aortiz1 Respected Contributor.
Respected Contributor.
412 views

Custom Identity Manager Events CEF

Hi all,

We are migrating from Novell Audit to CEF so we changed the Identity Manager Collector to the Universal CEF collector but in the old one we used to have Custom Events that were sent from Identity Manager Drivers. In this new driver we are only getting an "Identity Manager" information with no aditional information so i wanted to ask, Is there a way to use Custom Identity Manager Events with the new CEF Collector? do we have to edit the Taxonomy.map or something like that?
Thank you in advanced
0 Likes
4 Replies
ScorpionSting Absent Member.
Absent Member.

Re: Custom Identity Manager Events CEF

aortiz1;2500133 wrote:
Hi all,

We are migrating from Novell Audit to CEF so we changed the Identity Manager Collector to the Universal CEF collector but in the old one we used to have Custom Events that were sent from Identity Manager Drivers. In this new driver we are only getting an "Identity Manager" information with no aditional information so i wanted to ask, Is there a way to use Custom Identity Manager Events with the new CEF Collector? do we have to edit the Taxonomy.map or something like that?
Thank you in advanced


Have you changed your IDM config to use CEF?


Visit my Website for links to Cool Solution articles.
0 Likes
aortiz1 Respected Contributor.
Respected Contributor.

Re: Custom Identity Manager Events CEF

ScorpionSting;2500135 wrote:
Have you changed your IDM config to use CEF?



I did change the configuration, i recieve all the Driver events like Stop or Start.
My questions is directly to the Custom events. In novell audit i use to recieve events sent by my drivers(designer: Generate event) i had to modify the taxonomy of my naudit collector to be able to recieve that, but with the CEF collector i don't seem to find any information of this.
0 Likes
aortiz1 Respected Contributor.
Respected Contributor.

Re: Custom Identity Manager Events CEF

Just to give a more detailed information about my issue, i'm doing basically what the documentation tells me to here https://www.netiq.com/documentation/identity-manager-47/configure_auditing/data/user-defined-events.html
Then i go to my Sentinel box and all i see is this



I used to make it work when i was using Novell Audit, but now after migration to CEF and using the Universal CEF Collector i don't seem to find how to make this work.
0 Likes
ScorpionSting Absent Member.
Absent Member.

Re: Custom Identity Manager Events CEF

aortiz1;2500263 wrote:
Just to give a more detailed information about my issue, i'm doing basically what the documentation tells me to here https://www.netiq.com/documentation/identity-manager-47/configure_auditing/data/user-defined-events.html
Then i go to my Sentinel box and all i see is this



I used to make it work when i was using Novell Audit, but now after migration to CEF and using the Universal CEF Collector i don't seem to find how to make this work.


Have a look at Brandon's response in your other post.

Visit my Website for links to Cool Solution articles.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.