one JSON object per line, with the `audit_config` syslog message under the `message` field.

```
{"message": "1 2026-01-04T01:00:06.000000-06:00 HOST-A01(id01) audit_config 5246 - - request: 7769; uid: ; sid: ; remote_addr: ; uri: /4/local/upgrade/cluster/nodes/all/patch/sync; method: POST; args[1/1]: {}", "source_ip": "10.22.14.101"}
```

Records whose syslog header was already split into separate fields by the log shipper are also supported:

```
{"extradata": "-", "host": "HOST-A01(id01)", "ident": "audit_config", "message": "request: 7740; uid: ; sid: ; remote_addr: ; uri: /4/local/upgrade/cluster/nodes/all/patch/sync; method: POST; args[1/1]: {}", "msgid": "-", "pid": "5246", "source_ip": "10.22.14.101"}
```

              💡Note

              

The event time is read from the syslog header inside `message`. Records in the second format carry no timestamp, so keep the full syslog line in `message` when your log shipper allows it.

## Send data to Hunters

Hunters supports the collection of Dell Isilon audit config logs using S3.

**To connect Dell Isilon logs:**

1. Configure your Isilon/PowerScale cluster (or an intermediary syslog collection pipeline, such as Cribl, used to forward the cluster's `audit_config` syslog stream) to deliver the audit configuration logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in [this section](https://docs.hunters.ai/docs/connect-data-through-aws-s3).