Recoger registros de Microsoft Windows AD

Este documento incluye la siguiente información:

• Arquitectura de implementación y pasos de instalación, además de cualquier configuración necesaria que genere registros compatibles con el analizador de Google Security Operations para eventos de Microsoft Windows Active Directory. Para obtener información general sobre la ingestión de datos en Google Security Operations, consulta el artículo Ingestión de datos en Google Security Operations.
• Información sobre cómo asigna el analizador los campos del registro original a los campos del modelo de datos unificado de Google Security Operations.

En función de la arquitectura de tu implementación, configura el agente de Bindplane o el agente de NXLog para ingerir registros de Microsoft Windows Active Directory en Google Security Operations. Te recomendamos que uses Bindplane Agent para reenviar los registros de Windows Active Directory a Google Security Operations.

La información de este documento se aplica al analizador con la etiqueta de ingestión WINDOWS_AD. La etiqueta de ingestión identifica qué analizador normaliza los datos de registro sin procesar en formato UDM estructurado.

Antes de empezar

Antes de configurar el agente de Bindplane o el agente de NXLog, completa las siguientes tareas:

• Configura todos los sistemas para que usen la zona horaria UTC.
• Configura los servidores de Active Directory de Microsoft Windows.
• Consulta los dispositivos y las versiones compatibles.
• Consulta los tipos de registros admitidos.

Configurar servidores de Microsoft Windows AD

1. En cada servidor de Microsoft Windows Active Directory, crea y configura una secuencia de comandos de PowerShell para guardar los datos de registro en un archivo de salida. Bindplane Agent o NXLog Agent leen el archivo de salida.

   # Set the location where the log file will be written
   $OUTPUT_FILENAME="<Path_of_the_output_file>"
   
   If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}
   
   # USER_CONTEXT: Gets all Active Directory users and their properties.
   Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   
   # ASSET_CONTEXT: Gets all Active Directory assets and their properties.
   Get-ADComputer -Filter * -properties samAccountName | % { Get-ADComputer $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   

2. Sustituye lo siguiente :

   • Sustituye el valor de $OUTPUT_FILENAME por la ubicación del archivo de salida.
   • Almacena los datos en formato JSON.
   • Selecciona la codificación UTF-8.
   • Usa el parámetro -Filter en lugar del parámetro -LDAPFilter al llamar a los cmdlets Get-ADUser y Get-ADComputer.

3. Crea una tarea periódica que ejecute la secuencia de comandos para obtener y escribir datos en el archivo de salida.

   1. Abre la aplicación Programador de tareas.
   2. Haz clic en Crear tarea.
   3. Asigna un nombre a la tarea y añade una descripción.
   4. Seleccione la casilla Ejecutar con los privilegios más altos para asegurarse de que se recuperen todos los datos.
   5. En la pestaña Desencadenadores, define cuándo quieres repetir la tarea.
   6. En la pestaña Acción, añade una acción y proporciona la ruta del archivo en el que se almacena la secuencia de comandos.

Revisar los dispositivos y las versiones compatibles

Microsoft Windows Server se lanza con las siguientes ediciones: Foundation, Essentials, Standard y Datacenter. El esquema de eventos de los registros generados por cada edición no cambia.

El analizador de Google Security Operations admite registros de las siguientes versiones de servidor de Microsoft Windows:

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012

El analizador de Google Security Operations admite los registros recogidos por NXLog Community Edition o Enterprise Edition.

Revisar los tipos de registros admitidos

El analizador de Google Security Operations analizará y normalizará los datos obtenidos del contexto de usuario y del contexto de activo. Admite registros generados con texto en inglés, pero no registros generados en otros idiomas.

Configurar el agente de BindPlane

Te recomendamos que uses el agente Bindplane para reenviar los registros de Windows Active Directory a Google Security Operations.

Después de la instalación, el servicio del agente de Bindplane aparece como el servicio observIQ en la lista de servicios de Windows.

1. Instala el agente de Bindplane en cada servidor de Windows Active Directory. Para obtener más información sobre cómo instalar el agente de Bindplane, consulta las instrucciones de instalación del agente de Bindplane.

2. Crea un archivo de configuración para el agente de Bindplane con el siguiente contenido:

   receivers:
     filelog:
       include: [ `FILE_PATH` ]
       operators:
         - type: json_parser
       start_at: beginning
     windowseventlog/activedirectoryservice:
       channel: Directory Service
       raw: true
   processors:
     batch:
   
   exporters:
     chronicle/activedirectory:
       endpoint: https://malachiteingestion-pa.googleapis.com
       creds: '{
       "type": "service_account",
       "project_id": "malachite-projectname",
       "private_key_id": `PRIVATE_KEY_ID`,
       "private_key": `PRIVATE_KEY`,
       "client_email":"`SERVICE_ACCOUNT_NAME`@malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "client_id": `CLIENT_ID`,
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/`SERVICSERVICE_ACCOUNT_NAME`%40malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "universe_domain": "googleapis.com"
       }'
     log_type: 'WINDOWS_AD'
     override_log_type: false
     raw_log_field: body
     customer_id: `CUSTOMER_ID`
   
   service:
     pipelines:
       logs/ads:
         receivers:
           - filelog
           - windowseventlog/activedirectoryservice
         processors: [batch]
         exporters: [chronicle/activedirectory]
   

3. Sustituye lo siguiente :

   • FILE_PATH con la ruta del archivo en el que se ha almacenado el resultado de la secuencia de comandos de PowerShell mencionada en Configurar servidores de AD de Microsoft Windows.

   • PRIVATE_KEY_ID, PRIVATE_KEY, SERVICSERVICE_ACCOUNT_NAME, PROJECT_ID, CLIENT_ID y CUSTOMER_ID con los valores correspondientes del archivo JSON de la cuenta de servicio, que puedes descargar desde Google Cloud. Para obtener más información sobre las claves de cuentas de servicio, consulta el artículo Crear y eliminar claves de cuentas de servicio.

4. Para iniciar el servicio del agente de Bindplane (antes conocido como observIQ), selecciona Servicios > Extendido > el servicio de observIQ > Iniciar.

Configurar el agente NXLog

En el siguiente diagrama se muestra una arquitectura en la que se instalan agentes de NXLog para recoger y enviar eventos de Microsoft Windows a Google Security Operations. Compara esta información con tu entorno para asegurarte de que estos componentes están instalados. Tu implementación puede ser diferente a esta arquitectura y puede ser más compleja.

Si usa el agente NXLog en lugar del agente Bindplane, verifique lo siguiente:

• Se crea y configura una secuencia de comandos de PowerShell en cada servidor de Microsoft Windows que ejecuta Active Directory para recoger datos de USER_CONTEXT y ASSET_CONTEXT. Para obtener más información, consulta el artículo Configurar servidores de AD de Microsoft Windows.
• NXLog se instala en cada servidor AD de Microsoft Windows para enviar datos al servidor central de Microsoft Windows Server o Linux.
• El reenviador de Google Security Operations se instala en el servidor central Microsoft Windows Server o Linux para reenviar los datos de registro a Google Security Operations.

Configurar NXLog

1. Instala el agente NXLog en cada recopilador que se ejecute en el servidor de Windows Active Directory. Esta aplicación reenvía los registros al servidor central de Microsoft Windows o Linux. Para obtener más información, consulta la documentación de NXLog.

2. Crea un archivo de configuración para cada instancia de NXLog. Usa el módulo NXLog im_file para leer el archivo y analizar las líneas en campos. Usa om_tcp para reenviar datos al servidor central de Microsoft Windows o Linux.

   A continuación, se muestra un ejemplo de configuración de NXLog. Sustituye los valores <hostname> y <port> por información sobre el servidor central de destino de Microsoft Windows o Linux. En la sección <Input in_adcontext> y la propiedad File, añada la ruta del archivo de registro de salida escrito por la secuencia de comandos de PowerShell. Siempre debes definir DirCheckInterval y PollInterval. Si no se definen, NXLog sondea los archivos cada segundo.

   define ROOT C:\Program Files\nxlog
   define ADCONTEXT_OUTPUT_DESTINATION_ADDRESS <hostname>
   define ADCONTEXT_OUTPUT_DESTINATION_PORT <port>
   
   Moduledir   %ROOT%\modules
   CacheDir    %ROOT%\data
   Pidfile     %ROOT%\data\nxlog.pid
   SpoolDir    %ROOT%\data
   LogFile     %ROOT%\data\nxlog.log
   
   <Input in_adcontext>
       Module im_file
       File "<Path_of_the_output_file>"
       DirCheckInterval 3600
       PollInterval 3600
   </Input>
   
   <Output out_chronicle_adcontext>
       Module  om_tcp
       Host    %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS%
       Port    %ADCONTEXT_OUTPUT_DESTINATION_PORT%
   </Output>
   
   <Route ad_context_to_chronicle>
       Path in_adcontext => out_chronicle_adcontext
   </Route>
   

3. Inicia el servicio NXLog en cada sistema.

Configurar el reenviador en un servidor central

Para obtener información sobre cómo instalar y configurar el reenviador en Linux, consulta el artículo Instalar y configurar el reenviador en Linux. Para obtener información sobre cómo instalar y configurar el reenviador en Microsoft Windows, consulta el artículo Instalar y configurar el reenviador en Microsoft Windows.

1. Configura el sistema con la zona horaria UTC.
2. Instala el reenviador de Google Security Operations en el servidor central Microsoft Windows o Linux.

3. Configura el reenviador de Google Security Operations para que envíe registros a Google Security Operations. A continuación, se muestra un ejemplo de configuración de reenviador:

     - syslog:
         common:
           enabled: true
           data_type: WINDOWS_AD
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

Formatos de registro de AD de Windows admitidos

El analizador de AD de Windows admite registros en formato JSON.

Registros de ejemplo de Windows AD admitidos

• JSON:

  {
    "GivenName": "user1",
    "Surname": "itadmin",
    "UserPrincipalName": "user1.itadmin@testdhcp2.local",
    "Enabled": true,
    "SamAccountName": "user1.itadmin",
    "SID": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000"
    },
    "DistinguishedName": "CN=test,CN=Users,DC=testdhcp2,DC=local",
    "Name": "test",
    "ObjectClass": "user",
    "ObjectGuid": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "PropertyNames": [
      "AccountExpirationDate",
      "accountExpires",
      "AccountLockoutTime",
      "AccountNotDelegated",
      "AllowReversiblePasswordEncryption",
      "AuthenticationPolicy",
      "AuthenticationPolicySilo",
      "BadLogonCount",
      "badPasswordTime",
      "badPwdCount",
      "c",
      "CannotChangePassword",
      "CanonicalName",
      "Certificates",
      "City",
      "CN",
      "co",
      "codePage",
      "Company",
      "CompoundIdentitySupported",
      "Country",
      "countryCode",
      "Created",
      "createTimeStamp",
      "Deleted",
      "Department",
      "Description",
      "DisplayName",
      "DistinguishedName",
      "Division",
      "DoesNotRequirePreAuth",
      "dSCorePropagationData",
      "EmailAddress",
      "EmployeeID",
      "EmployeeNumber",
      "Enabled",
      "facsimileTelephoneNumber",
      "Fax",
      "GivenName",
      "HomeDirectory",
      "HomedirRequired",
      "HomeDrive",
      "HomePage",
      "HomePhone",
      "Initials",
      "instanceType",
      "ipPhone",
      "isDeleted",
      "KerberosEncryptionType",
      "l",
      "LastBadPasswordAttempt",
      "LastKnownParent",
      "lastLogoff",
      "lastLogon",
      "LastLogonDate",
      "lastLogonTimestamp",
      "LockedOut",
      "lockoutTime",
      "logonCount",
      "logonHours",
      "LogonWorkstations",
      "mail",
      "Manager",
      "MemberOf",
      "MNSLogonAccount",
      "mobile",
      "MobilePhone",
      "Modified",
      "modifyTimeStamp",
      "msDS-SupportedEncryptionTypes",
      "msDS-User-Account-Control-Computed",
      "Name",
      "nTSecurityDescriptor",
      "ObjectCategory",
      "ObjectClass",
      "ObjectGUID",
      "objectSid",
      "Office",
      "OfficePhone",
      "Organization",
      "OtherName",
      "pager",
      "PasswordExpired",
      "PasswordLastSet",
      "PasswordNeverExpires",
      "PasswordNotRequired",
      "physicalDeliveryOfficeName",
      "POBox",
      "PostalCode",
      "postOfficeBox",
      "PrimaryGroup",
      "primaryGroupID",
      "PrincipalsAllowedToDelegateToAccount",
      "ProfilePath",
      "ProtectedFromAccidentalDeletion",
      "pwdLastSet",
      "SamAccountName",
      "sAMAccountType",
      "ScriptPath",
      "sDRightsEffective",
      "ServicePrincipalNames",
      "SID",
      "SIDHistory",
      "SmartcardLogonRequired",
      "sn",
      "st",
      "State",
      "StreetAddress",
      "Surname",
      "telephoneNumber",
      "Title",
      "TrustedForDelegation",
      "TrustedToAuthForDelegation",
      "UseDESKeyOnly",
      "userAccountControl",
      "userCertificate",
      "userParameters",
      "UserPrincipalName",
      "uSNChanged",
      "uSNCreated",
      "whenChanged",
      "whenCreated",
      "wWWHomePage"
    ],
    "AddedProperties": [],
    "RemovedProperties": [],
    "ModifiedProperties": [],
    "PropertyCount": 123,
    "AccountExpirationDate": null,
    "accountExpires": 0,
    "AccountLockoutTime": "\\/Date(1631175863106)\\/",
    "AccountNotDelegated": true,
    "AllowReversiblePasswordEncryption": false,
    "AuthenticationPolicy": [],
    "AuthenticationPolicySilo": [],
    "BadLogonCount": 3,
    "badPasswordTime": 132756494631068585,
    "badPwdCount": 3,
    "c": "IN",
    "CannotChangePassword": false,
    "CanonicalName": "testdhcp2.local/Users/test",
    "Certificates": [],
    "City": "Ahmedabad",
    "CN": "test",
    "co": "India",
    "codePage": 0,
    "Company": "user",
    "CompoundIdentitySupported": [
      false
    ],
    "Country": "IN",
    "countryCode": 356,
    "Created": "\\/Date(1628229355000)\\/",
    "createTimeStamp": "\\/Date(1628229355000)\\/",
    "Deleted": null,
    "Department": "it",
    "Description": "itadmin",
    "DisplayName": "user1",
    "Division": "test",
    "DoesNotRequirePreAuth": false,
    "dSCorePropagationData": [
      "\\/Date(1631191510000)\\/",
      "\\/Date(-11644473600000)\\/"
    ],
    "EmailAddress": "user@dummy.local",
    "EmployeeID": null,
    "EmployeeNumber": null,
    "facsimileTelephoneNumber": "12345678",
    "Fax": "12345678",
    "HomeDirectory": "\\\\\\\\DHCP-AD01\\\\ADContext",
    "HomedirRequired": false,
    "HomeDrive": "G:",
    "HomePage": "www.test.com",
    "HomePhone": "123456789",
    "Initials": "user1",
    "instanceType": 4,
    "ipPhone": "1121",
    "isDeleted": null,
    "KerberosEncryptionType": [
      0
    ],
    "l": "ahmedabad",
    "LastBadPasswordAttempt": "\\/Date(1631175863106)\\/",
    "LastKnownParent": null,
    "lastLogoff": 0,
    "lastLogon": 132756492460689244,
    "LastLogonDate": "\\/Date(1631175025098)\\/",
    "lastLogonTimestamp": 132756486250985369,
    "LockedOut": false,
    "lockoutTime": 132756494631068585,
    "logonCount": 2,
    "logonHours": [
      0,
      0,
      248,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      7,
      0,
      0,
      0,
      0,
      0,
      0
    ],
    "LogonWorkstations": null,
    "mail": "user@dummy.local",
    "Manager": "CN=Administrator,CN=Users,DC=testdhcp2,DC=local",
    "MemberOf": [
      "CN=Netwrix Auditor Client Users,CN=Users,DC=dnstest2,DC=local",
      "CN=Netwrix Auditor Administrators,CN=Users,DC=dnstest2,DC=local",
      "CN=Group Policy Creator Owners,CN=Users,DC=dnstest2,DC=local",
      "CN=Domain Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Enterprise Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Schema Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Remote Desktop Users,CN=Builtin,DC=dnstest2,DC=local",
      "CN=Administrators,CN=Builtin,DC=dnstest2,DC=local"
    ],
    "MNSLogonAccount": false,
    "mobile": "923456789",
    "MobilePhone": "823456789",
    "Modified": "\\/Date(1631277960000)\\/",
    "modifyTimeStamp": "\\/Date(1631277960000)\\/",
    "msDS-SupportedEncryptionTypes": 0,
    "msDS-User-Account-Control-Computed": 0,
    "nTSecurityDescriptor": {
      "AccessRightType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Enum",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryRights",
        "FullName": "System.DirectoryServices.ActiveDirectoryRights",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryRights, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "f65acb9b-4c77-33ff-8523-43e9cc2c5798",
        "IsEnum": true,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryRights",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554438,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "",
        "DeclaredEvents": "",
        "DeclaredFields": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMembers": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMethods": "",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "",
        "ImplementedInterfaces": "System.IComparable System.IFormattable System.IConvertible",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 257,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": false,
        "IsInterface": false,
        "IsValueType": true,
        "IsAbstract": false,
        "IsSealed": true,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": true,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": "[System.FlagsAttribute()]"
      },
      "AccessRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAccessRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAccessRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "0db7ea8c-53d9-3d6d-8b09-bb209cf0d0ae",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAccessRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554445,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AuditRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAuditRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAuditRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "4ad0312a-2ed0-3526-97ec-f9c6f310c5e0",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAuditRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554453,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AreAccessRulesProtected": false,
      "AreAuditRulesProtected": false,
      "AreAccessRulesCanonical": true,
      "AreAuditRulesCanonical": true
    },
    "ObjectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=testdhcp2,DC=local",
    "ObjectGUID": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "objectSid": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000m"
    },
    "Office": "db office",
    "OfficePhone": "91-123456789",
    "Organization": null,
    "OtherName": null,
    "pager": "234567890",
    "PasswordExpired": false,
    "PasswordLastSet": "\\/Date(1631174951326)\\/",
    "PasswordNeverExpires": false,
    "PasswordNotRequired": false,
    "physicalDeliveryOfficeName": "db office",
    "POBox": "dummy",
    "PostalCode": "380015",
    "postOfficeBox": [
      "dummy"
    ],
    "PrimaryGroup": "CN=Domain Users,CN=Users,DC=testdhcp2,DC=local",
    "primaryGroupID": 513,
    "PrincipalsAllowedToDelegateToAccount": [],
    "ProfilePath": null,
    "ProtectedFromAccidentalDeletion": false,
    "pwdLastSet": 132756485513268133,
    "sAMAccountType": 805306368,
    "ScriptPath": null,
    "sDRightsEffective": 15,
    "ServicePrincipalNames": [],
    "SIDHistory": [],
    "SmartcardLogonRequired": false,
    "sn": "itadmin",
    "st": "Gujarat",
    "State": "Gujarat",
    "StreetAddress": "1,user street ,dummy,dummy",
    "telephoneNumber": "91-123456789",
    "Title": "it admin",
    "TrustedForDelegation": false,
    "TrustedToAuthForDelegation": false,
    "UseDESKeyOnly": false,
    "userAccountControl": 1049088,
    "userCertificate": [],
    "userParameters": null,
    "uSNChanged": 57594,
    "uSNCreated": 32800,
    "whenChanged": "\\/Date(1631277960000)\\/",
    "whenCreated": "\\/Date(1628229355000)\\/",
    "wWWHomePage": "www.test.com"
  } 
  

Referencia de asignación de campos: campos de registro de dispositivo a campos de UDM

En esta sección se describe cómo asigna el analizador los campos de registro originales a los campos del modelo de datos unificado.

Referencia de asignación de campos: WINDOWS_AD

En la siguiente tabla se enumeran los campos de registro del tipo de registro WINDOWS_AD y sus campos de UDM correspondientes.

¿Necesitas más ayuda? Recibe respuestas de los miembros de la comunidad y de los profesionales de Google SecOps.