PAM360 Parser

[adem_netsys]

Hi

I have a PAM360 Parser, but it can miss users. Does anyone have a parser related to this?

[kcanalichio]

Here is my PAm360 Parser, its pretty basic though

<patternDefinitions><pattern name="patIpV6Dot"><![CDATA[\d{1,2}:\d{1,2}:\d{1,2}:\d{1,2}:\d{1,2}:\d{1,2}:\d{1,2}:\d{1,2}]]></pattern></patternDefinitions><eventFormatRecognizer><![CDATA[<:gPatSyslogPRI><:gPatMon>\s+<:gPatDay>\s+<:gPatTime>\s+.*ResourceAudit:|UserAudit:]]></eventFormatRecognizer><parsingInstructions><switch><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostName:gPatStr>\s+<_ptype:gPatStr>:<userId:gPatStr>:<srcIpAddr:patIpV6Dot>\s+<_type:gPatStr><_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute><setEventAttribute attr="debug">caseIPv6</setEventAttribute></case><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostName:gPatStr>\s+<_ptype:gPatStr>:<userId:gPatStr>:<srcIpAddr:gPatIpAddr>\s+<_type:gPatStr><_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute><setEventAttribute attr="debug">caseIPV4</setEventAttribute></case><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostName:gPatStr>\s+<_ptype:gPatStr>:<userId:gPatStr>:<srcName:gPatStr>\s+<_type:gPatStr><_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute><setEventAttribute attr="debug">caseHost</setEventAttribute></case><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostIp:gPatIpAddr>\s+<_ptype:gPatStr>:<_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute><setEventAttribute attr="debug">caseAll</setEventAttribute></case></switch><setEventAttribute attr="eventType">combineMsgId("$_ptype", "_", $_type)</setEventAttribute><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute><setEventAttribute attr="eventAction">0</setEventAttribute><setEventAttribute attr="type">$_ptype</setEventAttribute><setEventAttribute attr="compEventType">$_type</setEventAttribute><setEventAttribute attr="usrMsg">$_body</setEventAttribute><choose><when test="$_ptype =  'ResourceAudit'"><collectAndSetAttrByRegex src="$_body"><regex><![CDATA[<_year:gPatYear>\/<_mon:gPatMon>\/<_day:gPatDay>\s+<_time:gPatTime>\s+<status:gPatStr>\s+<serverName:gPatStr>\s+<targetCustomer:gPatStr>:<accountName:gPatStr>:<distinctUser:gPatStr>:<msg:gPatMesgBody>]]></regex></collectAndSetAttrByRegex><setEventAttribute attr="eventSeverity">1</setEventAttribute></when><when test="$_ptype =  'UserAudit'"><collectAndSetAttrByRegex src="$_body"><regex><![CDATA[<_year:gPatYear>\/<_mon:gPatMon>\/<_day:gPatDay>\s+<_time:gPatTime>\s+<status:gPatStr>\s+<serverName:gPatStr> <targetCustomer:gPatStr>-<distinctUser:gPatStr>:<msg:gPatMesgBody>]]></regex></collectAndSetAttrByRegex><setEventAttribute attr="eventSeverity">1</setEventAttribute></when></choose><choose><when test="$_type = 'File OPen'"><!-- <182>Jan 2 13:13:46 file_smb[2270]: [User:TEK2020+kcanalichio(192.168.216.7)] File Open(Read) /mnt/array1/Applications/ISO --></when></choose><when test="exist srcName"><setEventAttribute attr="hostName">$srcName</setEventAttribute></when></parsingInstructions>

---

[adem_netsys]

When I try useraudit and resourceaudit logs, I get an error in 29 line 38 column.

[kcanalichio]

The error was probably caused by the cutting and pasting  of the parser into web form. I would check line 30 to make sure all of the variable (hostName, srcName, userId)  and pattern definitions exist in the SEIM. And make sure the \s+ are all correct

<![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostName:gPatStr>\s+<_ptype:gPatStr>:<userId:gPatStr>:<srcName:gPatStr>\s+<_type:gPatStr><_body:gPatMesgBody>]]>

Also your messages are in this format

<38>May 31 03:04:18 p-core-pam0 ResourceAudit:System:localhost Password_Verified 2024/05/31 03:04:17 Success p-core-pam0 u-rixrug-rpt0:vapps_nimda2:N/A:Password_not_in_Sync

[adem_netsys]

Yes, I checked the variables and they're all in SIEM. The message is in the format you posted and when I try that I get a test error.

[kcanalichio]

Sorry, I currently don't have time to help you debug it. It works fine in my SEIM. You should try removing variables from the regex until it works and then add them back in using the correct syntax that will match the event

[adem_netsys]

This is the parser I have and I parser the name with it, but in useraudit this log is different and therefore it misses the name.

<patternDefinitions>
<pattern name="patSep"><![CDATA[\s+|\t+]]></pattern>
<pattern name="patUser"><![CDATA[.*?:]]></pattern>
<pattern name="patSentence"><![CDATA[[^ ]*[\s[^ ]*]*]]></pattern>
<pattern name="patReg"><![CDATA[ResourceAudit|UserAudit]]></pattern>
</patternDefinitions>
<eventFormatRecognizer><![CDATA[<:patReg>]]></eventFormatRecognizer>
<parsingInstructions>
<collectFieldsByRegex src="$_rawmsg">
<regex>
<![CDATA[<:gPatSyslogPRI>?<:gPatMon><:patSep><:gPatDay><:patSep><:gPatTime>\s+<:gPatStr>\s+<_body:gPatMesgBody>]]>
</regex>
</collectFieldsByRegex>
<collectFieldsByRegex src="$_body">
<regex>
<![CDATA[<_eventType:patReg>:<user:gPatStrEndColon>:<srcIpAddr:gPatStr><:patSep><action:gPatStr><:patSep><:gPatStr><:patSep><:gPatStr><:patSep><status:gPatStr>]]>
</regex>
</collectFieldsByRegex>
<setEventAttribute attr="eventType">combineMsgId( $_eventType, "-", $status)</setEventAttribute>
</parsingInstructions>

[adem_netsys]

@kcanalichio 

Which attributes did you create for this?

[kcanalichio]

I create so many parser and try to use existing attributes:

but based on the parser these are the attributes that need to exist

hostName

hostIp

eventType

deviceTime

eventAction

type

compEventType

usrMsg

status

serverName

targetCustomer

eventSeverity

distinctUser

msg

accountName

[adem_netsys]

@kcanalichio 

Thank you for your return, most of these are already available. I just added hostIpAddr instead of hostIp but still no change.