收集 Microsoft Windows AD 資料

這份文件包含以下資訊：

• 部署架構和安裝步驟，以及任何必要的設定，這些設定可產生 Google Security Operations 剖析器支援的記錄，用於 Microsoft Windows Active Directory 事件。如需 Google Security Operations 資料擷取的總覽，請參閱「將資料擷取至 Google Security Operations」。
• 剖析器如何將原始記錄中的欄位對應至 Google Security Operations 統合式資料模型欄位。

根據部署架構，設定 Bindplane 代理程式或 NXLog 代理程式，將 Microsoft Windows Active Directory 記錄檔擷取至 Google 安全性作業。建議您使用 Bindplane Agent，將 Windows Active Directory 的記錄轉送至 Google 安全作業。

本文中的資訊適用於標示為 WINDOWS_AD 的剖析器攝入作業。擷取標籤可指出哪個剖析器將原始記錄資料正規化為具結構性的 UDM 格式。

事前準備

設定 Bindplane 代理程式或 NXLog 代理程式前，請先完成下列工作：

• 將所有系統設定為使用世界標準時間時區。
• 設定 Microsoft Windows AD 伺服器。
• 查看支援的裝置和版本。
• 查看支援的記錄檔類型。

設定 Microsoft Windows AD 伺服器

1. 在每部 Microsoft Windows Active Directory 伺服器上，建立及設定 PowerShell 指令碼，將記錄資料儲存到輸出檔案。Bindplane 代理程式或 NXLog 代理程式會讀取輸出檔案。

   # Set the location where the log file will be written
   $OUTPUT_FILENAME="<Path_of_the_output_file>"
   
   If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}
   
   # USER_CONTEXT: Gets all Active Directory users and their properties.
   Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   
   # ASSET_CONTEXT: Gets all Active Directory assets and their properties.
   Get-ADComputer -Filter * -properties samAccountName | % { Get-ADComputer $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   

2. 請使用下列內容取代：

   • 將 $OUTPUT_FILENAME 的值替換為輸出檔案的位置。
   • 以 JSON 格式儲存資料。
   • 將編碼設為 UTF-8。
   • 呼叫 Get-ADUser 和 Get-ADComputer 指令碼時，請使用 -Filter 參數，而非 -LDAPFilter 參數。

3. 建立定期工作，以便執行指令碼，擷取資料並寫入輸出檔案。

   1. 開啟工作排程器應用程式。
   2. 點選「建立工作」。
   3. 輸入工作名稱和說明。
   4. 請勾選「以最高權限執行」核取方塊，確保能擷取所有資料。
   5. 在「觸發條件」分頁中，定義工作重複執行的時間。
   6. 在「動作」分頁中新增動作，並提供儲存指令碼的檔案路徑。

查看支援的裝置和版本

Microsoft Windows Server 有以下版本：Foundation、Essentials、Standard 和 Datacenter。各版本產生的記錄事件結構定義並無差異。

Google Security Operations 剖析器支援下列 Microsoft Windows 伺服器版本的記錄：

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012

Google Security Operations 剖析器支援由 NXLog Community Edition 或 Enterprise Edition 收集的記錄。

查看支援的記錄類型

Google 安全作業剖析器會剖析並標準化從使用者情境和資產情境擷取的資料。這項工具支援以英文文字產生的記錄，但不支援以非英文語言產生的記錄。

設定 Bindplane 代理程式

建議您使用 Bindplane 代理程式，將 Windows Active Directory 的記錄轉送至 Google 安全作業。

安裝完成後，Bindplane 代理程式服務會顯示為 Windows 服務清單中的 observIQ 服務。

1. 在每部 Windows Active Directory 伺服器上安裝 Bindplane 代理程式。如要進一步瞭解如何安裝 Bindplane 代理程式，請參閱 Bindplane 代理程式安裝操作說明。

2. 請為 Bindplane 代理程式建立設定檔，並加入下列內容：

   receivers:
     filelog:
       include: [ `FILE_PATH` ]
       operators:
         - type: json_parser
       start_at: beginning
     windowseventlog/activedirectoryservice:
       channel: Directory Service
       raw: true
   processors:
     batch:
   
   exporters:
     chronicle/activedirectory:
       endpoint: https://malachiteingestion-pa.googleapis.com
       creds: '{
       "type": "service_account",
       "project_id": "malachite-projectname",
       "private_key_id": `PRIVATE_KEY_ID`,
       "private_key": `PRIVATE_KEY`,
       "client_email":"`SERVICE_ACCOUNT_NAME`@malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "client_id": `CLIENT_ID`,
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/`SERVICSERVICE_ACCOUNT_NAME`%40malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "universe_domain": "googleapis.com"
       }'
     log_type: 'WINDOWS_AD'
     override_log_type: false
     raw_log_field: body
     customer_id: `CUSTOMER_ID`
   
   service:
     pipelines:
       logs/ads:
         receivers:
           - filelog
           - windowseventlog/activedirectoryservice
         processors: [batch]
         exporters: [chronicle/activedirectory]
   

3. 請使用下列內容取代：

   • FILE_PATH 與檔案路徑，其中儲存了「設定 Microsoft Windows AD 伺服器」一文中提及的 PowerShell 指令碼輸出內容。

   • PRIVATE_KEY_ID、PRIVATE_KEY SERVICSERVICE_ACCOUNT_NAME、PROJECT_ID、CLIENT_ID 和 CUSTOMER_ID 的值，請參考服務帳戶 JSON 檔案 (可從 Google Cloud下載) 中的值。如要進一步瞭解服務帳戶金鑰，請參閱「建立及刪除服務帳戶金鑰」。

4. 如要啟動 Bindplane (舊稱 observIQ) 代理人服務，請依序選取「Services」>「Extended」>「observIQ Service」>「Start」。

設定 NXLog 代理程式

下圖顯示架構，其中安裝了 NXLog 代理程式，用於收集 Microsoft Windows 事件並傳送至 Google 安全防護服務。請將這項資訊與您的環境進行比對，確認已安裝這些元件。您的部署可能與這個架構不同，也可能更複雜。

如果您使用的是 NXLog 代理程式 (而非 Bindplane 代理程式)，請確認以下事項：

• 在執行 Active Directory 的每部 Microsoft Windows Server 上建立及設定 PowerShell 指令碼，以收集 USER_CONTEXT 和 ASSET_CONTEXT 資料。詳情請參閱「設定 Microsoft Windows AD 伺服器」。
• 在每部 Microsoft Windows AD 伺服器上安裝 NXLog，以便將資料傳送至中央 Microsoft Windows Server 或 Linux 伺服器。
• 在中央 Microsoft Windows Server 或 Linux 伺服器上安裝 Google Security Operations 轉送器，將記錄資料轉送至 Google Security Operations。

設定 NXLog

1. 在 Windows Active Directory 伺服器上執行的每個收集器上安裝 NXLog 代理程式。這個應用程式會將記錄轉送至中央 Microsoft Windows 或 Linux 伺服器。詳情請參閱 NXLog 說明文件。

2. 為每個 NXLog 執行個體建立設定檔。使用 NXLog im_file 模組讀取檔案，並將行解析為欄位。使用 om_tcp 將資料轉送至中央 Microsoft Windows 或 Linux 伺服器。

   以下是 NXLog 設定的範例。將 <hostname> 和 <port> 值替換為目的地中央 Microsoft Windows 或 Linux 伺服器的相關資訊。在 <Input in_adcontext> 部分和 File 屬性中，新增 PowerShell 指令碼所寫出輸出記錄檔案的路徑。請一律設定 DirCheckInterval 和 PollInterval。如果未定義這些值，NXLog 會每 1 秒輪詢一次檔案。

   define ROOT C:\Program Files\nxlog
   define ADCONTEXT_OUTPUT_DESTINATION_ADDRESS <hostname>
   define ADCONTEXT_OUTPUT_DESTINATION_PORT <port>
   
   Moduledir   %ROOT%\modules
   CacheDir    %ROOT%\data
   Pidfile     %ROOT%\data\nxlog.pid
   SpoolDir    %ROOT%\data
   LogFile     %ROOT%\data\nxlog.log
   
   <Input in_adcontext>
       Module im_file
       File "<Path_of_the_output_file>"
       DirCheckInterval 3600
       PollInterval 3600
   </Input>
   
   <Output out_chronicle_adcontext>
       Module  om_tcp
       Host    %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS%
       Port    %ADCONTEXT_OUTPUT_DESTINATION_PORT%
   </Output>
   
   <Route ad_context_to_chronicle>
       Path in_adcontext => out_chronicle_adcontext
   </Route>
   

3. 在每個系統中啟動 NXLog 服務。

在中央伺服器上設定轉送器

如要進一步瞭解如何在 Linux 上安裝及設定轉寄站，請參閱「在 Linux 上安裝及設定轉寄站」。如要瞭解如何在 Microsoft Windows 上安裝及設定轉寄站，請參閱「在 Microsoft Windows 上安裝及設定轉寄站」。

1. 使用世界標準時間時區設定系統。
2. 在中央 Microsoft Windows 或 Linux 伺服器上安裝 Google Security Operations 轉寄站。

3. 設定 Google Security Operations 轉送程式，將記錄傳送至 Google Security Operations。以下是轉送器設定範例：

     - syslog:
         common:
           enabled: true
           data_type: WINDOWS_AD
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

支援的 Windows AD 記錄格式

Windows AD 剖析器支援 JSON 格式的記錄。

支援的 Windows AD 範例記錄

• JSON：

  {
    "GivenName": "user1",
    "Surname": "itadmin",
    "UserPrincipalName": "user1.itadmin@testdhcp2.local",
    "Enabled": true,
    "SamAccountName": "user1.itadmin",
    "SID": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000"
    },
    "DistinguishedName": "CN=test,CN=Users,DC=testdhcp2,DC=local",
    "Name": "test",
    "ObjectClass": "user",
    "ObjectGuid": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "PropertyNames": [
      "AccountExpirationDate",
      "accountExpires",
      "AccountLockoutTime",
      "AccountNotDelegated",
      "AllowReversiblePasswordEncryption",
      "AuthenticationPolicy",
      "AuthenticationPolicySilo",
      "BadLogonCount",
      "badPasswordTime",
      "badPwdCount",
      "c",
      "CannotChangePassword",
      "CanonicalName",
      "Certificates",
      "City",
      "CN",
      "co",
      "codePage",
      "Company",
      "CompoundIdentitySupported",
      "Country",
      "countryCode",
      "Created",
      "createTimeStamp",
      "Deleted",
      "Department",
      "Description",
      "DisplayName",
      "DistinguishedName",
      "Division",
      "DoesNotRequirePreAuth",
      "dSCorePropagationData",
      "EmailAddress",
      "EmployeeID",
      "EmployeeNumber",
      "Enabled",
      "facsimileTelephoneNumber",
      "Fax",
      "GivenName",
      "HomeDirectory",
      "HomedirRequired",
      "HomeDrive",
      "HomePage",
      "HomePhone",
      "Initials",
      "instanceType",
      "ipPhone",
      "isDeleted",
      "KerberosEncryptionType",
      "l",
      "LastBadPasswordAttempt",
      "LastKnownParent",
      "lastLogoff",
      "lastLogon",
      "LastLogonDate",
      "lastLogonTimestamp",
      "LockedOut",
      "lockoutTime",
      "logonCount",
      "logonHours",
      "LogonWorkstations",
      "mail",
      "Manager",
      "MemberOf",
      "MNSLogonAccount",
      "mobile",
      "MobilePhone",
      "Modified",
      "modifyTimeStamp",
      "msDS-SupportedEncryptionTypes",
      "msDS-User-Account-Control-Computed",
      "Name",
      "nTSecurityDescriptor",
      "ObjectCategory",
      "ObjectClass",
      "ObjectGUID",
      "objectSid",
      "Office",
      "OfficePhone",
      "Organization",
      "OtherName",
      "pager",
      "PasswordExpired",
      "PasswordLastSet",
      "PasswordNeverExpires",
      "PasswordNotRequired",
      "physicalDeliveryOfficeName",
      "POBox",
      "PostalCode",
      "postOfficeBox",
      "PrimaryGroup",
      "primaryGroupID",
      "PrincipalsAllowedToDelegateToAccount",
      "ProfilePath",
      "ProtectedFromAccidentalDeletion",
      "pwdLastSet",
      "SamAccountName",
      "sAMAccountType",
      "ScriptPath",
      "sDRightsEffective",
      "ServicePrincipalNames",
      "SID",
      "SIDHistory",
      "SmartcardLogonRequired",
      "sn",
      "st",
      "State",
      "StreetAddress",
      "Surname",
      "telephoneNumber",
      "Title",
      "TrustedForDelegation",
      "TrustedToAuthForDelegation",
      "UseDESKeyOnly",
      "userAccountControl",
      "userCertificate",
      "userParameters",
      "UserPrincipalName",
      "uSNChanged",
      "uSNCreated",
      "whenChanged",
      "whenCreated",
      "wWWHomePage"
    ],
    "AddedProperties": [],
    "RemovedProperties": [],
    "ModifiedProperties": [],
    "PropertyCount": 123,
    "AccountExpirationDate": null,
    "accountExpires": 0,
    "AccountLockoutTime": "\\/Date(1631175863106)\\/",
    "AccountNotDelegated": true,
    "AllowReversiblePasswordEncryption": false,
    "AuthenticationPolicy": [],
    "AuthenticationPolicySilo": [],
    "BadLogonCount": 3,
    "badPasswordTime": 132756494631068585,
    "badPwdCount": 3,
    "c": "IN",
    "CannotChangePassword": false,
    "CanonicalName": "testdhcp2.local/Users/test",
    "Certificates": [],
    "City": "Ahmedabad",
    "CN": "test",
    "co": "India",
    "codePage": 0,
    "Company": "user",
    "CompoundIdentitySupported": [
      false
    ],
    "Country": "IN",
    "countryCode": 356,
    "Created": "\\/Date(1628229355000)\\/",
    "createTimeStamp": "\\/Date(1628229355000)\\/",
    "Deleted": null,
    "Department": "it",
    "Description": "itadmin",
    "DisplayName": "user1",
    "Division": "test",
    "DoesNotRequirePreAuth": false,
    "dSCorePropagationData": [
      "\\/Date(1631191510000)\\/",
      "\\/Date(-11644473600000)\\/"
    ],
    "EmailAddress": "user@dummy.local",
    "EmployeeID": null,
    "EmployeeNumber": null,
    "facsimileTelephoneNumber": "12345678",
    "Fax": "12345678",
    "HomeDirectory": "\\\\\\\\DHCP-AD01\\\\ADContext",
    "HomedirRequired": false,
    "HomeDrive": "G:",
    "HomePage": "www.test.com",
    "HomePhone": "123456789",
    "Initials": "user1",
    "instanceType": 4,
    "ipPhone": "1121",
    "isDeleted": null,
    "KerberosEncryptionType": [
      0
    ],
    "l": "ahmedabad",
    "LastBadPasswordAttempt": "\\/Date(1631175863106)\\/",
    "LastKnownParent": null,
    "lastLogoff": 0,
    "lastLogon": 132756492460689244,
    "LastLogonDate": "\\/Date(1631175025098)\\/",
    "lastLogonTimestamp": 132756486250985369,
    "LockedOut": false,
    "lockoutTime": 132756494631068585,
    "logonCount": 2,
    "logonHours": [
      0,
      0,
      248,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      7,
      0,
      0,
      0,
      0,
      0,
      0
    ],
    "LogonWorkstations": null,
    "mail": "user@dummy.local",
    "Manager": "CN=Administrator,CN=Users,DC=testdhcp2,DC=local",
    "MemberOf": [
      "CN=Netwrix Auditor Client Users,CN=Users,DC=dnstest2,DC=local",
      "CN=Netwrix Auditor Administrators,CN=Users,DC=dnstest2,DC=local",
      "CN=Group Policy Creator Owners,CN=Users,DC=dnstest2,DC=local",
      "CN=Domain Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Enterprise Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Schema Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Remote Desktop Users,CN=Builtin,DC=dnstest2,DC=local",
      "CN=Administrators,CN=Builtin,DC=dnstest2,DC=local"
    ],
    "MNSLogonAccount": false,
    "mobile": "923456789",
    "MobilePhone": "823456789",
    "Modified": "\\/Date(1631277960000)\\/",
    "modifyTimeStamp": "\\/Date(1631277960000)\\/",
    "msDS-SupportedEncryptionTypes": 0,
    "msDS-User-Account-Control-Computed": 0,
    "nTSecurityDescriptor": {
      "AccessRightType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Enum",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryRights",
        "FullName": "System.DirectoryServices.ActiveDirectoryRights",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryRights, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "f65acb9b-4c77-33ff-8523-43e9cc2c5798",
        "IsEnum": true,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryRights",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554438,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "",
        "DeclaredEvents": "",
        "DeclaredFields": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMembers": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMethods": "",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "",
        "ImplementedInterfaces": "System.IComparable System.IFormattable System.IConvertible",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 257,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": false,
        "IsInterface": false,
        "IsValueType": true,
        "IsAbstract": false,
        "IsSealed": true,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": true,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": "[System.FlagsAttribute()]"
      },
      "AccessRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAccessRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAccessRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "0db7ea8c-53d9-3d6d-8b09-bb209cf0d0ae",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAccessRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554445,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AuditRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAuditRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAuditRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "4ad0312a-2ed0-3526-97ec-f9c6f310c5e0",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAuditRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554453,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AreAccessRulesProtected": false,
      "AreAuditRulesProtected": false,
      "AreAccessRulesCanonical": true,
      "AreAuditRulesCanonical": true
    },
    "ObjectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=testdhcp2,DC=local",
    "ObjectGUID": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "objectSid": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000m"
    },
    "Office": "db office",
    "OfficePhone": "91-123456789",
    "Organization": null,
    "OtherName": null,
    "pager": "234567890",
    "PasswordExpired": false,
    "PasswordLastSet": "\\/Date(1631174951326)\\/",
    "PasswordNeverExpires": false,
    "PasswordNotRequired": false,
    "physicalDeliveryOfficeName": "db office",
    "POBox": "dummy",
    "PostalCode": "380015",
    "postOfficeBox": [
      "dummy"
    ],
    "PrimaryGroup": "CN=Domain Users,CN=Users,DC=testdhcp2,DC=local",
    "primaryGroupID": 513,
    "PrincipalsAllowedToDelegateToAccount": [],
    "ProfilePath": null,
    "ProtectedFromAccidentalDeletion": false,
    "pwdLastSet": 132756485513268133,
    "sAMAccountType": 805306368,
    "ScriptPath": null,
    "sDRightsEffective": 15,
    "ServicePrincipalNames": [],
    "SIDHistory": [],
    "SmartcardLogonRequired": false,
    "sn": "itadmin",
    "st": "Gujarat",
    "State": "Gujarat",
    "StreetAddress": "1,user street ,dummy,dummy",
    "telephoneNumber": "91-123456789",
    "Title": "it admin",
    "TrustedForDelegation": false,
    "TrustedToAuthForDelegation": false,
    "UseDESKeyOnly": false,
    "userAccountControl": 1049088,
    "userCertificate": [],
    "userParameters": null,
    "uSNChanged": 57594,
    "uSNCreated": 32800,
    "whenChanged": "\\/Date(1631277960000)\\/",
    "whenCreated": "\\/Date(1628229355000)\\/",
    "wWWHomePage": "www.test.com"
  } 
  

欄位對應參考資料：裝置記錄欄位與 UDM 欄位

本節說明剖析器如何將原始記錄欄位對應至統一資料模型欄位。

欄位對應參考資料：WINDOWS_AD

下表列出 WINDOWS_AD 記錄類型的記錄欄位，以及對應的 UDM 欄位。

還有其他問題嗎？向社群成員和 Google SecOps 專家尋求解答。