End-of-Life (EoL)

Configure the Windows User-ID Agent as a Syslog Listener

To configure the Windows-based User-ID agent to create new user mappings based on syslog monitoring, start by defining Syslog Parse profiles. The User-ID agent uses the profiles to find login events in syslog messages. In environments where
syslog senders
(the network services that authenticate users) deliver syslog messages in different formats, configure a profile for each syslog format. Syslog messages must meet certain criteria for a User-ID agent to parse them (see Syslog). This procedure uses examples with the following format:
[Tue Jul 5 13:15:04 2016 CDT] Administrator authentication success User:johndoe1 Source:192.168.3.212
After configuring the Syslog Parse profiles, you specify syslog senders for the User-ID agent to monitor.
The Windows User-ID agent accepts syslogs over TCP and UDP only. However, you must use caution when using UDP to receive syslog messages because it is an unreliable protocol and as such there is no way to verify that a message was sent from a trusted syslog server. Although you can restrict syslog messages to specific source IP addresses, an attacker can still spoof the IP address, potentially allowing the injection of unauthorized syslog messages into the firewall. As a best practice, use TCP instead of UDP. In either case, make sure that the syslog server and client are both on a dedicated, secure VLAN to prevent untrusted hosts from sending syslogs to the User-ID agent.
  1. Define custom Syslog Parse profiles to filter syslog messages for successful login events.
    1. Review the syslog messages that the syslog sender generates to identify the syntax for successful login events. This enables you to define the matching patterns when creating Syslog Parse profiles.
      While reviewing syslog messages, determine whether they include the domain name. If they don’t, and your user mappings require domain names, enter the
      Default Domain Name
      when defining the syslog senders that the User-ID agent monitors (later in this procedure).
    2. Open the Windows
      Start
      menu and select
      User-ID Agent
      .
    3. Select
      User Identification
      Setup
      and
      Edit
      the Setup.
    4. Select
      Syslog
      ,
      Enable Syslog Service
      , and
      Add
      a Syslog Parse profile.
    5. Enter a
      Profile Name
      and
      Description
      .
    6. Select the
      Type
      of parsing to find login events in syslog messages:
      • Regex
        —Regular expressions.
      • Field
        —Text strings.
      The following steps describe how to configure these parsing types.
  2. (Regex parsing only)
    Define the regex matching patterns.
    If the syslog message contains a standalone space or tab as a delimiter, use
    \s
    for a space and
    \t
    for a tab.
    1. Enter the
      Event Regex
      to identify successful login events.
      For the example message, the regex
      (authentication\ success){1}
      extracts the first
      {1}
      instance of the string
      authenticationsuccess
      . The backslash before the space is a standard regex escape character that instructs the regex engine not to treat the space as a special character.
    2. Enter the
      Username Regex
      to identify the start of the username.
      In the example message, the regex
      User:([a-zA-Z0-9\\\._]+)
      matches the string
      User:johndoe1
      and identifies
      johndoe1
      as the username.
      If you want to override the current domain in the username of your syslog message or prepend the domain to the username if your syslog message doesn’t contain a domain, enter a
      Default Domain Name
      when defining the monitored server entry in Step 5.
    3. Enter the
      Address Regex
      to identify the IP address portion of syslog messages.
      In the example message, the regular expression
      Source:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})
      matches the IPv4 address
      Source:192.168.3.212
      .
      The following is an example of a completed Syslog Parse profile that uses regex to identify login events:
      syslog_parse_profile_regex_login_windows.png
    4. Click
      OK
      twice to save the profile.
  3. (Field Identifier parsing only)
    Define string matching patterns.
    1. Enter an
      Event String
      to identify successful login events.
      For the example message, the string
      authentication success
      identifies login events.
    2. Enter a
      Username Prefix
      to identify the start of the username field in syslog messages. The field does not support regex expressions such as \s (for a space) or \t (for a tab).
      In the example messages,
      User:
      identifies the start of the username field.
    3. Enter the
      Username Delimiter
      that indicates the end of the username field in syslog messages. Use
      \s
      to indicate a standalone space (as in the sample message) and
      \t
      to indicate a tab.
    4. Enter an
      Address Prefix
      to identify the start of the IP address field in syslog messages. The field does not support regex expressions such as \s (for a space) or \t (for a tab).
      In the example messages,
      Source:
      identifies the start of the address field.
    5. Enter the
      Address Delimiter
      that indicates the end of the IP address field in syslog messages.
      For example, enter
      \n
      to indicate the delimiter is a line break.
      The following is an example of a completed Syslog Parse profile that uses string matching to identify login events:
      syslog_parse_profile_field_login_windows.png
    6. Click
      OK
      twice to save the profile.
  4. Specify the syslog senders that the User-ID agent monitors.
    Within the total maximum of 100 servers of all types that the User-ID agent can monitor, up to 50 can be syslog senders.
    The User-ID agent discards any syslog messages received from senders that are not on this list.
    1. Select
      User Identification
      Discovery
      and
      Add
      an entry to the Servers list.
    2. Enter a
      Name
      to identify the sender.
    3. Enter the
      Server Address
      of the syslog sender (IP address or FQDN).
    4. Set the
      Server Type
      to
      Syslog Sender
      .
    5. (Optional)
      If the syslog messages don’t contain domain information and your user mappings require domain names, enter a
      Default Domain Name
      to append to the mappings.
    6. Select the Syslog Parse profile you configured as a
      Filter
      .
    7. Click
      OK
      to save the settings.
    8. Commit
      your changes to the User-ID agent configuration.
  5. Verify the configuration by logging in to the firewall CLI and running the following commands:
    To see the status of a particular syslog sender:
    admin@PA-5050>
    show user server-monitor state Syslog2
            UDP Syslog Listener Service is enabled SSL Syslog Listener Service is enabled Proxy: Syslog2(vsys: vsys1) Host: Syslog2(10.5.204.41) number of log messages : 1000 number of auth. success messages : 1000 number of active connections : 0 total connections made : 4
    To see how many log messages came in from syslog senders and how many entries were successfully mapped:
    admin@PA-5050>
    show user server-monitor statistics
    Directory Servers: Name TYPE Host Vsys Status ----------------------------------------------------------------------------- AD AD 10.2.204.43 vsys1 Connected Syslog Servers: Name Connection Host Vsys Status ----------------------------------------------------------------------------- Syslog1 UDP 10.5.204.40 vsys1 N/A Syslog2 SSL 10.5.204.41 vsys1 Not connected
    To see how many user mappings were discovered through syslog senders:
    admin@PA-5050>
    show user ip-user-mapping all type SYSLOG
    IP Vsys From User IdleTimeout(s) MaxTimeout(s) --------------- ------ ------- -------------------------------- -------------- - 192.168.3.8 vsys1 SYSLOG acme\jreddick                    2476 2476 192.168.5.39 vsys1 SYSLOG acme\jdonaldson                  2480 2480 192.168.2.147 vsys1 SYSLOG acme\ccrisp                      2476 2476 192.168.2.175 vsys1 SYSLOG acme\jjaso                       2476 2476 192.168.4.196 vsys1 SYSLOG acme\jblevins                    2480 2480 192.168.4.103 vsys1 SYSLOG acme\bmoss                       2480 2480 192.168.2.193 vsys1 SYSLOG acme\esogard                     2476 2476 192.168.2.119 vsys1 SYSLOG acme\acallaspo                   2476 2476 192.168.3.176 vsys1 SYSLOG acme\jlowrie                     2478 2478 Total: 9 users

Recommended For You