Highlighted
kitdaddio Absent Member.
Absent Member.
552 views

Example of processing MS AD logs into CEF output

Hi, here  is an example of processing MS AD logs into CEF output file, categorizing the various events, e.g., into logon, logoff, create, access, modify, SystemAction, etc.

This is to process the CEF-formatted syslog that is produced by the ArcSight smart-connector for the MS Active Directory server.

I did a mapping of the logged events.

If anyone uses this and "enhances" it, I would appreciate feedback. This can be a community effort, e.g., to grow the list of events that are mapped.

It also is a good example of how to do the sdkrfilereader. for the fixed-format header, and then invoke extraProcessor to sdkkeyvaluefilereader, to process the key=value CEF variable format. (Remove the ".txt" from the filename if you install it for use.)

Thanks

Kit.

Labels (1)
0 Likes
2 Replies
Jurgen
Visitor.

Re: Example of processing MS AD logs into CEF output

Hi,

Sorry for asking, but whats the use case for this? isn't the CEF logging already arcsight parsed logging?

Kind regards,

Jurgen

0 Likes
kitdaddio Absent Member.
Absent Member.

Re: Example of processing MS AD logs into CEF output

It depends on if you think that cef output is useful as formatted and populated.

Also whether the user's identity is given in a useful way. I.e., if the user is identified as a numeric offset in the Linux password file, that is  not globally significant. Or a locally-specified username may not match the value on other systems.

One value-added of what I did is to group the similar records together, e.g., for login-related events.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.