Splunk Enterprise Security

Splunk Enterprise Security: How to retrieve ldap assets information?

paola92
Explorer

I tried to retrieve assets information of ldap so I used the search (I know that I must not to use search nt_host...)

"|ldapsearch domain=XXX search="(&(objectClass=computer))"
|eval city=""
|eval country=""
|eval priority="medium"
|eval category="normal"
|eval dns=dNSHostName
|eval owner=managedBy
|rex field=sAMAccountName mode=sed "s/\$//g"
|eval nt_host=sAMAccountName |search nt_host=segurinfo 
|makemv delim="," dn
|rex field=dn "(OU|CN)\=(?.+)"
|table Source_Address,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av" 

and I have the table but I the IP is not because I do not use static IP so I think is possible to use the security logs that I have but I do not how can i correlate it.

alt text

I used the next search for nt_host=segurinfo: index="wineventlog" Workstation_Name=segurinfo and I see in the logs the information that I need.

alt text

0 Karma

kagamalai
Explorer

I used the below query but not searched the computer assets its through the below error message please advise ?

"Error in 'rex' command: Encountered the following error while compiling the regex '(OU|CN)\=(?.+)': Regex: unrecognized character after (? or (?-. "

 

 

|ldapsearch domain=XXX search="(&(objectClass=computer))"
|eval city=""
|eval country=""
|eval priority="medium"
|eval category="normal"
|eval dns=dNSHostName
|eval owner=managedBy
|rex field=sAMAccountName mode=sed "s/\$//g"
|eval nt_host=sAMAccountName |search nt_host=segurinfo 
|makemv delim="," dn
|rex field=dn "(OU|CN)\=(?.+)"
|table Source_Address,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av 

 

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@paola92 - Did the answer provided by starcher help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

starcher
SplunkTrust
SplunkTrust

You should output your ldap search to a csv lookup table then tell ES that is a new assets lookup table. It will then consume it on changes and keep the auto lookups that exist within ES populated and working. You can find the instructions on using asset tables and a macro to ensure they have gotten ingested at http://docs.splunk.com/Documentation/ES/4.6.0/User/AssetandIdentityLookupReference

0 Karma

starcher
SplunkTrust
SplunkTrust

I just re-read your post. I am sorry I missed the DHCP reference. I would not write the table with IP if you use DHCP. I would write only with the computer names. Then additionally make an asset table with the DHCP ranges but without computer name information. Then at least if the data is IP you will get a category displayed like DHCP-Workstation or however you tag that ip range asset object. And if the match is by name you get the more precise asset information based on your ldap info.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...