Configure the Windows User-ID Agent as a Syslog Listener

1. Deploy the Windows-based User-ID agents if you haven’t already.

   1. Install the Windows-Based User-ID Agent.
   2. Configure the firewall to connect to the User-ID agent.
2. Define custom Syslog Parse profiles to create and delete user mappings.

   Each profile filters syslog messages to identify either login events (to create user mappings) or logout events (to delete mappings), but no single profile can do both.

   1. Review the syslog messages that the syslog sender generates to identify the syntax for login and logout events. This enables you to define the matching patterns when creating Syslog Parse profiles.

      While reviewing syslog messages, also determine whether they include the domain name. If they don’t, and your user mappings require domain names, enter the Default Domain Name when defining the syslog senders that the User-ID agent monitors (later in this procedure).
   2. Open the Windows Start menu and select User-ID Agent.
   3. Select User IdentificationSetup and Edit the Setup.
   4. Select Syslog, Enable Syslog Service, and Add a Syslog Parse profile.
   5. Enter a Profile Name and Description.
   6. Select the Type of parsing to find login and logout events in syslog messages:

      • Regex—Regular expressions.
      • Field—Text strings.

      The following steps describe how to configure these parsing types.
3. (Regex parsing only) Define the regex matching patterns.

   If the syslog message contains a standalone space or tab as a delimiter, use \s for a space and \t for a tab.

   1. Enter the Event Regex for the type of events you want to find:

      • Login events—For the example message, the regex (authentication\ success){1} extracts the first {1} instance of the string authentication success.
      • Logout events—For the example message, the regex (logout\ successful){1} extracts the first {1} instance of the string logout successful.

      The backslash before the space is a standard regex escape character that instructs the regex engine not to treat the space as a special character.
   2. Enter the Username Regex to identify the start of the username.

      In the example message, the regex User:([a-zA-Z0-9\\\._]+) matches the string User:johndoe1 and identifies johndoe1 as the username.
   3. Enter the Address Regex to identify the IP address portion of syslog messages.

      In the example message, the regular expression Source:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) matches the IPv4 address Source:192.168.3.212.

      The following is an example of a completed Syslog Parse profile that uses regex to identify login events:

   4. Click OK twice to save the profile.
4. (Field Identifier parsing only) Define string matching patterns.

   1. Enter an Event String to identify the type of events you want to find.

      • Login events—For the example message, the string authentication success identifies login events.
      • Logout events—For the example message, the string logout successful identifies logout events.
   2. Enter a Username Prefix to identify the start of the username field in syslog messages. The field does not support regex expressions such as \s (for a space) or \t (for a tab).

      In the example messages, User: identifies the start of the username field.
   3. Enter the Username Delimiter that indicates the end of the username field in syslog messages. Use \s to indicate a standalone space (as in the sample message) and \t to indicate a tab.
   4. Enter an Address Prefix to identify the start of the IP address field in syslog messages. The field does not support regex expressions such as \s (for a space) or \t (for a tab).

      In the example messages, Source: identifies the start of the address field.
   5. Enter the Address Delimiter that indicates the end of the IP address field in syslog messages.

      For example, enter \n to indicate the delimiter is a line break.

      The following is an example of a completed Syslog Parse profile that uses string matching to identify login events:

   6. Click OK twice to save the profile.
5. Specify the syslog senders that the User-ID agent monitors.

   Within the total maximum of 100 servers of all types that the User-ID agent can monitor, up to 50 can be syslog senders.

   The User-ID agent discards any syslog messages received from senders that are not on this list.

   1. Select User IdentificationDiscovery and Add an entry to the Servers list.
   2. Enter a Name to identify the sender.
   3. Enter the Server Address of the syslog sender (IP address or FQDN).
   4. Set the Server Type to Syslog Sender.
   5. (Optional) If you want to override the current domain in the username of your syslog message or prepend the domain to the username if your syslog message doesn’t contain a domain, enter a Default Domain Name.
   6. For each syslog format that the sender supports, Add a Syslog Parse profile to the Filter list. Select the Event Type that you configured each profile to identify—login (default) or logout—and then click OK.
   7. Click OK to save the settings.
   8. Commit your changes to the User-ID agent configuration.
6. Verify that the User-ID agent adds and deletes user mappings when users log in and out.

   You can use CLI commands to see additional information about syslog senders, syslog messages, and user mappings.

   1. Log in to a client system for which a monitored syslog sender generates login and logout event messages.
   2. Verify that the User-ID agent mapped the login username to the client IP address:

      1. In the User-ID agent, select Monitoring.
      2. Enter the username or IP address in the filter field, Search, and verify that the list displays the mapping.
   3. Verify that the firewall received the user mapping from the User-ID agent:

      1. Log in to the firewall CLI.
      2. Run the following command:

         > show user ip-user-mapping ip <ip-address>

         If the firewall received the user mapping, the output resembles the following:

         IP address:    192.0.2.1 (vsys1) 
         User:          localdomain\username 
         From:          SYSLOG 

   4. Log out of the client system.
   5. Verify that the User-ID agent removed the user mapping:

      1. In the User-ID agent, select Monitoring.
      2. Enter the username or IP address in the filter field, Search, and verify that the list does not display the mapping.
   6. Verify that the firewall deleted the user mapping:

      1. Access the firewall CLI.
      2. Run the following command:

         > show user ip-user-mapping ip <ip-address>

         If the firewall deleted the user mapping, the output displays:

         No matched record