Auditing

The Identity Manager - Administrator’s Guide to Configure Auditing provides the information necessary to set up Identity Manager components for auditing events.

Custom engine events

Besides the predefined events that are generated automatically if enabled on the driver or driverset, one can also generate custom events from policy. This allows for business context (hire, transfer, …) to be injected into the event stream.

Custom event ids must be in the range 1000 - 1999 (0x3E8 – 0x7CF). A few have been reserved for internal use and must not be used:

The help text for the do-generate-event token still uses the deprecated NAudit field names. Nowadays you can use any valid CEF Extensions Keys as string names. See the dictionary of standard Extension Keys.

There is one non-standard string name: event_name. It allows you to override the EventName field in the CEF header (the evt/EventName field in Sentinel).

The Severity header is set from the log level.

The following extensions are automatically populated for all custom events by the engine:

You can use placeholders (identified by curly brackets) for the msg extension to refer to other extension values. , e.g. {suser}.

Here’s a sample do-generate-event call that sets some sensible defaults that should work with both Sentinel and ArcSight (or other CEF consumers):

<do-if>
  <arg-conditions>
    <and>
      <if-dest-dn op="available"/>
    </and>
  </arg-conditions>
  <arg-actions>
    <do-set-local-variable name="destDnOrAssociation" scope="policy">
      <arg-string>
        <token-dest-dn/>
      </arg-string>
    </do-set-local-variable>
  </arg-actions>
  <arg-actions>
    <do-set-local-variable name="destDnOrAssociation" scope="policy">
      <arg-string>
        <token-association/>
      </arg-string>
    </do-set-local-variable>
  </arg-actions>
</do-if>
<do-generate-event id="1000" level="log-alert">
  <arg-string name="event_name">
    <token-text xml:space="preserve">MyCustomSubscriberEvent1000</token-text>
  </arg-string>
  <arg-string name="externalId">
    <token-xpath expression="@event-id"/>
  </arg-string>
  <arg-string name="suser">
    <token-src-dn/>
  </arg-string>
  <arg-string name="suid">
    <token-parse-dn dest-dn-format="ldap" src-dn-format="qualified-slash">
      <token-xpath expression="@qualified-src-dn"/>
    </token-parse-dn>
  </arg-string>
  <arg-string name="duser">
    <token-dest-dn/>
  </arg-string>
  <arg-string name="duid">
    <token-association/>
  </arg-string>
  <arg-string name="filePath">
    <token-local-variable name="destDnOrAssociation"/>
  </arg-string>
  <arg-string name="fileType">
    <token-class-name/>
  </arg-string>
  <arg-string name="msg">
    <token-text xml:space="preserve">{act} object of type {fileType}: channel:{deviceProcessName} src-dn:{suser} object:{duser} result:{outcome} reason:{reason}</token-text>
  </arg-string>
  <arg-string name="reason">
    <token-text xml:space="preserve">reason</token-text>
  </arg-string>
  <arg-string name="request">
    <token-local-variable name="destDnOrAssociation"/>
  </arg-string>
  <arg-string name="requestMethod">
    <token-operation/>
  </arg-string>
  <arg-string name="act">
    <token-operation/>
  </arg-string>
  <arg-string name="cs1Label">
    <token-text xml:space="preserve">Attribute Name</token-text>
  </arg-string>
  <arg-string name="cs1">
    <token-xpath expression="*[@attr-name and 1]/@attr-name"/>
  </arg-string>
  <arg-string name="cs6Label">
    <token-text xml:space="preserve">Attribute Value</token-text>
  </arg-string>
  <arg-string name="cs6">
    <token-xpath expression="descendant::value[1]/text()"/>
  </arg-string>
  <arg-string name="outcome">
    <token-text xml:space="preserve">Failure</token-text>
  </arg-string>
  <arg-string name="sproc">
    <token-global-variable name="dirxml.auto.localserverdn"/>
  </arg-string>
</do-generate-event>
<do-generate-event id="1001" level="log-info">
  <arg-string name="event_name">
    <token-text xml:space="preserve">MyCustomNoAdditionalStringsEvent1001</token-text>
  </arg-string>
</do-generate-event>

CEF

The resulting CEF event then looks like this:

CEF:0|NetIQ|Identity Manager|4.8.4.0|303E8|MyCustomSubscriberEvent1000|9|msg=modify object of type User: channel:system\\driverset1\\REST-Sentinel\\Subscriber src-dn:\\IDM48\_TREE\\data\\users\\idm-sentinel-user-driver10407user object: result:Failure reason:reason cs1=Description sproc=CN\=engine,OU\=servers,O\=system reason=reason request=https://sentinel.example.com:8443/SentinelRESTServices/objects/user/104 rt=1650977701654 duid=https://sentinel.example.com:8443/SentinelRESTServices/objects/user/104 cs5=REST-Sentinel#Subscriber#27eff4e6-e567-4e24-bb60-e6f4ef2767e5 requestMethod=modify cs1Label=Attribute Name suid=CN\=idm-sentinel-user-driver10407user,OU\=users,O\=data cs6Label=Attribute Value dvc=172.30.1.24 act=modify dvchost=engine.example.com cat=DirXML\\\\Driver deviceProcessName=system\\driverset1\\REST-Sentinel\\Subscriber outcome=Failure cs5Label=correlationid cn2=1650977701647 filePath=https://sentinel.example.com:8443/SentinelRESTServices/objects/user/104 externalId=engine#20220426125501#1#1:27eff4e6-e567-4e24-bb60-e6f4ef2767e5 dtz=GMT suser=\\IDM48\_TREE\\data\\users\\idm-sentinel-user-driver10407user cn2Label=Event Group ID fileType=User cs6=description10407-8

Or formatted for better readability:

Sentinel

For custom IDM events, the Universal CEF collector parses the following extensions keys by default:

Unfortunately, none of the InitiatorUser/Service and TargetUser/Data fields are populated in Sentinel for custom IDM events. To achieve this, you have to customize the Universal CEF Collector. Specifically, the processCustomEvents() function in idm.js. Much of the required code can be borrowed from processVrdimEvents().

The resulting event in Sentinel then looks like this: