You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "Casey Stella (JIRA)" <ji...@apache.org> on 2016/05/17 14:22:13 UTC
[jira] [Comment Edited] (METRON-161) Create AD Parser
[ https://issues.apache.org/jira/browse/METRON-161?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15286699#comment-15286699 ]
Casey Stella edited comment on METRON-161 at 5/17/16 2:21 PM:
--------------------------------------------------------------
I'm interested in this for user enrichment. Does this contain the source IP that the request came from?
I should clarify, the information that I thought we'd get are the source IP and the username for logon (and maybe logoff) events in AD. Any chance of that?
was (Author: cestella):
I'm interested in this for user enrichment. Does this contain the source IP that the request came from?
> Create AD Parser
> ----------------
>
> Key: METRON-161
> URL: https://issues.apache.org/jira/browse/METRON-161
> Project: Metron
> Issue Type: New Feature
> Reporter: Deeptaanshu Kumar
>
> Create a parser for the Active Directory telemetry source. This data source has 3 formats that should be parsed as specified below:
> Required Active Directory fields:
> dcName
> admonEventType
> description
> distinguishedName
> DC
> CN
> whenChanged
> whenCreated
> memberOf
> userAccountControl
> Sample Active Directory log message:
> 04/11/2016 17:00:03.182
> dcName=wewewew.google.com
> admonEventType=Update
> Names:
> objectCategory=CN=ms-DS-Az-Role,CN=Schema,CN=Configuration,DC=google,DC=com
> name=CRA3
> distinguishedName=CN=CRA,CN=AzRoleObjectContainer-f2c06b86-f897-4ca4-ac5e-2762c25c5da4,CN=f2c06b86-f897-4ca4-ac5e-2762c25c5da4,CN=636cb236-cdb1-443b-bfb3-7683dd85b2f4,CN=Authorization,CN=Corporate,OU=Zones,OU=UNIX,DC=google,DC=com
> cn=CRA
> Object Details:
> objectGUID=dd4fb895-3672-4f0c-bd73-f41f05205f37
> whenChanged=05:00.03 PM, Mon 04/11/2016
> whenCreated=04:59.49 PM, Mon 04/11/2016
> objectClass=top|msDS-AzRole
> Event Details:
> uSNChanged=1645647639
> uSNCreated=1645647635
> instanceType=4
> Additional Details:
> msDS-AzApplicationData=ptype=g
> msDS-TasksForAzRole=CN=role-Unix Sysadmin,CN=AzTaskObjectContainer-636cb236-cdb1-443b-bfb3-7683dd85b2f4,CN=636cb236-cdb1-443b-bfb3-7683dd85b2f4,CN=Authorization,CN=Corporate,OU=Zones,OU=UNIX,DC=google,DC=com
> msDS-MembersForAzRole=CN=PAWS_ENVPR_DDEPROD_ADM,OU=Bigdata,OU=Groups,DC=google,DC=com
> dSCorePropagationData=16010101000000.0Z
> showInAdvancedViewOnly=TRUE
> Data after parsing:
> { "timestamp": "April 11th 2016 17:00:03 (NOTE: Timezone unknown. Solve for this)", "hostname": "wewewew", "dcName": "wewewew.google.com", "admonEventType": "Update", "names.objectCategory": "CN=ms-DS-Az-Role,CN=Schema,CN=Configuration,DC=google,DC=com", "names.name": "CRA", "names.distinguishedName": "CN=CRA,CN=AzRoleObjectContainer-f2c06b86-f897-4ca4-ac5e-2762c25c5da4,CN=f2c06b86-f897-4ca4-ac5e-2762c25c5da4,CN=636cb236-cdb1-443b-bfb3-7683dd85b2f4,CN=Authorization,CN=Corporate,OU=Zones,OU=UNIX,DC=google,DC=com", "names.cn": "CRA", "object.objectGUID": "dd4fb895-3672-4f0c-bd73-f41f05205f37", "object.whenChanged": "05:00.03 PM, Mon 04/11/2016", "object.whenCreated": "04:59.49 PM, Mon 04/11/2016", "object.objectClass": "top|msDS-AzRole", "event.uSNChanged": "1645647639", "event.uSNCreated": "1645647635", event.instanceType": "4", "additional.msDS-AzApplicationData": "ptype=g", "additional.msDS-TasksForAzRole": "CN=role-Unix Sysadmin,CN=AzTaskObjectContainer-636cb236-cdb1-443b-bfb3-7683dd85b2f4,CN=636cb236-cdb1-443b-bfb3-7683dd85b2f4,CN=Authorization,CN=Corporate,OU=Zones,OU=UNIX,DC=google,DC=com", "additional.msDS-MembersForAzRole": "CN=PAWS_ENVPR_DDEPROD_ADM,OU=Bigdata,OU=Groups,DC=google,DC=com", "additional.dSCorePropagationData": "16010101000000.0Z", "additional.showInAdvancedViewOnly": "TRUE" }
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)