Collect Microsoft Windows AD logs

This document includes the following information:

• Deployment architecture and installation steps, plus any required configuration that produce logs supported by the Google Security Operations parser for Microsoft Windows Active Directory events. For an overview of Google Security Operations data ingestion, see Data ingestion to Google Security Operations .
• Information about how the parser maps fields in the original log to Google Security Operations Unified Data Model fields.

Based on your deployment architecture, configure the Bindplane agent or the NXLog agent to ingest Microsoft Windows Active Directory logs into Google Security Operations. We recommend that you use Bindplane Agent to forward the logs of the Windows Active Directory into Google Security Operations.

Information in this document applies to the parser with the WINDOWS_AD ingestion label. The ingestion label identifies which parser normalizes raw log data to structured UDM format.

Before you begin

Before you configure Bindplane agent or the NXLog Agent, complete the following tasks:

• Configure all systems to use UTC time zone.
• Configure Microsoft Windows AD servers .
• Review supported devices and versions .
• Review supported log types .

Configure Microsoft Windows AD servers

1. On each Microsoft Windows Active Directory server, create and configure a PowerShell script to save the log data to an output file. Bindplane Agent or NXLog Agent reads the output file.

    # Set the location where the log file will be written
   $OUTPUT_FILENAME="<Path_of_the_output_file>"
   
   If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}
   
   # USER_CONTEXT: Gets all Active Directory users and their properties.
   Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   
   # ASSET_CONTEXT: Gets all Active Directory assets and their properties.
   Get-ADComputer -Filter * -properties samAccountName | % { Get-ADComputer $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append } 
   

2. Replace the following :

   • Replace the value of $OUTPUT_FILENAME with the location of the output file.
   • Store the data in JSON format.
   • Set the encoding to UTF-8.
   • Use the -Filter parameter, rather than the -LDAPFilter parameter, when calling the Get-ADUser and Get-ADComputer cmdlets.

3. Create a recurring task that runs the script to fetch and write data to the output file.

   1. Open the Task Scheduler application.
   2. Click Create task.
   3. Enter a name and description for the task.
   4. Select the Run with highest privilegescheckbox to make sure all data is retrieved.
   5. In the Triggerstab, define when you want to repeat the task.
   6. In the Actiontab, add a new action and provide the path of the file where the script is stored.

Review supported devices and versions

Microsoft Windows Server is released with the following editions: Foundation, Essentials, Standard, and Datacenter. The event schema of logs generated by each edition does not differ.

The Google Security Operations Parser supports logs from the following Microsoft Windows server versions:

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012

The Google Security Operations parser supports logs that are collected by NXLog Community Edition or Enterprise Edition.

Review supported log types

The Google Security Operations parser will parse and normalize data retrieved from the User Context and the Asset Context . It supports logs generated with English language text and doesn't support logs generated in non-English languages.

Configure the Bindplane agent

We recommend that you use the Bindplane agent to forward the logs of the Windows Active Directory into Google Security Operations.

After installation, the Bindplane agent service appears as the observIQ service in the list of Windows services.

1. Install the Bindplane agent on each Windows Active Directory server. For more information about installing the Bindplane agent, see the Bindplane Agent installation instructions .

2. Create a configuration file for the Bindplane agent with the following contents:

    receivers:
     filelog:
       include: [ ` FILE_PATH 
   ` ]
       operators:
         - type: json_parser
       start_at: beginning
     windowseventlog/activedirectoryservice:
       channel: Directory Service
       raw: true
   processors:
     batch:
   
   exporters:
     chronicle/activedirectory:
       endpoint: https://malachiteingestion-pa.googleapis.com
       creds: '{
       "type": "service_account",
       "project_id": "malachite-projectname",
       "private_key_id": ` PRIVATE_KEY_ID 
   `,
       "private_key": ` PRIVATE_KEY 
   `,
       "client_email":"` SERVICE_ACCOUNT_NAME 
   `@malachite-` PROJECT_ID 
   `.iam.gserviceaccount.com",
       "client_id": ` CLIENT_ID 
   `,
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/` SERVICSERVICE_ACCOUNT_NAME 
   `%40malachite-` PROJECT_ID 
   `.iam.gserviceaccount.com",
       "universe_domain": "googleapis.com"
       }'
     log_type: 'WINDOWS_AD'
     override_log_type: false
     raw_log_field: body
     customer_id: ` CUSTOMER_ID 
   `
   
   service:
     pipelines:
       logs/ads:
         receivers:
           - filelog
           - windowseventlog/activedirectoryservice
         processors: [batch]
         exporters: [chronicle/activedirectory] 
   

3. Replace the following :

   • FILE_PATH with the path of the file where the output of the PowerShell script mentioned in the Configure Microsoft Windows AD servers has been stored.

   • PRIVATE_KEY_ID , PRIVATE_KEY SERVICSERVICE_ACCOUNT_NAME , PROJECT_ID , CLIENT_ID and CUSTOMER_ID with the respective values from the service account JSON file which you can download from Google Cloud. For more information about service account keys, see Create and delete service account keys .

4. To start the Bindplane (formally known as observIQ) agent service, select Services > Extended > the observIQ Service > Start.

Configure NXLog Agent

The following diagram shows an architecture in which NXLog Agents are installed to collect and send Microsoft Windows events to Google Security Operations. Compare this information with your environment to be sure these components are installed. Your deployment might be different from this architecture and might be more complex.

If you use the NXLog agent instead of the Bindplane agent, verify the following:

• A PowerShell script is created and configured on each Microsoft Windows Server that runs Active Directory to collect USER_CONTEXT and ASSET_CONTEXT data. For more information, see the Configure Microsoft Windows AD servers .
• NXLog is installed on each Microsoft Windows AD server to send data to the central Microsoft Windows Server or Linux server.
• Google Security Operations forwarder is installed on the central Microsoft Windows Server or Linux server to forward log data to Google Security Operations.

Configure NXLog

1. Install the NXLog agent on each collector that runs on the Windows Active Directory server. This application forwards logs to the central Microsoft Windows or Linux server. For more information, see the NXLog documentation .

2. Create a configuration file for each NXLog instance. Use the NXLog im_file module to read from the file and parse the lines into fields. Use om_tcp to forward data to the central Microsoft Windows or Linux server.

   The following is an example of the NXLog configuration. Replace <hostname> and <port> values with information about the destination central Microsoft Windows or Linux Server. In the <Input in_adcontext> section and File property, add the path of the output log file written by the PowerShell script. Always set DirCheckInterval and PollInterval . If these are not defined, NXLog polls for files every 1 second.

    define ROOT C:\Program Files\nxlog
   define ADCONTEXT_OUTPUT_DESTINATION_ADDRESS <hostname>
   define ADCONTEXT_OUTPUT_DESTINATION_PORT <port>
   
   Moduledir   %ROOT%\modules
   CacheDir    %ROOT%\data
   Pidfile     %ROOT%\data\nxlog.pid
   SpoolDir    %ROOT%\data
   LogFile     %ROOT%\data\nxlog.log
   
   <Input in_adcontext>
       Module im_file
       File "<Path_of_the_output_file>"
       DirCheckInterval 3600
       PollInterval 3600
   </Input>
   
   <Output out_chronicle_adcontext>
       Module  om_tcp
       Host    %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS%
       Port    %ADCONTEXT_OUTPUT_DESTINATION_PORT%
   </Output>
   
   <Route ad_context_to_chronicle>
       Path in_adcontext => out_chronicle_adcontext
   </Route> 
   

3. Start the NXLog service in each system.

Configure the forwarder on a central server

For information about installing and configuring the forwarder on Linux, see Installing and configuring the forwarder on Linux . For information about installing and configuring the forwarder on Microsoft Windows, see Installing and configuring the forwarder on Microsoft Windows .

1. Configure the system with the UTC time zone.
2. Install the Google Security Operations forwarder on the central Microsoft Windows or Linux server.

3. Configure the Google Security Operations forwarder to send logs to Google Security Operations. The following is an example forwarder configuration:

    - syslog:
         common:
           enabled: true
           data_type: WINDOWS_AD
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60 
   

Supported Windows AD log formats

The Windows AD parser supports logs in JSON format.

Supported Windows AD sample logs

• JSON:

   {
    "GivenName": "user1",
    "Surname": "itadmin",
    "UserPrincipalName": "user1.itadmin@testdhcp2.local",
    "Enabled": true,
    "SamAccountName": "user1.itadmin",
    "SID": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000"
    },
    "DistinguishedName": "CN=test,CN=Users,DC=testdhcp2,DC=local",
    "Name": "test",
    "ObjectClass": "user",
    "ObjectGuid": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "PropertyNames": [
      "AccountExpirationDate",
      "accountExpires",
      "AccountLockoutTime",
      "AccountNotDelegated",
      "AllowReversiblePasswordEncryption",
      "AuthenticationPolicy",
      "AuthenticationPolicySilo",
      "BadLogonCount",
      "badPasswordTime",
      "badPwdCount",
      "c",
      "CannotChangePassword",
      "CanonicalName",
      "Certificates",
      "City",
      "CN",
      "co",
      "codePage",
      "Company",
      "CompoundIdentitySupported",
      "Country",
      "countryCode",
      "Created",
      "createTimeStamp",
      "Deleted",
      "Department",
      "Description",
      "DisplayName",
      "DistinguishedName",
      "Division",
      "DoesNotRequirePreAuth",
      "dSCorePropagationData",
      "EmailAddress",
      "EmployeeID",
      "EmployeeNumber",
      "Enabled",
      "facsimileTelephoneNumber",
      "Fax",
      "GivenName",
      "HomeDirectory",
      "HomedirRequired",
      "HomeDrive",
      "HomePage",
      "HomePhone",
      "Initials",
      "instanceType",
      "ipPhone",
      "isDeleted",
      "KerberosEncryptionType",
      "l",
      "LastBadPasswordAttempt",
      "LastKnownParent",
      "lastLogoff",
      "lastLogon",
      "LastLogonDate",
      "lastLogonTimestamp",
      "LockedOut",
      "lockoutTime",
      "logonCount",
      "logonHours",
      "LogonWorkstations",
      "mail",
      "Manager",
      "MemberOf",
      "MNSLogonAccount",
      "mobile",
      "MobilePhone",
      "Modified",
      "modifyTimeStamp",
      "msDS-SupportedEncryptionTypes",
      "msDS-User-Account-Control-Computed",
      "Name",
      "nTSecurityDescriptor",
      "ObjectCategory",
      "ObjectClass",
      "ObjectGUID",
      "objectSid",
      "Office",
      "OfficePhone",
      "Organization",
      "OtherName",
      "pager",
      "PasswordExpired",
      "PasswordLastSet",
      "PasswordNeverExpires",
      "PasswordNotRequired",
      "physicalDeliveryOfficeName",
      "POBox",
      "PostalCode",
      "postOfficeBox",
      "PrimaryGroup",
      "primaryGroupID",
      "PrincipalsAllowedToDelegateToAccount",
      "ProfilePath",
      "ProtectedFromAccidentalDeletion",
      "pwdLastSet",
      "SamAccountName",
      "sAMAccountType",
      "ScriptPath",
      "sDRightsEffective",
      "ServicePrincipalNames",
      "SID",
      "SIDHistory",
      "SmartcardLogonRequired",
      "sn",
      "st",
      "State",
      "StreetAddress",
      "Surname",
      "telephoneNumber",
      "Title",
      "TrustedForDelegation",
      "TrustedToAuthForDelegation",
      "UseDESKeyOnly",
      "userAccountControl",
      "userCertificate",
      "userParameters",
      "UserPrincipalName",
      "uSNChanged",
      "uSNCreated",
      "whenChanged",
      "whenCreated",
      "wWWHomePage"
    ],
    "AddedProperties": [],
    "RemovedProperties": [],
    "ModifiedProperties": [],
    "PropertyCount": 123,
    "AccountExpirationDate": null,
    "accountExpires": 0,
    "AccountLockoutTime": "\\/Date(1631175863106)\\/",
    "AccountNotDelegated": true,
    "AllowReversiblePasswordEncryption": false,
    "AuthenticationPolicy": [],
    "AuthenticationPolicySilo": [],
    "BadLogonCount": 3,
    "badPasswordTime": 132756494631068585,
    "badPwdCount": 3,
    "c": "IN",
    "CannotChangePassword": false,
    "CanonicalName": "testdhcp2.local/Users/test",
    "Certificates": [],
    "City": "Ahmedabad",
    "CN": "test",
    "co": "India",
    "codePage": 0,
    "Company": "user",
    "CompoundIdentitySupported": [
      false
    ],
    "Country": "IN",
    "countryCode": 356,
    "Created": "\\/Date(1628229355000)\\/",
    "createTimeStamp": "\\/Date(1628229355000)\\/",
    "Deleted": null,
    "Department": "it",
    "Description": "itadmin",
    "DisplayName": "user1",
    "Division": "test",
    "DoesNotRequirePreAuth": false,
    "dSCorePropagationData": [
      "\\/Date(1631191510000)\\/",
      "\\/Date(-11644473600000)\\/"
    ],
    "EmailAddress": "user@dummy.local",
    "EmployeeID": null,
    "EmployeeNumber": null,
    "facsimileTelephoneNumber": "12345678",
    "Fax": "12345678",
    "HomeDirectory": "\\\\\\\\DHCP-AD01\\\\ADContext",
    "HomedirRequired": false,
    "HomeDrive": "G:",
    "HomePage": "www.test.com",
    "HomePhone": "123456789",
    "Initials": "user1",
    "instanceType": 4,
    "ipPhone": "1121",
    "isDeleted": null,
    "KerberosEncryptionType": [
      0
    ],
    "l": "ahmedabad",
    "LastBadPasswordAttempt": "\\/Date(1631175863106)\\/",
    "LastKnownParent": null,
    "lastLogoff": 0,
    "lastLogon": 132756492460689244,
    "LastLogonDate": "\\/Date(1631175025098)\\/",
    "lastLogonTimestamp": 132756486250985369,
    "LockedOut": false,
    "lockoutTime": 132756494631068585,
    "logonCount": 2,
    "logonHours": [
      0,
      0,
      248,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      255,
      7,
      0,
      0,
      0,
      0,
      0,
      0
    ],
    "LogonWorkstations": null,
    "mail": "user@dummy.local",
    "Manager": "CN=Administrator,CN=Users,DC=testdhcp2,DC=local",
    "MemberOf": [
      "CN=Netwrix Auditor Client Users,CN=Users,DC=dnstest2,DC=local",
      "CN=Netwrix Auditor Administrators,CN=Users,DC=dnstest2,DC=local",
      "CN=Group Policy Creator Owners,CN=Users,DC=dnstest2,DC=local",
      "CN=Domain Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Enterprise Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Schema Admins,CN=Users,DC=dnstest2,DC=local",
      "CN=Remote Desktop Users,CN=Builtin,DC=dnstest2,DC=local",
      "CN=Administrators,CN=Builtin,DC=dnstest2,DC=local"
    ],
    "MNSLogonAccount": false,
    "mobile": "923456789",
    "MobilePhone": "823456789",
    "Modified": "\\/Date(1631277960000)\\/",
    "modifyTimeStamp": "\\/Date(1631277960000)\\/",
    "msDS-SupportedEncryptionTypes": 0,
    "msDS-User-Account-Control-Computed": 0,
    "nTSecurityDescriptor": {
      "AccessRightType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Enum",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryRights",
        "FullName": "System.DirectoryServices.ActiveDirectoryRights",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryRights, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "f65acb9b-4c77-33ff-8523-43e9cc2c5798",
        "IsEnum": true,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryRights",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554438,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "",
        "DeclaredEvents": "",
        "DeclaredFields": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMembers": "Int32 value__ System.DirectoryServices.ActiveDirectoryRights Delete System.DirectoryServices.ActiveDirectoryRights ReadControl System.DirectoryServices.ActiveDirectoryRights WriteDacl System.DirectoryServices.ActiveDirectoryRights WriteOwner System.DirectoryServices.ActiveDirectoryRights Synchronize System.DirectoryServices.ActiveDirectoryRights AccessSystemSecurity System.DirectoryServices.ActiveDirectoryRights GenericRead System.DirectoryServices.ActiveDirectoryRights GenericWrite System.DirectoryServices.ActiveDirectoryRights GenericExecute System.DirectoryServices.ActiveDirectoryRights GenericAll System.DirectoryServices.ActiveDirectoryRights CreateChild System.DirectoryServices.ActiveDirectoryRights DeleteChild System.DirectoryServices.ActiveDirectoryRights ListChildren System.DirectoryServices.ActiveDirectoryRights Self System.DirectoryServices.ActiveDirectoryRights ReadProperty System.DirectoryServices.ActiveDirectoryRights WriteProperty System.DirectoryServices.ActiveDirectoryRights DeleteTree System.DirectoryServices.ActiveDirectoryRights ListObject System.DirectoryServices.ActiveDirectoryRights ExtendedRight",
        "DeclaredMethods": "",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "",
        "ImplementedInterfaces": "System.IComparable System.IFormattable System.IConvertible",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 257,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": false,
        "IsInterface": false,
        "IsValueType": true,
        "IsAbstract": false,
        "IsSealed": true,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": true,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": "[System.FlagsAttribute()]"
      },
      "AccessRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAccessRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAccessRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAccessRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "0db7ea8c-53d9-3d6d-8b09-bb209cf0d0ae",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAccessRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554445,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AccessControlType, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AccessControlType, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AuditRuleType": {
        "Module": "System.DirectoryServices.dll",
        "Assembly": "System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "TypeHandle": "System.RuntimeTypeHandle",
        "DeclaringMethod": null,
        "BaseType": "System.Security.AccessControl.ObjectAuditRule",
        "UnderlyingSystemType": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "FullName": "System.DirectoryServices.ActiveDirectoryAuditRule",
        "AssemblyQualifiedName": "System.DirectoryServices.ActiveDirectoryAuditRule, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
        "Namespace": "System.DirectoryServices",
        "GUID": "4ad0312a-2ed0-3526-97ec-f9c6f310c5e0",
        "IsEnum": false,
        "GenericParameterAttributes": null,
        "IsSecurityCritical": false,
        "IsSecuritySafeCritical": false,
        "IsSecurityTransparent": true,
        "IsGenericTypeDefinition": false,
        "IsGenericParameter": false,
        "GenericParameterPosition": null,
        "IsGenericType": false,
        "IsConstructedGenericType": false,
        "ContainsGenericParameters": false,
        "StructLayoutAttribute": "System.Runtime.InteropServices.StructLayoutAttribute",
        "Name": "ActiveDirectoryAuditRule",
        "MemberType": 32,
        "DeclaringType": null,
        "ReflectedType": null,
        "MetadataToken": 33554453,
        "GenericTypeParameters": "",
        "DeclaredConstructors": "Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid)",
        "DeclaredEvents": "",
        "DeclaredFields": "",
        "DeclaredMembers": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType() Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, System.DirectoryServices.ActiveDirectoryRights, System.Security.AccessControl.AuditFlags, System.Guid, System.DirectoryServices.ActiveDirectorySecurityInheritance, System.Guid) Void .ctor(System.Security.Principal.IdentityReference, Int32, System.Security.AccessControl.AuditFlags, System.Guid, Boolean, System.Security.AccessControl.InheritanceFlags, System.Security.AccessControl.PropagationFlags, System.Guid) System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "DeclaredMethods": "System.DirectoryServices.ActiveDirectoryRights get_ActiveDirectoryRights() System.DirectoryServices.ActiveDirectorySecurityInheritance get_InheritanceType()",
        "DeclaredNestedTypes": "",
        "DeclaredProperties": "System.DirectoryServices.ActiveDirectoryRights ActiveDirectoryRights System.DirectoryServices.ActiveDirectorySecurityInheritance InheritanceType",
        "ImplementedInterfaces": "",
        "TypeInitializer": null,
        "IsNested": false,
        "Attributes": 1048577,
        "IsVisible": true,
        "IsNotPublic": false,
        "IsPublic": true,
        "IsNestedPublic": false,
        "IsNestedPrivate": false,
        "IsNestedFamily": false,
        "IsNestedAssembly": false,
        "IsNestedFamANDAssem": false,
        "IsNestedFamORAssem": false,
        "IsAutoLayout": true,
        "IsLayoutSequential": false,
        "IsExplicitLayout": false,
        "IsClass": true,
        "IsInterface": false,
        "IsValueType": false,
        "IsAbstract": false,
        "IsSealed": false,
        "IsSpecialName": false,
        "IsImport": false,
        "IsSerializable": false,
        "IsAnsiClass": true,
        "IsUnicodeClass": false,
        "IsAutoClass": false,
        "IsArray": false,
        "IsByRef": false,
        "IsPointer": false,
        "IsPrimitive": false,
        "IsCOMObject": false,
        "HasElementType": false,
        "IsContextful": false,
        "IsMarshalByRef": false,
        "GenericTypeArguments": "",
        "CustomAttributes": ""
      },
      "AreAccessRulesProtected": false,
      "AreAuditRulesProtected": false,
      "AreAccessRulesCanonical": true,
      "AreAuditRulesCanonical": true
    },
    "ObjectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=testdhcp2,DC=local",
    "ObjectGUID": "4bde3f8d-8e9e-4ded-9d71-126ba9cd1300",
    "objectSid": {
      "BinaryLength": 28,
      "AccountDomainSid": {
        "BinaryLength": 24,
        "AccountDomainSid": "S-1-2-3",
        "Value": "S-1-2-3"
      },
      "Value": "S-1-2-3-4000m"
    },
    "Office": "db office",
    "OfficePhone": "91-123456789",
    "Organization": null,
    "OtherName": null,
    "pager": "234567890",
    "PasswordExpired": false,
    "PasswordLastSet": "\\/Date(1631174951326)\\/",
    "PasswordNeverExpires": false,
    "PasswordNotRequired": false,
    "physicalDeliveryOfficeName": "db office",
    "POBox": "dummy",
    "PostalCode": "380015",
    "postOfficeBox": [
      "dummy"
    ],
    "PrimaryGroup": "CN=Domain Users,CN=Users,DC=testdhcp2,DC=local",
    "primaryGroupID": 513,
    "PrincipalsAllowedToDelegateToAccount": [],
    "ProfilePath": null,
    "ProtectedFromAccidentalDeletion": false,
    "pwdLastSet": 132756485513268133,
    "sAMAccountType": 805306368,
    "ScriptPath": null,
    "sDRightsEffective": 15,
    "ServicePrincipalNames": [],
    "SIDHistory": [],
    "SmartcardLogonRequired": false,
    "sn": "itadmin",
    "st": "Gujarat",
    "State": "Gujarat",
    "StreetAddress": "1,user street ,dummy,dummy",
    "telephoneNumber": "91-123456789",
    "Title": "it admin",
    "TrustedForDelegation": false,
    "TrustedToAuthForDelegation": false,
    "UseDESKeyOnly": false,
    "userAccountControl": 1049088,
    "userCertificate": [],
    "userParameters": null,
    "uSNChanged": 57594,
    "uSNCreated": 32800,
    "whenChanged": "\\/Date(1631277960000)\\/",
    "whenCreated": "\\/Date(1628229355000)\\/",
    "wWWHomePage": "www.test.com"
  } 
  

Field mapping reference: device log fields to UDM fields

This section describes how the parser maps original log fields to Unified Data Model fields.

Field mapping reference: WINDOWS_AD

The following table lists the log fields of the WINDOWS_AD log type and their corresponding UDM fields.

Need more help? Get answers from Community members and Google SecOps professionals.