TL;DR
| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
| Proxmox VE Host Syslog (System/Auth Events) | ✅ | ✅ | ✅ | proxmox_host_syslog | JSON | S3 |
Overview
Proxmox VE (Virtual Environment) is an open-source server virtualization platform that manages KVM virtual machines and LXC containers across a cluster of hosts, built on a standard Debian-based Linux operating system. This integration ingests the host-level syslog/journald stream forwarded from Proxmox nodes, wrapped in a JSON envelope that preserves the original syslog priority, timestamp, hostname, and process name inside a free-text message field. While most events reflect generic Linux OS activity — systemd service lifecycle events, sshd-session authentication and disconnection events, and PAM session open/close notifications — a smaller subset surfaces Proxmox-specific daemon activity (such as pveproxy ACL warnings) and ESXi-import tooling errors related to VMware migration. For security operations, this data provides visibility into SSH authentication attempts and disconnections, privileged session activity, and service-level behavior on virtualization infrastructure that frequently hosts critical workloads.
Supported data types
Proxmox VE Host Syslog (System/Auth Events)
Table name: proxmox_host_syslog
This data type contains the host-level syslog/journald stream forwarded from Proxmox VE nodes, capturing SSH authentication and disconnection events, PAM session open/close activity, systemd service and socket lifecycle events, and occasional Proxmox-specific daemon output (e.g. pveproxy ACL warnings) or ESXi-import tooling errors. It is primarily useful for tracking authentication activity and privileged session behavior on virtualization hosts.
Expected format
Logs are expected in JSON format.
{"message": "<38>Feb 4 03:32:10 host-d4e5f6 sshd-session[64563]: Accepted password for admin from 192.0.2.20 port 59302 ssh2", "src_host": "host-d4e5f6.example.com", "src_ip": "192.0.2.11"}
Send data to Hunters
Hunters supports the collection of Proxmox logs using S3.
To connect Proxmox logs:
- Configure your Proxmox VE hosts to forward their syslog/journald stream (via your preferred log shipper or syslog forwarder) into an AWS S3 bucket, preserving the JSON envelope format described above. Refer to the Proxmox VE Administration Guide and Proxmox log files documentation for guidance on locating and forwarding host syslog data.
- Once logs are landing in S3, follow the steps in this section to connect the S3 bucket to Hunters.