All Apps and Add-ons

Splunk DB Connect: How to parse user name field form McAfee logs so it can support CIM?

Champion

Hi,

I have McAfee logs coming in to Splunk using Splunk DB Connect application. There are total 3 fields related to user name:
1. user
2. sourcelogonuser
3. logon_user

and the mcafee logs tagged to malware, attack, operations and the data is being accelerated by Malware datamodel. Malware data model looks for user and user field is available in McAfee logs, but the problem is I need to consider logonuser/sourcelogonuser not user field, I could simply rename sourcelogonuser/logonuser to user to work with CIM, again the problem with logonuser/sourcelogon_user has username like :

domain\username
username@domain.com
username

how to deal with the above scenarios, the reason why I would like to reformat the username field from above three scenarios to user, when we search something user=username , it will not return user=domain\username.

please help me out, if any spelunker already faced/solved this problem.

————————————
If this helps, give a like below.
0 Karma

Splunk Employee
Splunk Employee

By looking at the CIM doc
http://docs.splunk.com/Documentation/CIM/4.9.1/User/Malware

you want to use "destntdomain" field to extract the domain separately from the username.

0 Karma