Microsoft Windows AD データを収集する

以下でサポートされています。

Google SecOpsSIEM

このドキュメントには、次の情報が含まれています。

• デプロイ アーキテクチャとインストール手順、さらに Microsoft Windows Active Directory イベントに対して Google Security Operations パーサーがサポートするログを生成するために必要な構成。Google Security Operations へのデータ取り込みの概要については、Google Security Operations へのデータの取り込みをご覧ください。
• パーサーが元のログのフィールドを Google Security Operations Unified Data Model フィールドにマッピングする方法に関する情報。

デプロイ アーキテクチャに基づいて、Microsoft Windows Active Directory ログを Google Security Operations に取り込むように BindPlane エージェントまたは NXLog エージェントを構成します。BindPlane エージェントを使用して、Windows Active Directory のログを Google Security Operations に転送することをおすすめします。

このドキュメントの情報は、WINDOWS_AD 取り込みラベルを持つパーサーに適用されます。 取り込みラベルは、未加工のログデータを構造化 UDM 形式に正規化するパーサーを識別します。

始める前に

BindPlane エージェントまたは NXLog エージェントを構成する前に、次のタスクを完了します。

• UTC タイムゾーンを使用するようにすべてのシステムを構成します。
• Microsoft Windows AD サーバーを構成します。
• サポートされているデバイスとバージョンを確認します。
• サポートされているログタイプを確認します。

Microsoft Windows AD サーバーを構成する

1. 各 Microsoft Windows Active Directory サーバーで、ログデータを出力ファイルに保存する PowerShell スクリプトを作成して構成します。BindPlane エージェントまたは NXLog が出力ファイルを読み取ります。

   # Set the location where the log file will be written
   $OUTPUT_FILENAME="<Path_of_the_output_file>"
   
   If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}
   
   # USER_CONTEXT: Gets all Active Directory users and their properties.
   Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   
   # ASSET_CONTEXT: Gets all Active Directory assets and their properties.
   Get-ADComputer -Filter * -properties samAccountName | % { Get-ADComputer $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   

2. 次のように置き換えます。

   • $OUTPUT_FILENAME の値は、出力ファイルの場所に置き換えます。
   • データを JSON 形式で保存します。
   • エンコードを UTF-8 に設定します。
   • Get-ADUser コマンドレットと Get-ADComputer コマンドレットを呼び出すときは、-LDAPFilter パラメータではなく、-Filter パラメータを使用します。

3. スクリプトを実行してデータを取得し、出力ファイルに書き込む繰り返しタスクを作成します。

   1. タスク スケジューラ アプリケーションを開きます。
   2. [タスクを作成] をクリックします。
   3. カタログの名前と説明を入力します。
   4. すべてのデータが取得されるように、[最上位の特権で実行する] チェックボックスをオンにします。
   5. [トリガー] タブで、タスクを繰り返すタイミングを定義します。
   6. [アクション] タブで、新しいアクションを追加し、スクリプトを保存するファイルのパスを指定します。

サポートされているデバイスとバージョンを確認する

Microsoft Windows Server は、Foundation、Essentials、Standard、Datacenter でリリースされています。各エディションによって生成されたログのイベント スキーマに違いはありません。

Google Security Operations パーサーは、次の Microsoft Windows サーバー バージョンのログをサポートしています。

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012

Google Security Operations パーサーは、NXLog Community Edition または Enterprise Edition によって収集されたログをサポートします。

サポートされているログタイプを確認する

Google Security Operations パーサーは、ユーザー コンテキストとアセット コンテキストから取得したデータを解析して正規化します。英語のテキストで生成されたログはサポートされますが、英語以外の言語で生成されたログはサポートされません。

BindPlane エージェントを構成する

BindPlane エージェントを使用して、Windows Active Directory のログを Google Security Operations に転送することをおすすめします。

インストール後、BindPlane エージェント サービスは Windows サービスのリストに observIQ サービスとして表示されます。

1. 各 Windows Active Directory サーバーに BindPlane エージェントをインストールします。BindPlane エージェントのインストールの詳細については、BindPlane Agent のインストール手順をご覧ください。

2. 次の内容で BindPlane エージェントの構成ファイルを作成します。

   receivers:
     filelog:
       include: [ `FILE_PATH` ]
       operators:
         - type: json_parser
       start_at: beginning
     windowseventlog/activedirectoryservice:
       channel: Directory Service
       raw: true
   processors:
     batch:
   
   exporters:
     chronicle/activedirectory:
       endpoint: https://malachiteingestion-pa.googleapis.com
       creds: '{
       "type": "service_account",
       "project_id": "malachite-projectname",
       "private_key_id": `PRIVATE_KEY_ID`,
       "private_key": `PRIVATE_KEY`,
       "client_email":"`SERVICE_ACCOUNT_NAME`@malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "client_id": `CLIENT_ID`,
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/`SERVICSERVICE_ACCOUNT_NAME`%40malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "universe_domain": "googleapis.com"
       }'
     log_type: 'WINDOWS_AD'
     override_log_type: false
     raw_log_field: body
     customer_id: `CUSTOMER_ID`
   
   service:
     pipelines:
       logs/ads:
         receivers:
           - filelog
           - windowseventlog/activedirectoryservice
         processors: [batch]
         exporters: [chronicle/activedirectory]
   

3. 次のように置き換えます。

   • FILE_PATH は、Microsoft Windows AD サーバーを構成するで説明されている PowerShell スクリプトの出力が保存されているファイルのパスに置き換えます。

   • PRIVATE_KEY_ID、PRIVATE_KEY、SERVICSERVICE_ACCOUNT_NAME、PROJECT_ID、CLIENT_ID、CUSTOMER_ID は、 Google Cloudからダウンロードできるサービス アカウントの JSON ファイルのそれぞれの値に置き換えます。サービス アカウントキーの詳細については、サービス アカウントキーの作成と削除をご覧ください。

4. observerIQ エージェント サービスを開始するには、サービス > 拡張 > observerIQ サービス > 開始 の順に選択します。

NXLog を構成する

次の図は、NXLog エージェントをインストールして Microsoft Windows イベントを収集し、Google Security Operations に送信するアーキテクチャを示しています。この情報とお客様の環境を比較して、これらのコンポーネントがインストールされていることを確認してください。デプロイは、このアーキテクチャとは異なる場合があり、より複雑になる場合があります。

BindPlane エージェントではなく NXLog エージェントを使用している場合は、次の点を確認します。

• Active Directory を実行する各 Microsoft Windows Server に PowerShell スクリプトが作成され、構成されて、USER_CONTEXT データと ASSET_CONTEXT データが収集されます。詳細については、Microsoft Windows AD サーバーを構成するをご覧ください。
• NXLog は、各 Microsoft Windows AD サーバーにインストールされ、中央の Microsoft Windows サーバーまたは Linux サーバーにデータを送信します。
• Google Security Operations フォワーダーは、中央の Microsoft Windows サーバーまたは Linux サーバーにインストールされ、ログデータを Google Security Operations に転送します。

NXLog を構成する

1. Windows Active Directory サーバーで実行される各コレクタに NXLog エージェントをインストールします。このアプリケーションは、ログを中央の Microsoft Windows または Linux サーバーに転送します。詳細については、NXLog のドキュメントをご覧ください。

2. NXLog インスタンスごとに構成ファイルを作成します。NXLog im_file モジュールを使用して、ファイルから読み取り、行をフィールドにパースします。om_tcp を使用して、データを中央の Microsoft Windows または Linux サーバーに転送します。

   NXLog 構成の例を次に示します。<hostname> と <port> の値は、転送先の中央の Microsoft Windows または Linux サーバーに関する情報に置き換えます。 <Input in_adcontext> セクションと File プロパティに、PowerShell スクリプトによって書き込まれた出力ログファイルのパスを追加します。常に DirCheckInterval と PollInterval を設定します。これらが定義されていない場合、NXLog は 1 秒ごとにファイルをポーリングします。

   define ROOT C:\Program Files\nxlog
   define ADCONTEXT_OUTPUT_DESTINATION_ADDRESS <hostname>
   define ADCONTEXT_OUTPUT_DESTINATION_PORT <port>
   
   Moduledir   %ROOT%\modules
   CacheDir    %ROOT%\data
   Pidfile     %ROOT%\data\nxlog.pid
   SpoolDir    %ROOT%\data
   LogFile     %ROOT%\data\nxlog.log
   
   <Input in_adcontext>
       Module im_file
       File "<Path_of_the_output_file>"
       DirCheckInterval 3600
       PollInterval 3600
   </Input>
   
   <Output out_chronicle_adcontext>
       Module  om_tcp
       Host    %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS%
       Port    %ADCONTEXT_OUTPUT_DESTINATION_PORT%
   </Output>
   
   <Route ad_context_to_chronicle>
       Path in_adcontext => out_chronicle_adcontext
   </Route>
   

3. 各システムで NXLog サービスを起動します。

中央サーバーでフォワーダーを構成する

Linux でのフォワーダーのインストールと構成については、Linux でのフォワーダーのインストールと構成をご覧ください。Microsoft Windows でのフォワーダーのインストールと構成については、Microsoft Windows でのフォワーダーのインストールと構成をご覧ください。

1. UTC タイムゾーンでシステムを構成します。
2. 中央の Microsoft Windows または Linux サーバーに Google Security Operations フォワーダーをインストールします。

3. Google Security Operations にログを送信するように Google Security Operations フォワーダーを構成します。フォワーダー構成の例を次に示します。

     - syslog:
         common:
           enabled: true
           data_type: WINDOWS_AD
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

フィールド マッピング リファレンス: デバイスログ フィールドから UDM フィールド

このセクションでは、パーサーが元のログフィールドを Unified Data Model フィールドにマッピングする方法について説明します。

注: % 値（%1、%2、%3、%{EventID} など）は変数のプレースホルダです。

フィールド マッピング リファレンス: WINDOWS_AD

次の表に、WINDOWS_AD ログタイプのログ フィールドと、対応する UDM フィールドを示します。

Log field	UDM mapping	Logic
	metadata.entity_type	If the ObjectClass log field value is equal to user or is empty, then the metadata.entity_type UDM field is set to USER. Else, if the ObjectClass log field value is equal to computer, then the metadata.entity_type UDM field is set to ASSET.
ObjectGuid	entity.user.product_object_id	If the ObjectClass log field value is equal to user or is empty, then if the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.user.product_object_id UDM field. Else, if the ObjectClass log field value is equal to computer, then if the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.asset.product_object_id UDM field.
whenCreated	metadata.creation_timestamp	If the ObjectClass log field value is equal to user or is empty, then if the whenCreated log field value is not empty, then when_created is extracted from the whenCreated log field using a Grok pattern, and mapped to the entity.asset.attribute.creation_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the whenCreated log field value is not empty, then when_created is extracted from the whenCreated log field using a Grok pattern, and mapped to the metadata.creation_timestamp UDM field. Else, timestamp tz_left tz_right is extracted from the whenCreated log field using a Grok pattern, and mapped to the entity.asset.attribute.creation_time UDM field.
DisplayName	entity.user.user_display_name	If the ObjectClass log field value is equal to user or is empty, then if the DisplayName log field value is not empty, then the DisplayName log field is mapped to the entity.user.user_display_name UDM field.
GivenName	entity.user.first_name	If the ObjectClass log field value is equal to user or is empty, then if the GivenName log field value is not empty, then the GivenName log field is mapped to the entity.user.first_name UDM field.
SamAccountName	entity.user.userid	If the ObjectClass log field value is equal to user or is empty, then if the SamAccountName log field value is not empty, then the SamAccountName log field is mapped to the entity.user.userid UDM field. If the ObjectClass log field value is equal to computer, then the SamAccountName log field is mapped to the entity.asset.asset_id UDM field.
EmployeeID	entity.user.employee_id	If the EmployeeID log field value is not empty, then the EmployeeID log field is mapped to the entity.user.employee_id UDM field. Else the employeeID.0 log field is mapped to the entity.user.employee_id UDM field.
Title	entity.user.title	If the Title log field value is not empty, then the Title log field is mapped to the entity.user.title UDM field.
Surname	entity.user.last_name	If the ObjectClass log field value is equal to user or is empty, then if the Surname log field value is not empty, then if the sn log field is mapped to the entity.user.last_name UDM field. Else ifSurname log field value is not empty, then the Surname log field is mapped to the entity.user.last_name UDM field.
Company	entity.user.company_name	If the ObjectClass log field value is equal to user or is empty, then if the Company log field value is not empty, then the Company log field is mapped to the entity.user.company_name UDM field.
City	entity.user.personal_address.city	If the ObjectClass log field value is equal to user or is empty, then if the City log field value is not empty, then the City log field is mapped to the entity.user.personal_address.city UDM field.
Department	entity.user.department	If the ObjectClass log field value is equal to user or is empty, then if the Department log field value is not empty, then the Department log field is mapped to the entity.user.department UDM field.
	entity.user.email_addresses	If the ObjectClass log field value is equal to user or is empty, then if the EmailAddress log field value is not empty, then the EmailAddress log field is mapped to the entity.user.email_addresses UDM field. Else, if the mail log field value is not empty, then the mail log field is mapped to the entity.user.email_addresses UDM field.
HomePhone	entity.user.phone_numbers	If the ObjectClass log field value is equal to user or is empty, then if the HomePhone log field value is not empty, then the HomePhone log field is mapped to the entity.user.phone_numbers UDM field. Else if the telephoneNumber log field value is not empty, then the telephoneNumber log field is mapped to the entity.user.phone_numbers UDM field. If the ObjectClass log field value is equal to user or is empty, then if the MobilePhone log field value is not empty, then the MobilePhone log field is mapped to the entity.user.phone_numbers UDM field.
StreetAddress	entity.user.personal_address.name	If the ObjectClass log field value is equal to user or is empty, then if the StreetAddress log field value is not empty, then the StreetAddress log field is mapped to the entity.user.personal_address.name UDM field.
State	entity.user.personal_address.state	If the ObjectClass log field value is equal to user or is empty, then if the State log field value is not empty, then the State log field is mapped to the entity.user.personal_address.state UDM field.
Country	entity.user.personal_address.country_or_region	If the ObjectClass log field value is equal to user or is empty, then if the Country log field value is not empty, then the Country log field is mapped to the entity.user.personal_address.country_or_region UDM field.
Office	entity.user.office_address.name	If the ObjectClass log field value is equal to user or is empty, then if the Office log field value is not empty, then the Office log field is mapped to the entity.user.office_address.name UDM field.
HomeDirectory	entity.file.full_path	If the ObjectClass log field value is equal to user or is empty, then if the HomeDirectory log field value is not empty, then the HomeDirectory log field is mapped to the entity.file.full_path UDM field.
	entity.user.managers.user_display_name	If the ObjectClass log field value is equal to user or is empty, then if the Manager log field value is not empty, then manager_name is extracted from the Manager log field using a Grok pattern, and mapped to the entity.user.managers.user_display_name UDM field.
	entity.user.windows_sid	If the SID.Value log field value is not empty, then the SID.Value field is mapped to the entity.user.windows_sid UDM field. Else, if the objectSid log field value is not empty, then the objectSid field is mapped to the entity.user.windows_sid UDM field. If the ObjectClass log field value is equal to user or is empty, then if the Manager log field value is not empty, then if Manager matches the regular expression pattern (S-\d-(\d+-){1,14}\d+), then the Manager log field is mapped to the entity.user.managers.windows_sid UDM field. Else, the Manager log field is mapped to the entity.user.managers.userid UDM field.
	relations.relationship	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, the relations.relationship UDM field is set to MEMBER. Else, if the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then the relations.relationship UDM field is set to ADMINISTERS. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern, if the group_name extracted field value is not empty, then the relations.relationship UDM field is set to MEMBER.
	relations.entity.group.group_display_name	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, group_name is extracted from the index using a Grok pattern and mapped to the relations.entity.group.group_display_name UDM field. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern and mapped to the relations.entity.group.group_display_name UDM field.
	relations.entity_type	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, the relations.entity_type UDM field is set to GROUP. Else, if the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then the relations.entity_type UDM field is set to ASSET. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern, if the group_name extracted field value is not empty, then the relations.entity_type UDM field is set to GROUP.
	relations.direction	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, the relations.direction UDM field is set to UNIDIRECTIONAL. Else, if the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then the relations.direction UDM field is set to UNIDIRECTIONAL. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern, if the group_name extracted field value is not empty, then the relations.direction UDM field is set to UNIDIRECTIONAL.
	relations.entity.user.user_display_name	If the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then user_name is extracted from the ManagedBy log field using a Grok pattern and mapped to the relations.entity.user.user_display_name UDM field.
proxyAddresses	entity.user.group_identifiers	If the ObjectClass log field value is equal to user or is empty, then for index in proxyAddresses the index is mapped to entity.user.group_identifiers UDM field.
	entity.user.attribute.labels[Bad Password Count]	If the ObjectClass log field value is equal to user or is empty, then if the badPwdCount log field value is not empty, then the entity.user.attribute.labels.key UDM field is set to Bad Password Count and the badPwdCount log field is mapped to the entity.user.attribute.labels.value UDM field.
LastBadPasswordAttempt	entity.user.last_bad_password_attempt_time	If the ObjectClass log field value is equal to user or is empty, then if the LastBadPasswordAttempt log field value is not empty, then last_bad_password_attempt is extracted from the LastBadPasswordAttempt log field using a Grok pattern and mapped to the entity.user.last_bad_password_attempt_time UDM field. Else, if the ObjectClass log field value is equal to computer, then last_bad_password_attempt is extracted from the LastBadPasswordAttempt log field using a Grok pattern and mapped to the entity.user.last_bad_password_attempt_time UDM field.
AccountExpirationDate	entity.user.account_expiration_time	If the ObjectClass log field value is equal to user or is empty, then if the AccountExpirationDate log field value is not empty, then account_expiration_date is extracted from the AccountExpirationDate log field using a Grok pattern and mapped to the entity.user.account_expiration_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the AccountExpirationDate log field value is not empty, then account_expiration_date is extracted from the AccountExpirationDate log field using a Grok pattern and mapped to the entity.user.account_expiration_time UDM field.
PasswordLastSet	entity.user.last_password_change_time	If the ObjectClass log field value is equal to user or is empty, then if the PasswordLastSet log field value is not empty, then password_last_set is extracted from the PasswordLastSet log field using a Grok pattern and mapped to the entity.user.last_password_change_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the PasswordLastSet log field value is not empty, then password_last_set is extracted from the PasswordLastSet log field using a Grok pattern and mapped to the entity.user.last_password_change_time UDM field.
PasswordNotRequired	entity.user.attribute.labels[Password Not Required]	If the ObjectClass log field value is equal to user or is empty, then if the PasswordNotRequired log field value is not empty, then the PasswordNotRequired log field is mapped to the entity.user.attribute.labels.value UDM field. If the ObjectClass log field value is equal to computer, then if the PasswordNotRequired log field value is not empty, then the PasswordNotRequired log field is mapped to the entity.asset.attribute.labels.value UDM field.
ServicePrincipalNames	entity.user.attribute.labels[Service Principal Names]	If the ObjectClass log field value is equal to user or is empty, then if ServicePrincipalNames log field value is not empty, then for index in ServicePrincipalNames the index is mapped to the entity.user.attribute.labels.value UDM field. Else, if the ObjectClass log field value is equal to computer, then if ServicePrincipalNames log field value is not empty, then for index in ServicePrincipalNames, if index is equal to 0, then the index is mapped to the entity.user.attribute.labels.value UDM field.
AccountLockoutTime	entity.user.account_lockout_time	If the ObjectClass log field value is equal to user or is empty, then if the AccountLockoutTime log field value is not empty, then account_lockout_time is extracted from the AccountLockoutTime log field using a Grok pattern and mapped to the entity.user.account_lockout_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the AccountLockoutTime log field value is not empty, then account_lockout_time is extracted from the AccountLockoutTime log field using a Grok pattern and mapped to the entity.user.account_lockout_time UDM field.
whenChanged	entity.asset.attribute.last_update_time	If the ObjectClass log field value is equal to computer, then when_changed is extracted from the whenChanged log field using a Grok pattern, if whenChanged is not empty, then when_changed is mapped to the entity.asset.attribute.last_update_time UDM field. Else, timestamp and timezone is extracted from whenChanged log field using a Grok pattern and tz_left and tz_right is extracted from the timezone using a Grok pattern and timestamp tz_left tz_right is mapped to entity.asset.attribute.creation_time UDM field.
DNSHostName	entity.asset.hostname	If the ObjectClass log field value is equal to computer, then if the DNSHostName log field value is not empty, then the DNSHostName log field is mapped to the entity.asset.hostname UDM field.
countryCode	entity.asset.location.country_or_region	If the ObjectClass log field value is equal to computer, then if the countryCode log field value is not empty, then the countryCode log field is mapped to the entity.asset.location.country_or_region UDM field.
	entity.asset.platform_software.platform	If the ObjectClass log field value is equal to computer, then if the OperatingSystem log field value is not empty, then if the OperatingSystem log field value matches the regular expression pattern (?i)windows, then the entity.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the OperatingSystem log field value matches the regular expression pattern (?i)mac or the OperatingSystem log field value matches the regular expression pattern (?i)osx, then the entity.asset.platform_software.platform UDM field is set to MAC. Else, if the OperatingSystem log field value matches the regular expression pattern (?i)linux, then the entity.asset.platform_software.platform UDM field is set to LINUX.
OperatingSystemVersion	entity.asset.platform_software.platform_version	If the ObjectClass log field value is equal to computer, then if the OperatingSystem log field value is not empty, then if the OperatingSystemVersion log field value is not empty, then OperatingSystem - OperatingSystemVersion is mapped to the entity.asset.platform_software.platform_version UDM field. Else if the OperatingSystemVersion log field value is not empty, then the OperatingSystemVersion log field is mapped to the entity.asset.platform_software.platform_version UDM field.
OperatingSystemServicePack	entity.asset.platform_software.platform_patch_level	If the ObjectClass log field value is equal to computer, then if the OperatingSystemServicePack log field value is not empty, then the OperatingSystemServicePack log field is mapped to the entity.asset.platform_software.platform_patch_level UDM field.
IPv4Address	entity.asset.ip	If the ObjectClass log field value is equal to computer, then if the IPv4Address log field value is not empty, then the IPv4Address log field is mapped to the entity.asset.ip UDM field.
IPv6Address	entity.asset.ip	If the ObjectClass log field value is equal to computer, then if the IPv6Address log field value is not empty, then the IPv6Address log field is mapped to the entity.asset.ip UDM field.
Location	entity.asset.location.name	If the ObjectClass log field value is equal to computer, then if the Location log field value is not empty, then the Location log field is mapped to the entity.asset.location.name UDM field.
ObjectCategory	entity.asset.category	If the ObjectClass log field value is equal to computer, then if the ObjectCategory log field value is not empty, then object_category is extracted from the ObjectCategory log field using a Grok pattern, and mapped to the entity.asset.category UDM field.
PasswordExpired	entity.asset.attribute.labels[Password Expired]	If the ObjectClass log field value is equal to computer, then if the PasswordExpired log field value is not empty, then the PasswordExpired log field is mapped to the entity.asset.attribute.labels.value UDM field. If the ObjectClass log field value is equal to user or is empty, then if the PasswordExpired log field value is not empty, then the PasswordExpired log field is mapped to the entity.user.attribute.labels.value UDM field.
PasswordNeverExpires	entity.asset.attribute.labels[Password Never Expires]	If the ObjectClass log field value is equal to computer, then if the PasswordNeverExpires log field value is not empty, then the PasswordNeverExpires log field is mapped to the entity.asset.attribute.labels.value UDM field. If the ObjectClass log field value is equal to user or is empty, then if the PasswordNeverExpires log field value is not empty, then the PasswordNeverExpires log field is mapped to the entity.user.attribute.labels.value UDM field.
	entity.user.attribute.labels[Last Logon]	If the ObjectClass log field value is equal to user or is empty, then if the lastLogon log field value is not equal to 0, then the entity.user.attribute.labels.key UDM field is set to Last Logon and the lastLogon log field is mapped to the entity.user.attribute.labels.value UDM field. If the ObjectClass log field value is equal to computer, then if the lastLogon log field value is not equal to 0, then the entity.asset.attribute.labels.key UDM field is set to Last Logon and the lastLogon log field is mapped to the entity.asset.attribute.labels.value UDM field.
lastLogoff	entity.asset.attribute.labels[Last Logoff]	If the ObjectClass log field value is equal to computer, then if the lastLogoff log field value does not contain one of the following values, then the lastLogoff log field is mapped to the entity.asset.attribute.labels.value UDM field. "0" 0 .
LastLogonDate	entity.user.last_login_time	If the ObjectClass log field value is equal to user or is empty, then if the LastLogonDate log field value is not empty, then last_logon_date is extracted from the LastLogonDate log field using a Grok pattern, and mapped to the entity.user.last_login_time UDM field. Else if the ObjectClass log field value is equal to computer,then if the LastLogonDate log field value is not empty, then last_logon_date is extracted from the LastLogonDate log field using a Grok pattern, and mapped to the entity.user.last_login_time UDM field.
HomePage	entity.url	If the HomePage log field value is not empty, then the HomePage log field is mapped to the entity.url UDM field.
	entity.administrative_domain	If the CanonicalName log field value is not empty, then domain_name is extracted from the CanonicalName log field using a Grok pattern, and mapped to the entity.administrative_domain UDM field.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Microsoft.
	metadata.product_name	The metadata.product_name UDM field is set to Windows Active Directory.
Description	metadata.description	The Description log field is mapped to the metadata.description UDM field.