Proxmox VE
Overview
- Vendor: Proxmox
- Supported environment: On-Prem
- Version compatibility: 9.2
- Detection based on: Telemetry
- Supported application or feature:
Proxmox VE is an open-source virtualization platform combining KVM virtual machines, LXC containers, cluster orchestration, integrated networking, and firewall capabilities.
Beta
This integration is currently in beta. Features, field names and suggested rules may change. Validate parsing and detection rules before deploying to production.
Configure
Prerequisites
An internal log concentrator is required to collect and forward events to Sekoia.io.
Create the intake
Go to the intake page and create a new intake from the format Proxmox VE.
Mount Sekoia forwarder
Please consult the Syslog Forwarding documentation to forward these logs to Sekoia.io.
Configure Proxmox node
Create a new configuration file:
Run these commands on your Proxmox VE 9.2 host via SSH/shell as root:
# 1. Install rsyslog (required for Debian 13 / PVE 9.2)
apt update && apt install rsyslog -y
# 2. Write targeted Sekoia forwarding configuration
cat << 'EOF' > /etc/rsyslog.d/50-sekoia.conf
# Tail web access and firewall files directly from disk
module(load="imfile")
input(type="imfile"
File="/var/log/pveproxy/access.log"
Tag="pveproxy-access"
Severity="info"
Facility="local0")
input(type="imfile"
File="/var/log/pve-firewall.log"
Tag="pve-firewall"
Severity="info"
Facility="local0")
# Filter and forward high-value security logs
if (
$syslogfacility-text == 'auth' or
$syslogfacility-text == 'authpriv' or
$programname == 'sshd' or
$programname == 'sudo' or
$programname == 'pvedaemon' or
$programname == 'pveproxy' or
$programname == 'pvestatd' or
$programname == 'corosync' or
$programname == 'pve-ha-crm' or
$programname == 'pveproxy-access' or
$programname == 'pve-firewall'
) then {
action(type="omfwd"
target="192.168.1.50"
port="20516"
protocol="tcp")
}
EOF
# 3. MUST REPLACE: 192.168.1.50 with your Sekoia Forwarder IP address
FORWARDER_IP="192.168.1.50"
sed -i "s/192.168.1.50/${FORWARDER_IP}/g" /etc/rsyslog.d/50-sekoia.conf
# 4. Verify configuration syntax and restart rsyslog
rsyslogd -N1
systemctl enable --now rsyslog
Test connection
Run this command on your Proxmox VE 9.2 node to trigger a test log:
logger -t pvedaemon "Sekoia Test Log from Proxmox VE 9.2 Node"
Verify that the message appears under Events in your Sekoia workspace.
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
Jul 02 15:55:51 hostname sshd-session[8530]: Invalid user admin from 192.168.122.1 port 53094
Jul 02 15:55:54 hostname sshd-session[8530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.122.1
Jul 02 15:55:56 hostname sshd-session[8530]: Failed password for invalid user admin from 192.168.122.1 port 53094 ssh2
Jul 02 15:56:37 hostname sshd-session[8663]: Accepted password for root from 192.168.122.1 port 43660 ssh2
Aug 05 12:33:59 hostname login[812912]: pam_unix(login:session): session opened for user root(uid=0) by root(uid=0)
Aug 05 12:38:38 hostname pvedaemon[3357098]: <root@pam> successful auth for user 'root@pam'
Jul 02 15:58:27 hostname pve-ha-crm[1055]: starting server
Jul 02 15:58:27 hostname pve-ha-crm[1055]: status change startup => wait_for_quorum
Jul 06 15:34:56 hostname pve-ha-crm[1055]: received signal TERM
Jul 06 15:34:56 hostname pve-ha-crm[1055]: server received shutdown request
Jul 06 15:34:56 hostname pve-ha-crm[1055]: server stopped
0 5 PVEFW-HOST-IN 05/Aug/2026:12:35:31 +0300 DROP: IN=vmbr0 PHYSIN=enp1s0 MAC=02:00:00:00:00:01:02:00:00:00:00:02:08:00 SRC=192.168.50.49 DST=192.168.50.104 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=63356 DF PROTO=TCP SPT=34144 DPT=8006 SEQ=774561632 ACK=0 WINDOW=64240 SYN
Aug 05 12:34:13 hostname pvedaemon[3357098]: <root@pam> end task UPID:hostname:00112233:44556677:8899AABB:vncshell::root@pam: OK
Aug 05 12:39:18 hostname pvedaemon[3357684]: <root@pam> starting task UPID:hostname:00112233:44556677:8899AABB:vncshell::root@pam:
Aug 01 16:50:44 hostname pvedaemon[3805324]: <root@pam> end task UPID:hostname:00112233:44556677:8899AABB:vncproxy:200:root@pam: connection timed out
::ffff:192.168.122.1 - root@pam [31/07/2026:16:55:30 +0200] "GET /api2/json/cluster/tasks HTTP/1.1" 200 911
::ffff:192.168.122.1 - root@pam [31/07/2026:16:55:32 +0200] "GET /api2/json/cluster/resources HTTP/1.1" 200 759
::ffff:192.168.122.1 - root@pam [31/07/2026:16:55:34 +0200] "GET /api2/json/nodes/pve/status HTTP/1.1" 200 1072
192.168.7.10 - user1@ldap [30/07/2020:14:24:48 +0200] "POST /api2/json/nodes/devel1/qemu/225/agent/shutdown HTTP/1.1" 596 -
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
API monitoring |
None |
Application logs |
None |
Authentication logs |
None |
Network device logs |
None |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | `` |
| Category | authentication, host, network, web |
| Type | access, connection, info, start |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "Jul 02 15:55:51 hostname sshd-session[8530]: Invalid user admin from 192.168.122.1 port 53094",
"event": {
"action": "invalid_user",
"category": [
"authentication"
],
"dataset": "proxmox.ve",
"outcome": "failure",
"reason": "Invalid user",
"type": [
"start"
]
},
"@timestamp": "2026-07-02T15:55:51Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "sshd-session",
"pid": 8530
},
"related": {
"ip": [
"192.168.122.1"
],
"user": [
"admin"
]
},
"source": {
"address": "192.168.122.1",
"ip": "192.168.122.1",
"port": 53094
},
"user": {
"name": "admin"
}
}
{
"message": "Jul 02 15:55:54 hostname sshd-session[8530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.122.1",
"event": {
"action": "authentication_failure",
"category": [
"authentication"
],
"dataset": "proxmox.ve",
"outcome": "failure",
"reason": "authentication failure",
"type": [
"start"
]
},
"@timestamp": "2026-07-02T15:55:54Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "sshd-session",
"pid": 8530
},
"related": {
"ip": [
"192.168.122.1"
]
},
"source": {
"address": "192.168.122.1",
"ip": "192.168.122.1"
}
}
{
"message": "Jul 02 15:55:56 hostname sshd-session[8530]: Failed password for invalid user admin from 192.168.122.1 port 53094 ssh2",
"event": {
"action": "failed_password",
"category": [
"authentication"
],
"dataset": "proxmox.ve",
"outcome": "failure",
"reason": "Failed password for invalid user",
"type": [
"start"
]
},
"@timestamp": "2026-07-02T15:55:56Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "sshd-session",
"pid": 8530
},
"related": {
"ip": [
"192.168.122.1"
],
"user": [
"admin"
]
},
"source": {
"address": "192.168.122.1",
"ip": "192.168.122.1",
"port": 53094
},
"user": {
"name": "admin"
}
}
{
"message": "Jul 02 15:56:37 hostname sshd-session[8663]: Accepted password for root from 192.168.122.1 port 43660 ssh2",
"event": {
"action": "accepted_password",
"category": [
"authentication"
],
"dataset": "proxmox.ve",
"outcome": "success",
"reason": "Accepted password",
"type": [
"start"
]
},
"@timestamp": "2026-07-02T15:56:37Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "sshd-session",
"pid": 8663
},
"related": {
"ip": [
"192.168.122.1"
],
"user": [
"root"
]
},
"source": {
"address": "192.168.122.1",
"ip": "192.168.122.1",
"port": 43660
},
"user": {
"name": "root"
}
}
{
"message": "Aug 05 12:33:59 hostname login[812912]: pam_unix(login:session): session opened for user root(uid=0) by root(uid=0)",
"event": {
"action": "session_opened",
"category": [
"authentication"
],
"dataset": "proxmox.ve",
"outcome": "success",
"reason": "session opened",
"type": [
"start"
]
},
"@timestamp": "2026-08-05T12:33:59Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "login",
"pid": 812912
},
"related": {
"user": [
"root"
]
},
"user": {
"name": "root"
}
}
{
"message": "Aug 05 12:38:38 hostname pvedaemon[3357098]: <root@pam> successful auth for user 'root@pam'",
"event": {
"action": "successful_auth",
"category": [
"authentication"
],
"dataset": "proxmox.ve",
"outcome": "success",
"reason": "successful auth",
"type": [
"start"
]
},
"@timestamp": "2026-08-05T12:38:38Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pvedaemon",
"pid": 3357098
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "pam"
}
}
},
"related": {
"user": [
"root"
]
},
"user": {
"name": "root"
}
}
{
"message": "Jul 02 15:58:27 hostname pve-ha-crm[1055]: starting server",
"event": {
"action": "cluster_ha_event",
"category": [
"host"
],
"dataset": "proxmox.ve",
"reason": "starting server",
"type": [
"info"
]
},
"@timestamp": "2026-07-02T15:58:27Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pve-ha-crm",
"pid": 1055
}
}
{
"message": "Jul 02 15:58:27 hostname pve-ha-crm[1055]: status change startup => wait_for_quorum",
"event": {
"action": "cluster_ha_event",
"category": [
"host"
],
"dataset": "proxmox.ve",
"reason": "status change startup => wait_for_quorum",
"type": [
"info"
]
},
"@timestamp": "2026-07-02T15:58:27Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pve-ha-crm",
"pid": 1055
}
}
{
"message": "Jul 06 15:34:56 hostname pve-ha-crm[1055]: received signal TERM",
"event": {
"action": "cluster_ha_event",
"category": [
"host"
],
"dataset": "proxmox.ve",
"reason": "received signal TERM",
"type": [
"info"
]
},
"@timestamp": "2026-07-06T15:34:56Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pve-ha-crm",
"pid": 1055
}
}
{
"message": "Jul 06 15:34:56 hostname pve-ha-crm[1055]: server received shutdown request",
"event": {
"action": "cluster_ha_event",
"category": [
"host"
],
"dataset": "proxmox.ve",
"reason": "server received shutdown request",
"type": [
"info"
]
},
"@timestamp": "2026-07-06T15:34:56Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pve-ha-crm",
"pid": 1055
}
}
{
"message": "Jul 06 15:34:56 hostname pve-ha-crm[1055]: server stopped",
"event": {
"action": "cluster_ha_event",
"category": [
"host"
],
"dataset": "proxmox.ve",
"reason": "server stopped",
"type": [
"info"
]
},
"@timestamp": "2026-07-06T15:34:56Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pve-ha-crm",
"pid": 1055
}
}
{
"message": "0 5 PVEFW-HOST-IN 05/Aug/2026:12:35:31 +0300 DROP: IN=vmbr0 PHYSIN=enp1s0 MAC=02:00:00:00:00:01:02:00:00:00:00:02:08:00 SRC=192.168.50.49 DST=192.168.50.104 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=63356 DF PROTO=TCP SPT=34144 DPT=8006 SEQ=774561632 ACK=0 WINDOW=64240 SYN",
"event": {
"action": "drop",
"category": [
"network"
],
"dataset": "proxmox.ve",
"outcome": "failure",
"type": [
"connection"
]
},
"@timestamp": "2026-08-05T09:35:31Z",
"destination": {
"address": "192.168.50.104",
"ip": "192.168.50.104",
"mac": "02:00:00:00:00:01",
"port": 8006
},
"network": {
"transport": "tcp"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"related": {
"ip": [
"192.168.50.104",
"192.168.50.49"
]
},
"source": {
"address": "192.168.50.49",
"ip": "192.168.50.49",
"mac": "02:00:00:00:00:02",
"port": 34144
}
}
{
"message": "Aug 05 12:34:13 hostname pvedaemon[3357098]: <root@pam> end task UPID:hostname:00112233:44556677:8899AABB:vncshell::root@pam: OK",
"event": {
"action": "end_task",
"category": [
"host"
],
"dataset": "proxmox.ve",
"type": [
"info"
]
},
"@timestamp": "2026-08-05T12:34:13Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pvedaemon",
"pid": 3357098
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "pam"
},
"task": {
"id": "UPID:hostname:00112233:44556677:8899AABB:vncshell::root@pam",
"result": "OK"
}
}
},
"related": {
"user": [
"root"
]
},
"user": {
"name": "root"
}
}
{
"message": "Aug 05 12:39:18 hostname pvedaemon[3357684]: <root@pam> starting task UPID:hostname:00112233:44556677:8899AABB:vncshell::root@pam:",
"event": {
"action": "starting_task",
"category": [
"host"
],
"dataset": "proxmox.ve",
"type": [
"info"
]
},
"@timestamp": "2026-08-05T12:39:18Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pvedaemon",
"pid": 3357684
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "pam"
},
"task": {
"id": "UPID:hostname:00112233:44556677:8899AABB:vncshell::root@pam:"
}
}
},
"related": {
"user": [
"root"
]
},
"user": {
"name": "root"
}
}
{
"message": "Aug 01 16:50:44 hostname pvedaemon[3805324]: <root@pam> end task UPID:hostname:00112233:44556677:8899AABB:vncproxy:200:root@pam: connection timed out",
"event": {
"action": "end_task",
"category": [
"host"
],
"dataset": "proxmox.ve",
"type": [
"info"
]
},
"@timestamp": "2026-08-01T16:50:44Z",
"host": {
"name": "hostname"
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"process": {
"name": "pvedaemon",
"pid": 3805324
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "pam"
},
"task": {
"id": "UPID:hostname:00112233:44556677:8899AABB:vncproxy:200:root@pam",
"result": "connection timed out"
}
}
},
"related": {
"user": [
"root"
]
},
"user": {
"name": "root"
}
}
{
"message": "::ffff:192.168.122.1 - root@pam [31/07/2026:16:55:30 +0200] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 911",
"event": {
"action": "/api2/json/cluster/tasks",
"category": [
"web"
],
"dataset": "proxmox.ve",
"outcome": "success",
"type": [
"access"
]
},
"@timestamp": "2026-07-31T14:55:30Z",
"http": {
"request": {
"method": "GET"
},
"response": {
"body": {
"bytes": 911
},
"status_code": 200
}
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "pam"
}
}
},
"related": {
"ip": [
"192.168.122.1"
],
"user": [
"root"
]
},
"source": {
"address": "192.168.122.1",
"ip": "192.168.122.1"
},
"url": {
"original": "/api2/json/cluster/tasks",
"path": "/api2/json/cluster/tasks"
},
"user": {
"name": "root"
}
}
{
"message": "::ffff:192.168.122.1 - root@pam [31/07/2026:16:55:32 +0200] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 759",
"event": {
"action": "/api2/json/cluster/resources",
"category": [
"web"
],
"dataset": "proxmox.ve",
"outcome": "success",
"type": [
"access"
]
},
"@timestamp": "2026-07-31T14:55:32Z",
"http": {
"request": {
"method": "GET"
},
"response": {
"body": {
"bytes": 759
},
"status_code": 200
}
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "pam"
}
}
},
"related": {
"ip": [
"192.168.122.1"
],
"user": [
"root"
]
},
"source": {
"address": "192.168.122.1",
"ip": "192.168.122.1"
},
"url": {
"original": "/api2/json/cluster/resources",
"path": "/api2/json/cluster/resources"
},
"user": {
"name": "root"
}
}
{
"message": "::ffff:192.168.122.1 - root@pam [31/07/2026:16:55:34 +0200] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 1072",
"event": {
"action": "/api2/json/nodes/pve/status",
"category": [
"web"
],
"dataset": "proxmox.ve",
"outcome": "success",
"type": [
"access"
]
},
"@timestamp": "2026-07-31T14:55:34Z",
"http": {
"request": {
"method": "GET"
},
"response": {
"body": {
"bytes": 1072
},
"status_code": 200
}
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "pam"
}
}
},
"related": {
"ip": [
"192.168.122.1"
],
"user": [
"root"
]
},
"source": {
"address": "192.168.122.1",
"ip": "192.168.122.1"
},
"url": {
"original": "/api2/json/nodes/pve/status",
"path": "/api2/json/nodes/pve/status"
},
"user": {
"name": "root"
}
}
{
"message": "192.168.7.10 - user1@ldap [30/07/2020:14:24:48 +0200] \"POST /api2/json/nodes/devel1/qemu/225/agent/shutdown HTTP/1.1\" 596 -",
"event": {
"action": "/api2/json/nodes/devel1/qemu/225/agent/shutdown",
"category": [
"web"
],
"dataset": "proxmox.ve",
"outcome": "failure",
"type": [
"access"
]
},
"@timestamp": "2020-07-30T12:24:48Z",
"http": {
"request": {
"method": "POST"
},
"response": {
"status_code": 596
}
},
"observer": {
"product": "Proxmox VE",
"type": "hypervisor",
"vendor": "Proxmox"
},
"proxmox": {
"proxmox_ve": {
"auth": {
"realm": "ldap"
}
}
},
"related": {
"ip": [
"192.168.7.10"
],
"user": [
"user1"
]
},
"source": {
"address": "192.168.7.10",
"ip": "192.168.7.10"
},
"url": {
"original": "/api2/json/nodes/devel1/qemu/225/agent/shutdown",
"path": "/api2/json/nodes/devel1/qemu/225/agent/shutdown"
},
"user": {
"name": "user1"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
destination.ip |
ip |
IP address of the destination. |
destination.mac |
keyword |
MAC address of the destination. |
destination.port |
long |
Port of the destination. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.dataset |
keyword |
Name of the dataset. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
host.name |
keyword |
Name of the host. |
http.request.method |
keyword |
HTTP request method. |
http.response.body.bytes |
long |
Size in bytes of the response body. |
http.response.status_code |
long |
HTTP response status code. |
network.transport |
keyword |
Protocol Name corresponding to the field iana_number. |
observer.product |
keyword |
The product name of the observer. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
process.name |
keyword |
Process name. |
process.pid |
long |
Process id. |
proxmox.proxmox_ve.auth.realm |
keyword |
Auth realm |
proxmox.proxmox_ve.task.id |
keyword |
Task ID |
proxmox.proxmox_ve.task.result |
keyword |
Task result |
source.ip |
ip |
IP address of the source. |
source.mac |
keyword |
MAC address of the source. |
source.port |
long |
Port of the source. |
url.original |
wildcard |
Unmodified original url as seen in the event source. |
user.name |
keyword |
Short name or login of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.