Mapping between log messages and Meta data

[RayBlair]

Where is the mapping defined between NetWitness and syslog messages?  For example if I want to see a failed ssh login on a RedHat system I could look for the following in /var/log/messages:

#     type=USER_AUTH

#     $msg contains the following; ‘op=PAM’  exe=”/usr/sbin/sshd”  res=failed

#     acct=username can identify who performed the ssh (root)

What information is used from the syslog to populate alert.id, event.desc etc?

Also is there a list of all possible values of alert.id?.

[DaveGlover]

Ray

The are parsers involved which normalize the data

These parsers are located in /etc/netwitness/ng/envision/etc/devices

For example with a Redhat failed login -> Jul 10 17:44:18 NW-HU unix_chkpwd[22684]: password check failed for user (root)

Using the RedHat parser line matching the log message -> 

functions="<@hostname:*HDR(hhost)><@ec_theme:Authentication><@ec_subject:User><@ec_outcome:Failure><@:*SYSVAL($MSGID,$ID1)><@msg:*PARMVAL($MSG)><@event_description:could not identify user from getpwnam>"

content="<agent>[<process_id>]: could not identify user (from getpwnam(<username>)"

From here we can see how the data is being parsed from raw into meta in addition to the enrichments that are added.

In addition to the log parser there are Application Rules that will add info to meta about the log message.

Dave