Parser override for WINC connector

[rmroczk]

Hi,

We have a problem augmenting event 4688 (A new process has been created) for the WINC connector.

Raw Event : {"System":{"EventId":"4688","Version":"1","Channel":"Security","ProviderName":"Microsoft-Windows-Security-Auditing","Computer":"abc.computer.net","EventRecordID":"4304053","Keywords":"Audit Success","Level":"Log Always","Opcode":"Info","Task":"Process Creation","ProcessID":"4","ThreadID":"104","TimeCreated":"1490370004076","UserId":""},"EventData":{"SubjectUserSid":"domain\\\\user","SubjectUserName":"user","SubjectDomainName":"domain","SubjectLogonId":"0x2ebffb","NewProcessId":"0x3d04","NewProcessName":"C:\\cygwin64\\bin\\bash.exe","TokenElevationType":"TokenElevationTypeDefault (1)","ProcessId":"0x3f08","CommandLine":"\"C:\\cygwin64\\bin\\bash.exe\""}}

We tried to use conditionalmap by creating the file $ARCSIGHT_HOME/current/user/agent/fcp/winc/security/microsoft_windows_security_auditing.sdkkeyvaluefilereader.properties with this:

conditionalmap[0].mappings[90].event.filePath=__regexToken(NewProcessName,"^(.*)/.*")

conditionalmap[0].mappings[90].event.targetProcessName=__regexToken(NewProcessName,".*/([^/]+)$")

Apparently mapping 90 is not the correct value for augmenting this event.  Have any ideas about this?

[wsladek1 · Accepted solution]

Have you tried using map files instead?  And you're just looking to break out the binary vs the full path, correct?

I tested the following on WUC (don't have WINC yet) but I think this should work regardless of connector type:

$CONNECTOR_HOME/current/user/agent/map

map.0.properties:

set.expr(targetProcessName).event.filePath

"__regexToken(targetProcessName,""^(.*)\\.*"")"

map.1.properties:

set.expr(targetProcessName).event.fileName

"__regexToken(targetProcessName,"".*\\([^\\]+)$"")"

[rmroczk]

Thanks.  That worked!