Mapping data fields from access list
I am wondering, is it possible to map additional information from access list to streaming events? In my case, I have events with user name, but I need to input additional information (user ID) from an access list (it contains user name and user ID). I would appreciate any kind of help;)
Are you saying you want to add, say a user's name to an additional field such as deviceCustomString1 based on their userid with the userid and name contained in an active list for events coming from that connector?
Yes, just the opposite, but it does not change the point. I do have an access list with user names+user IDs, but from events I only get user names. I am considering about the opportunety to get user ID from my AL and to add them based on user names of incomming events (for examle in a field deviceCustomString1). In other words, I would like to have events with both, user name+user ID.
P.S. I use ESM 4.5.1
There's actually 3 ways you can do this, but only one that I can think of that uses an AL. One would be to have a rule fire when the event comes in that generates a new event with the user name looked up in the AL based on the userid and then have all the needed information populated into the new event. This is probably the least desireable way.
You can also use static and dynamic mapping on the connector. For the static mapping, you have a file that the connector loads that tells it how to map the userid to a username and where to put it (for example, deviceCustomString1). A new method I just learned about is dynamic mapping, where the data is actually stored in a seperate database and is configured to do a lookup dynamically from this database to get the username. The advantage to this is you can just add or remove a user from the database to update the mappings, whereas with the static mapping file you have to tell the connector to reload it.
Unfortunately, other than using the rule, I can't think of a way to map the username to the event from an AL.