IBM AIX Collections

AIR supports the following AIX Evidence and Artifacts

AIX Evidence List

#	Category	Evidence (click for details)	Parsed	Sent to the Investigation Hub	Source Files Collected
1	Applications	AnyDesk Logs	No	Yes	Yes
2	Applications	Apache Logs	No	Yes	Yes
3	Applications	Discord Desktop Cache	No	Yes	Yes
4	Applications	Docker Logs	No	Yes	Yes
5	Applications	Homebrew Logs	No	Yes	Yes
6	Applications	MongoDB Logs	No	Yes	Yes
7	Applications	NGINX Logs	No	Yes	Yes
8	Applications	Parallels Logs	No	Yes	Yes
9	Applications	PostgreSQL Logs	No	Yes	Yes
10	Applications	Sophos Events Database	No	Yes	Yes
11	Applications	Sophos Logs	No	Yes	Yes
12	Applications	Splashtop Mac Logs	No	Yes	Yes
13	Applications	Teamviewer Logs	No	Yes	Yes
14	DiskFilesystem	File System Enumeration	Yes	Yes	No
15	DiskFilesystem	Mounts	Yes	Yes	No
16	Network	DNS Resolvers	Yes	Yes	No
17	Network	Hosts	Yes	Yes	No
18	Network	SSH Authorized Keys	Yes	Yes	No
19	Network	SSH Configs	Yes	Yes	No
20	Network	SSH Known Hosts	Yes	Yes	No
21	Network	SSHD Configs	Yes	Yes	No
22	System	Cron Jobs	Yes	Yes	No
23	System	Install Logs	No	Yes	Yes
24	System	KnowledgeC	No	Yes	Yes
25	System	Log Files	Yes	Yes	No
26	System	Processes	Yes	Yes	No
27	System	SUID Binaries	Yes	Yes	No
28	System	Shell History	Yes	Yes	No
29	System	System Artifacts	Yes	Yes	No
30	System	ULimit Information	Yes	Yes	No
31	System	User Groups	Yes	Yes	No
32	System	Users	Yes	Yes	No
33	System	Wifi Logs	No	Yes	Yes
34	System	YUM History	Yes	Yes	No
35	System	YUM Sources	Yes	Yes	No

AIX Artifact List:

#	Category	Evidence (click for details)	Parsed	Sent to the Investigation Hub	Source Files Collected
1	Applications	DHCP Server Logs	No	No	Yes
2	Applications	MySQL Logs	No	No	Yes
3	Applications	SSH Server Logs	No	No	Yes
4	Applications	System Logs	No	No	Yes
5	System	Auth Logs	No	No	Yes
6	System	Boot Logs	No	No	Yes
7	System	Mail Logs	No	No	Yes