Collecter les journaux Microsoft Windows AD

Ce document inclut les informations suivantes :

• Architecture de déploiement et étapes d'installation, ainsi que toute configuration requise qui génère des journaux compatibles avec l'analyseur Google Security Operations pour les événements Microsoft Windows Active Directory. Pour en savoir plus sur l'ingestion de données dans Google Security Operations, consultez Ingestion de données dans Google Security Operations.
• Informations sur la façon dont l'analyseur mappe les champs du journal d'origine aux champs du modèle de données unifié Google Security Operations.

En fonction de votre architecture de déploiement, configurez l'agent Bindplane ou l'agent NXLog pour ingérer les journaux Microsoft Windows Active Directory dans Google Security Operations. Nous vous recommandons d'utiliser l'agent Bindplane pour transférer les journaux Windows Active Directory vers Google Security Operations.

Les informations de ce document s'appliquent au parseur avec le libellé d'ingestion WINDOWS_AD. Le libellé d'ingestion identifie l'analyseur qui normalise les données de journaux brutes au format UDM structuré.

Avant de commencer

Avant de configurer l'agent Bindplane ou l'agent NXLog, effectuez les tâches suivantes :

• Configurez tous les systèmes pour qu'ils utilisent le fuseau horaire UTC.
• Configurer les serveurs Microsoft Windows AD
• Consultez les appareils et versions compatibles.
• Consultez les types de journaux compatibles.

Configurer les serveurs Microsoft Windows AD

1. Sur chaque serveur Microsoft Windows Active Directory, créez et configurez un script PowerShell pour enregistrer les données de journaux dans un fichier de sortie. L'agent Bindplane ou l'agent NXLog lit le fichier de sortie.

   # Set the location where the log file will be written
   $OUTPUT_FILENAME="<Path_of_the_output_file>"
   
   If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}
   
   # USER_CONTEXT: Gets all Active Directory users and their properties.
   Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   
   # ASSET_CONTEXT: Gets all Active Directory assets and their properties.
   Get-ADComputer -Filter * -properties samAccountName | % { Get-ADComputer $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   

2. Remplacez les éléments suivants :

   • Remplacez la valeur de $OUTPUT_FILENAME par l'emplacement du fichier de sortie.
   • Stockez les données au format JSON.
   • Définissez l'encodage sur UTF-8.
   • Utilisez le paramètre -Filter plutôt que le paramètre -LDAPFilter lorsque vous appelez les cmdlets Get-ADUser et Get-ADComputer.

3. Créez une tâche récurrente qui exécute le script pour extraire et écrire les données dans le fichier de sortie.

   1. Ouvrez l'application Planificateur de tâches.
   2. Cliquez sur Créer une tâche.
   3. Saisissez un nom et une description pour la tâche.
   4. Cochez la case Exécuter avec les privilèges les plus élevés pour vous assurer que toutes les données sont récupérées.
   5. Dans l'onglet Déclencheurs, définissez la fréquence à laquelle vous souhaitez répéter la tâche.
   6. Dans l'onglet Action, ajoutez une action et indiquez le chemin d'accès au fichier dans lequel le script est stocké.

Vérifier les appareils et versions compatibles

Microsoft Windows Server est disponible dans les éditions suivantes : Foundation, Essentials, Standard et Datacenter. Le schéma d'événement des journaux générés par chaque édition ne diffère pas.

L'analyseur Google Security Operations est compatible avec les journaux des versions suivantes du serveur Microsoft Windows :

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012

L'analyseur Google Security Operations est compatible avec les journaux collectés par NXLog Community Edition ou Enterprise Edition.

Examiner les types de journaux compatibles

L'analyseur Google Security Operations analysera et normalisera les données récupérées à partir du contexte utilisateur et du contexte de l'asset. Il est compatible avec les journaux générés avec du texte en anglais, mais pas avec ceux générés dans d'autres langues.

Configurer l'agent Bindplane

Nous vous recommandons d'utiliser l'agent Bindplane pour transférer les journaux Windows Active Directory vers Google Security Operations.

Après l'installation, le service de l'agent Bindplane apparaît sous le nom de service observIQ dans la liste des services Windows.

1. Installez l'agent Bindplane sur chaque serveur Windows Active Directory. Pour en savoir plus sur l'installation de l'agent Bindplane, consultez les instructions d'installation de l'agent Bindplane.

2. Créez un fichier de configuration pour l'agent Bindplane avec le contenu suivant :

   receivers:
     filelog:
       include: [ `FILE_PATH` ]
       operators:
         - type: json_parser
       start_at: beginning
     windowseventlog/activedirectoryservice:
       channel: Directory Service
       raw: true
   processors:
     batch:
   
   exporters:
     chronicle/activedirectory:
       endpoint: https://malachiteingestion-pa.googleapis.com
       creds: '{
       "type": "service_account",
       "project_id": "malachite-projectname",
       "private_key_id": `PRIVATE_KEY_ID`,
       "private_key": `PRIVATE_KEY`,
       "client_email":"`SERVICE_ACCOUNT_NAME`@malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "client_id": `CLIENT_ID`,
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/`SERVICSERVICE_ACCOUNT_NAME`%40malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "universe_domain": "googleapis.com"
       }'
     log_type: 'WINDOWS_AD'
     override_log_type: false
     raw_log_field: body
     customer_id: `CUSTOMER_ID`
   
   service:
     pipelines:
       logs/ads:
         receivers:
           - filelog
           - windowseventlog/activedirectoryservice
         processors: [batch]
         exporters: [chronicle/activedirectory]
   

3. Remplacez les éléments suivants :

   • FILE_PATH avec le chemin d'accès au fichier dans lequel la sortie du script PowerShell mentionné dans Configurer les serveurs Microsoft Windows AD a été stockée.

   • PRIVATE_KEY_ID, PRIVATE_KEY SERVICSERVICE_ACCOUNT_NAME,PROJECT_ID, CLIENT_ID et CUSTOMER_ID avec les valeurs respectives du fichier JSON du compte de service que vous pouvez télécharger depuis Google Cloud. Pour en savoir plus sur les clés de compte de service, consultez Créer et supprimer des clés de compte de service.

4. Pour démarrer le service de l'agent Bindplane (anciennement observIQ), sélectionnez Services> Étendu> le service observIQ> Démarrer.

Configurer l'agent NXLog

Le schéma suivant illustre une architecture dans laquelle des agents NXLog sont installés pour collecter et envoyer des événements Microsoft Windows à Google Security Operations. Comparez ces informations à votre environnement pour vous assurer que ces composants sont installés. Votre déploiement peut être différent de cette architecture et peut être plus complexe.

Si vous utilisez l'agent NXLog au lieu de l'agent Bindplane, vérifiez les points suivants :

• Un script PowerShell est créé et configuré sur chaque serveur Microsoft Windows exécutant Active Directory pour collecter les données USER_CONTEXT et ASSET_CONTEXT. Pour en savoir plus, consultez Configurer des serveurs Microsoft Windows AD.
• NXLog est installé sur chaque serveur Microsoft Windows AD pour envoyer des données au serveur Microsoft Windows Server ou Linux central.
• Le redirecteur Google Security Operations est installé sur le serveur Microsoft Windows Server ou Linux central pour transférer les données de journaux vers Google Security Operations.

Configurer NXLog

1. Installez l'agent NXLog sur chaque collecteur exécuté sur le serveur Windows Active Directory. Cette application transfère les journaux vers le serveur central Microsoft Windows ou Linux. Pour en savoir plus, consultez la documentation NXLog.

2. Créez un fichier de configuration pour chaque instance NXLog. Utilisez le module NXLog im_file pour lire le fichier et analyser les lignes en champs. Utilisez om_tcp pour transférer les données vers le serveur central Microsoft Windows ou Linux.

   Voici un exemple de configuration NXLog. Remplacez les valeurs <hostname> et <port> par des informations sur le serveur Microsoft Windows ou Linux central de destination. Dans la section <Input in_adcontext> et la propriété File, ajoutez le chemin d'accès au fichier journal de sortie écrit par le script PowerShell. Définissez toujours DirCheckInterval et PollInterval. Si ces valeurs ne sont pas définies, NXLog interroge les fichiers toutes les secondes.

   define ROOT C:\Program Files\nxlog
   define ADCONTEXT_OUTPUT_DESTINATION_ADDRESS <hostname>
   define ADCONTEXT_OUTPUT_DESTINATION_PORT <port>
   
   Moduledir   %ROOT%\modules
   CacheDir    %ROOT%\data
   Pidfile     %ROOT%\data\nxlog.pid
   SpoolDir    %ROOT%\data
   LogFile     %ROOT%\data\nxlog.log
   
   <Input in_adcontext>
       Module im_file
       File "<Path_of_the_output_file>"
       DirCheckInterval 3600
       PollInterval 3600
   </Input>
   
   <Output out_chronicle_adcontext>
       Module  om_tcp
       Host    %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS%
       Port    %ADCONTEXT_OUTPUT_DESTINATION_PORT%
   </Output>
   
   <Route ad_context_to_chronicle>
       Path in_adcontext => out_chronicle_adcontext
   </Route>
   

3. Démarrez le service NXLog dans chaque système.

Configurer le redirecteur sur un serveur central

Pour en savoir plus sur l'installation et la configuration du redirecteur sous Linux, consultez Installer et configurer le redirecteur sous Linux. Pour savoir comment installer et configurer le transmetteur sur Microsoft Windows, consultez Installer et configurer le transmetteur sur Microsoft Windows.

1. Configurez le système avec le fuseau horaire UTC.
2. Installez le redirecteur Google Security Operations sur le serveur Microsoft Windows ou Linux central.

3. Configurez le redirecteur Google Security Operations pour envoyer les journaux à Google Security Operations. Voici un exemple de configuration de redirecteur :

     - syslog:
         common:
           enabled: true
           data_type: WINDOWS_AD
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

Formats de journaux Windows AD acceptés

L'analyseur Windows AD est compatible avec les journaux au format JSON.

Exemples de journaux Windows AD compatibles

• JSON :

  {
    "GivenName": "user1",
    "Surname": "itadmin",
    "UserPrincipalName": "user1.itadmin@testdhcp2.local",
    "Enabled": true,
    "SamAccountName": "user1.itadmin",
    "SID": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000"
    },
    "DistinguishedName": "CN=test,CN=Users,DC=testdhcp2,DC=local",
    "Name": "test",
    "ObjectClass": "user",
    "ObjectGuid": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "PropertyNames": [
      "AccountExpirationDate",
      "accountExpires",
      "AccountLockoutTime",
      "AccountNotDelegated",
      "AllowReversiblePasswordEncryption",
      "AuthenticationPolicy",
      "AuthenticationPolicySilo",
      "BadLogonCount",
      "badPasswordTime",
      "badPwdCount",
      "c",
      "CannotChangePassword",
      "CanonicalName",
      "Certificates",
      "City",
      "CN",
      "co",
      "codePage",
      "Company",
      "CompoundIdentitySupported",
      "Country",
      "countryCode",
      "Created",
      "createTimeStamp",
      "Deleted",
      "Department",
      "Description",
      "DisplayName",
      "DistinguishedName",
      "Division",
      "DoesNotRequirePreAuth",
      "dSCorePropagationData",
      "EmailAddress",
      "EmployeeID",
      "EmployeeNumber",
      "Enabled",
      "facsimileTelephoneNumber",
      "Fax",
      "GivenName",
      "HomeDirectory",
      "HomedirRequired",
      "HomeDrive",
      "HomePage",
      "HomePhone",
      "Initials",
      "instanceType",
      "ipPhone",
      "isDeleted",
      "KerberosEncryptionType",
      "l",
      "LastBadPasswordAttempt",
      "LastKnownParent",
      "lastLogoff",
      "lastLogon",
      "LastLogonDate",
      "lastLogonTimestamp",
      "LockedOut",
      "lockoutTime",
      "logonCount",
      "logonHours",
      "LogonWorkstations",
      "mail",
      "Manager",
      "MemberOf",
      "MNSLogonAccount",
      "mobile",
      "MobilePhone",
      "Modified",
      "modifyTimeStamp",
      "msDS-SupportedEncryptionTypes",
      "msDS-User-Account-Control-Computed",
      "Name",
      "nTSecurityDescriptor",
      "ObjectCategory",
      "ObjectClass",
      "ObjectGUID",
      "objectSid",
      "Office",
      "OfficePhone",
      "Organization",
      "OtherName",
      "pager",
      "PasswordExpired",
      "PasswordLastSet",
      "PasswordNeverExpires",
      "PasswordNotRequired",
      "physicalDeliveryOfficeName",
      "POBox",
      "PostalCode",
      "postOfficeBox",
      "PrimaryGroup",
      "primaryGroupID",
      "PrincipalsAllowedToDelegateToAccount",
      "ProfilePath",
      "ProtectedFromAccidentalDeletion",
      "pwdLastSet",
      "SamAccountName",
      "sAMAccountType",
      "ScriptPath",
      "sDRightsEffective",
      "ServicePrincipalNames",
      "SID",
      "SIDHistory",
      "SmartcardLogonRequired",
      "sn",
      "st",
      "State",
      "StreetAddress",
      "Surname",
      "telephoneNumber",
      "Title",
      "TrustedForDelegation",
      "TrustedToAuthForDelegation",
      "UseDESKeyOnly",
      "userAccountControl",
      "userCertificate",
      "userParameters",
      "UserPrincipalName",
      "uSNChanged",
      "uSNCreated",
      "whenChanged",
      "whenCreated",
      "wWWHomePage"
    ],
    "AddedProperties": [],
    "RemovedProperties": [],
    "ModifiedProperties": [],
    "PropertyCount": 123,
    "AccountExpirationDate": null,
    "accountExpires": 0,
    "AccountLockoutTime": "\\/Date(1631175863106)\\/",
    "AccountNotDelegated": true,
    "AllowReversiblePasswordEncryption": false,
    "AuthenticationPolicy": [],
    "AuthenticationPolicySilo": [],
    "BadLogonCount": 3,
    "badPasswordTime": 132756494631068585,
    "badPwdCount": 3,
    "c": "IN",
    "CannotChangePassword": false,
    "CanonicalName": "testdhcp2.local/Users/test",
    "Certificates": [],
    "City": "Ahmedabad",
    "CN": "test",
    "co": "India",
    "codePage": 0,
    "Company": "user",
    "CompoundIdentitySupported": [
      false
    ],
    "Country": "IN",
    "countryCode": 356,
    "Created": "\\/Date(1628229355000)\\/",
    "createTimeStamp": "\\/Date(1628229355000)\\/",
    "Deleted": null,
    "Department": "it",
    "Description": "itadmin",
    "DisplayName": "user1",
    "Division": "test",
    "DoesNotRequirePreAuth": false,
    "dSCorePropagationData": [
      "\\/Date(1631191510000)\\/",
      "\\/Date(-11644473600000)\\/"
    ],
    "EmailAddress": "user@dummy.local",
    "EmployeeID": null,
    "EmployeeNumber": null,
    "facsimileTelephoneNumber": "12345678",
    "Fax": "12345678",
    "HomeDirectory": "\\\\\\\\DHCP-AD01\\\\ADContext",
    "HomedirRequired": false,
    "HomeDrive": "G:",
    "HomePage": "www.test.com",
    "HomePhone": "123456789",
    "Initials": "user1",
    "instanceType": 4,
    "ipPhone": "1121",
    "isDeleted": null,
    "KerberosEncryptionType": [
      0
    ],
    "l": "ahmedabad",
    "LastBadPasswordAttempt": "\\/Date(1631175863106)\\/",
    "LastKnownParent": null,
    "lastLogoff": 0,
    "lastLogon": 132756492460689244,
    "LastLogonDate": "\\/Date(1631175025098)\\/",
    "lastLogonTimestamp": 132756486250985369,
    "LockedOut": false,
    "lockoutTime": 132756494631068585,
    "logonCount": 2,
    "logonHours": [
      0,
      0,
      248,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      7,
      0,
      0,
      0,
      0,
      0,
      0
    ],
    "LogonWorkstations": null,
    "mail": "user@dummy.local",
    "Manager": "CN=Administrator,CN=Users,DC=testdhcp2,DC=local",
    "MemberOf": [
      "CN=Netwrix Auditor Client Users,CN=Users,DC=dnstest2,DC=local",
      "CN=Netwrix Auditor Administrators,CN=Users,DC=dnstest2,DC=local",
      "CN=Group Policy Creator Owners,CN=Users,DC=dnstest2,DC=local",
      "CN=Domain Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Enterprise Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Schema Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Remote Desktop Users,CN=Builtin,DC=dnstest2,DC=local",
      "CN=Administrators,CN=Builtin,DC=dnstest2,DC=local"
    ],
    "MNSLogonAccount": false,
    "mobile": "923456789",
    "MobilePhone": "823456789",
    "Modified": "\\/Date(1631277960000)\\/",
    "modifyTimeStamp": "\\/Date(1631277960000)\\/",
    "msDS-SupportedEncryptionTypes": 0,
    "msDS-User-Account-Control-Computed": 0,
    "nTSecurityDescriptor": {
      "AccessRightType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Enum",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryRights",
        "FullName": "System.DirectoryServices.ActiveDirectoryRights",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryRights, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "f65acb9b-4c77-33ff-8523-43e9cc2c5798",
        "IsEnum": true,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryRights",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554438,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "",
        "DeclaredEvents": "",
        "DeclaredFields": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMembers": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMethods": "",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "",
        "ImplementedInterfaces": "System.IComparable System.IFormattable System.IConvertible",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 257,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": false,
        "IsInterface": false,
        "IsValueType": true,
        "IsAbstract": false,
        "IsSealed": true,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": true,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": "[System.FlagsAttribute()]"
      },
      "AccessRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAccessRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAccessRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "0db7ea8c-53d9-3d6d-8b09-bb209cf0d0ae",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAccessRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554445,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AuditRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAuditRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAuditRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "4ad0312a-2ed0-3526-97ec-f9c6f310c5e0",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAuditRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554453,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AreAccessRulesProtected": false,
      "AreAuditRulesProtected": false,
      "AreAccessRulesCanonical": true,
      "AreAuditRulesCanonical": true
    },
    "ObjectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=testdhcp2,DC=local",
    "ObjectGUID": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "objectSid": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000m"
    },
    "Office": "db office",
    "OfficePhone": "91-123456789",
    "Organization": null,
    "OtherName": null,
    "pager": "234567890",
    "PasswordExpired": false,
    "PasswordLastSet": "\\/Date(1631174951326)\\/",
    "PasswordNeverExpires": false,
    "PasswordNotRequired": false,
    "physicalDeliveryOfficeName": "db office",
    "POBox": "dummy",
    "PostalCode": "380015",
    "postOfficeBox": [
      "dummy"
    ],
    "PrimaryGroup": "CN=Domain Users,CN=Users,DC=testdhcp2,DC=local",
    "primaryGroupID": 513,
    "PrincipalsAllowedToDelegateToAccount": [],
    "ProfilePath": null,
    "ProtectedFromAccidentalDeletion": false,
    "pwdLastSet": 132756485513268133,
    "sAMAccountType": 805306368,
    "ScriptPath": null,
    "sDRightsEffective": 15,
    "ServicePrincipalNames": [],
    "SIDHistory": [],
    "SmartcardLogonRequired": false,
    "sn": "itadmin",
    "st": "Gujarat",
    "State": "Gujarat",
    "StreetAddress": "1,user street ,dummy,dummy",
    "telephoneNumber": "91-123456789",
    "Title": "it admin",
    "TrustedForDelegation": false,
    "TrustedToAuthForDelegation": false,
    "UseDESKeyOnly": false,
    "userAccountControl": 1049088,
    "userCertificate": [],
    "userParameters": null,
    "uSNChanged": 57594,
    "uSNCreated": 32800,
    "whenChanged": "\\/Date(1631277960000)\\/",
    "whenCreated": "\\/Date(1628229355000)\\/",
    "wWWHomePage": "www.test.com"
  } 
  

Référence de mappage des champs : champs de journaux d'appareils vers champs UDM

Cette section décrit comment l'analyseur mappe les champs de journaux d'origine aux champs du modèle de données unifié.

Référence de mappage de champ : WINDOWS_AD

Le tableau suivant liste les champs de journaux du type de journal WINDOWS_AD et les champs UDM correspondants.

Vous avez encore besoin d'aide ? Obtenez des réponses de membres de la communauté et de professionnels Google SecOps.