收集 Microsoft Windows AD 数据

支持的平台：

Google SecOps SIEM

此文档包含以下信息：

• 部署架构和安装步骤，以及生成 Microsoft Windows Active Directory 事件的 Google Security Operations 解析器支持的日志所需的任何配置。如需简要了解 Google Security Operations 数据提取，请参阅将数据提取到 Google Security Operations。
• 有关解析器如何将原始日志中的字段映射到 Google Security Operations Unified Data Model 字段的信息。

根据您的部署架构，配置 Bindplane 代理或 NXLog 代理，以将 Microsoft Windows Active Directory 日志提取到 Google 安全运营中心。我们建议您使用 Bindplane Agent 将 Windows Active Directory 的日志转发到 Google 安全运营中心。

本文档中的信息适用于具有 WINDOWS_AD 注入标签的解析器。注入标签标识哪个解析器将原始日志数据标准化为结构化 UDM 格式。

准备工作

在配置 Bindplane 代理或 NXLog 代理之前，请完成以下任务：

• 将所有系统配置为使用世界协调时间 (UTC) 时区。
• 配置 Microsoft Windows AD 服务器。
• 查看支持的设备和版本。
• 查看支持的日志类型。

配置 Microsoft Windows AD 服务器

1. 在每个 Microsoft Windows Active Directory 服务器上，创建并配置 PowerShell 脚本以将日志数据保存到输出文件。Bindplane Agent 或 NXLog Agent 会读取输出文件。

   # Set the location where the log file will be written
   $OUTPUT_FILENAME="<Path_of_the_output_file>"
   
   If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}
   
   # USER_CONTEXT: Gets all Active Directory users and their properties.
   Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   
   # ASSET_CONTEXT: Gets all Active Directory assets and their properties.
   Get-ADComputer -Filter * -properties samAccountName | % { Get-ADComputer $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }
   

2. 请替换以下内容：

   • 将 $OUTPUT_FILENAME 的值替换为输出文件的位置。
   • 以 JSON 格式存储数据。
   • 将编码设置为 UTF-8。
   • 调用 Get-ADUser 和 Get-ADComputer cmdlet 时，请使用 -Filter 参数，而不是 -LDAPFilter 参数。

3. 创建运行脚本的周期性任务，以将数据提取并写入到输出文件。

   1. 打开“任务计划程序”应用。
   2. 点击创建任务。
   3. 输入任务的名称和说明。
   4. 选中Run with highest privileges（以最高权限运行）复选框，以确保检索所有数据。
   5. 在触发器标签页中，定义何时希望重复执行该任务。
   6. 在操作标签页中，添加新操作，并提供存储该脚本的文件的路径。

查看支持的设备和版本

Microsoft Windows Server 按以下版本发布：Foundation、Essentials、Standard 和 Datacenter。每个版本生成的日志事件架构没有区别。

Google 安全运营解析器支持来自以下 Microsoft Windows 服务器版本的日志：

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012

Google Security Operations 解析器支持 NXLog Community Edition 或 Enterprise Edition 收集的日志。

查看支持的日志类型

Google 安全运营解析器将解析从用户上下文和资源上下文中检索的数据并对其进行标准化。它支持使用英语文本生成的日志，不支持使用非英语生成的日志。

配置 Bindplane 代理

我们建议您使用 Bindplane 代理将 Windows Active Directory 的日志转发到 Google 安全运营中心。

安装后，Bindplane 代理服务会在 Windows 服务列表中显示为 observIQ 服务。

1. 在每台 Windows Active Directory 服务器上安装 Bindplane 代理。如需详细了解如何安装 Bindplane 代理，请参阅 Bindplane 代理安装说明。

2. 为 Bindplane 代理创建一个配置文件，其中包含以下内容：

   receivers:
     filelog:
       include: [ `FILE_PATH` ]
       operators:
         - type: json_parser
       start_at: beginning
     windowseventlog/activedirectoryservice:
       channel: Directory Service
       raw: true
   processors:
     batch:
   
   exporters:
     chronicle/activedirectory:
       endpoint: https://malachiteingestion-pa.googleapis.com
       creds: '{
       "type": "service_account",
       "project_id": "malachite-projectname",
       "private_key_id": `PRIVATE_KEY_ID`,
       "private_key": `PRIVATE_KEY`,
       "client_email":"`SERVICE_ACCOUNT_NAME`@malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "client_id": `CLIENT_ID`,
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/`SERVICSERVICE_ACCOUNT_NAME`%40malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "universe_domain": "googleapis.com"
       }'
     log_type: 'WINDOWS_AD'
     override_log_type: false
     raw_log_field: body
     customer_id: `CUSTOMER_ID`
   
   service:
     pipelines:
       logs/ads:
         receivers:
           - filelog
           - windowseventlog/activedirectoryservice
         processors: [batch]
         exporters: [chronicle/activedirectory]
   

3. 请替换以下内容：

   • FILE_PATH，其中包含存储配置 Microsoft Windows AD 服务器中所述 PowerShell 脚本输出的文件的路径。

   • PRIVATE_KEY_ID、PRIVATE_KEY、SERVICSERVICE_ACCOUNT_NAME、PROJECT_ID、CLIENT_ID 和 CUSTOMER_ID 的值，这些值来自您可以从 Google Cloud下载的服务账号 JSON 文件。如需详细了解服务账号密钥，请参阅创建和删除服务账号密钥。

4. 如需启动 Bindplane（以前称为 observIQ）代理服务，请依次选择 Services > Extended > observIQ Service > Start。

配置 NXLog Agent

下图展示了一个架构，其中安装了 NXLog Agent 来收集 Microsoft Windows 事件并将其发送到 Google 安全运营团队。将此信息与您的环境进行比较，以确保已安装这些组件。您的部署可能与此架构不同，并且可能更复杂。

如果您使用的是 NXLog 代理而非 Bindplane 代理，请验证以下内容：

• 在每个运行 Active Directory 的 Microsoft Windows Server 上创建并配置 PowerShell 脚本，以收集 USER_CONTEXT 和 ASSET_CONTEXT 数据。如需了解详情，请参阅配置 Microsoft Windows AD 服务器。
• 每个 Microsoft Windows AD 服务器上安装了 NXLog，用于将数据发送到中央 Microsoft Windows Server 或 Linux 服务器。
• Google Security Operations 转发器安装在中央 Microsoft Windows 服务器或 Linux 服务器上，用于将日志数据转发到 Google Security Operations。

配置 NXLog

1. 在 Windows Active Directory 服务器上运行的每个收集器上安装 NXLog 代理。该应用会将日志转发到中央 Microsoft Windows 或 Linux 服务器。如需了解详情，请参阅 NXLog 文档。

2. 为每个 NXLog 实例创建一个配置文件。使用 NXLog im_file 模块从文件中读取内容并将行解析为字段。使用 om_tcp 将数据转发到中央 Microsoft Windows 或 Linux 服务器。

   以下是 NXLog 配置示例。将 <hostname> 和 <port> 值替换为目标中央 Microsoft Windows 或 Linux 服务器的信息。在 <Input in_adcontext> 部分和 File 属性中，添加由 PowerShell 脚本写入的输出日志文件的路径。始终设置 DirCheckInterval 和 PollInterval。如果未定义，则 NXLog 每 1 秒轮询一次文件。

   define ROOT C:\Program Files\nxlog
   define ADCONTEXT_OUTPUT_DESTINATION_ADDRESS <hostname>
   define ADCONTEXT_OUTPUT_DESTINATION_PORT <port>
   
   Moduledir   %ROOT%\modules
   CacheDir    %ROOT%\data
   Pidfile     %ROOT%\data\nxlog.pid
   SpoolDir    %ROOT%\data
   LogFile     %ROOT%\data\nxlog.log
   
   <Input in_adcontext>
       Module im_file
       File "<Path_of_the_output_file>"
       DirCheckInterval 3600
       PollInterval 3600
   </Input>
   
   <Output out_chronicle_adcontext>
       Module  om_tcp
       Host    %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS%
       Port    %ADCONTEXT_OUTPUT_DESTINATION_PORT%
   </Output>
   
   <Route ad_context_to_chronicle>
       Path in_adcontext => out_chronicle_adcontext
   </Route>
   

3. 在每个系统中启动 NXLog 服务。

在中央服务器上配置转发器

如需了解如何在 Linux 上安装和配置转发器，请参阅在 Linux 上安装和配置转发器。如需了解如何在 Microsoft Windows 上安装和配置转发器，请参阅在 Microsoft Windows 上安装和配置转发器。

1. 使用世界协调时间 (UTC) 时区配置系统。
2. 在中央 Microsoft Windows 或 Linux 服务器上安装 Google 安全运营转发器。

3. 配置 Google Security Operations 转发器，以将日志发送到 Google Security Operations。以下是转发器配置示例：

     - syslog:
         common:
           enabled: true
           data_type: WINDOWS_AD
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

字段映射参考信息：设备日志字段到 UDM 字段

本部分介绍解析器如何将原始日志字段映射到 Unified Data Model 字段。

注意：% 值（例如 %1、%2、%3、%{EventID}）是变量占位符。

字段映射参考：WINDOWS_AD

下表列出了 WINDOWS_AD 日志类型的日志字段及其对应的 UDM 字段。

Log field	UDM mapping	Logic
	metadata.entity_type	If the ObjectClass log field value is equal to user or is empty, then the metadata.entity_type UDM field is set to USER. Else, if the ObjectClass log field value is equal to computer, then the metadata.entity_type UDM field is set to ASSET.
ObjectGuid	entity.user.product_object_id	If the ObjectClass log field value is equal to user or is empty, then if the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.user.product_object_id UDM field. Else, if the ObjectClass log field value is equal to computer, then if the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.asset.product_object_id UDM field.
whenCreated	metadata.creation_timestamp	If the ObjectClass log field value is equal to user or is empty, then if the whenCreated log field value is not empty, then when_created is extracted from the whenCreated log field using a Grok pattern, and mapped to the entity.asset.attribute.creation_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the whenCreated log field value is not empty, then when_created is extracted from the whenCreated log field using a Grok pattern, and mapped to the metadata.creation_timestamp UDM field. Else, timestamp tz_left tz_right is extracted from the whenCreated log field using a Grok pattern, and mapped to the entity.asset.attribute.creation_time UDM field.
DisplayName	entity.user.user_display_name	If the ObjectClass log field value is equal to user or is empty, then if the DisplayName log field value is not empty, then the DisplayName log field is mapped to the entity.user.user_display_name UDM field.
GivenName	entity.user.first_name	If the ObjectClass log field value is equal to user or is empty, then if the GivenName log field value is not empty, then the GivenName log field is mapped to the entity.user.first_name UDM field.
SamAccountName	entity.user.userid	If the ObjectClass log field value is equal to user or is empty, then if the SamAccountName log field value is not empty, then the SamAccountName log field is mapped to the entity.user.userid UDM field. If the ObjectClass log field value is equal to computer, then the SamAccountName log field is mapped to the entity.asset.asset_id UDM field.
EmployeeID	entity.user.employee_id	If the EmployeeID log field value is not empty, then the EmployeeID log field is mapped to the entity.user.employee_id UDM field. Else the employeeID.0 log field is mapped to the entity.user.employee_id UDM field.
Title	entity.user.title	If the Title log field value is not empty, then the Title log field is mapped to the entity.user.title UDM field.
Surname	entity.user.last_name	If the ObjectClass log field value is equal to user or is empty, then if the Surname log field value is not empty, then if the sn log field is mapped to the entity.user.last_name UDM field. Else ifSurname log field value is not empty, then the Surname log field is mapped to the entity.user.last_name UDM field.
Company	entity.user.company_name	If the ObjectClass log field value is equal to user or is empty, then if the Company log field value is not empty, then the Company log field is mapped to the entity.user.company_name UDM field.
City	entity.user.personal_address.city	If the ObjectClass log field value is equal to user or is empty, then if the City log field value is not empty, then the City log field is mapped to the entity.user.personal_address.city UDM field.
Department	entity.user.department	If the ObjectClass log field value is equal to user or is empty, then if the Department log field value is not empty, then the Department log field is mapped to the entity.user.department UDM field.
	entity.user.email_addresses	If the ObjectClass log field value is equal to user or is empty, then if the EmailAddress log field value is not empty, then the EmailAddress log field is mapped to the entity.user.email_addresses UDM field. Else, if the mail log field value is not empty, then the mail log field is mapped to the entity.user.email_addresses UDM field.
HomePhone	entity.user.phone_numbers	If the ObjectClass log field value is equal to user or is empty, then if the HomePhone log field value is not empty, then the HomePhone log field is mapped to the entity.user.phone_numbers UDM field. Else if the telephoneNumber log field value is not empty, then the telephoneNumber log field is mapped to the entity.user.phone_numbers UDM field. If the ObjectClass log field value is equal to user or is empty, then if the MobilePhone log field value is not empty, then the MobilePhone log field is mapped to the entity.user.phone_numbers UDM field.
StreetAddress	entity.user.personal_address.name	If the ObjectClass log field value is equal to user or is empty, then if the StreetAddress log field value is not empty, then the StreetAddress log field is mapped to the entity.user.personal_address.name UDM field.
State	entity.user.personal_address.state	If the ObjectClass log field value is equal to user or is empty, then if the State log field value is not empty, then the State log field is mapped to the entity.user.personal_address.state UDM field.
Country	entity.user.personal_address.country_or_region	If the ObjectClass log field value is equal to user or is empty, then if the Country log field value is not empty, then the Country log field is mapped to the entity.user.personal_address.country_or_region UDM field.
Office	entity.user.office_address.name	If the ObjectClass log field value is equal to user or is empty, then if the Office log field value is not empty, then the Office log field is mapped to the entity.user.office_address.name UDM field.
HomeDirectory	entity.file.full_path	If the ObjectClass log field value is equal to user or is empty, then if the HomeDirectory log field value is not empty, then the HomeDirectory log field is mapped to the entity.file.full_path UDM field.
	entity.user.managers.user_display_name	If the ObjectClass log field value is equal to user or is empty, then if the Manager log field value is not empty, then manager_name is extracted from the Manager log field using a Grok pattern, and mapped to the entity.user.managers.user_display_name UDM field.
	entity.user.windows_sid	If the SID.Value log field value is not empty, then the SID.Value field is mapped to the entity.user.windows_sid UDM field. Else, if the objectSid log field value is not empty, then the objectSid field is mapped to the entity.user.windows_sid UDM field. If the ObjectClass log field value is equal to user or is empty, then if the Manager log field value is not empty, then if Manager matches the regular expression pattern (S-\d-(\d+-){1,14}\d+), then the Manager log field is mapped to the entity.user.managers.windows_sid UDM field. Else, the Manager log field is mapped to the entity.user.managers.userid UDM field.
	relations.relationship	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, the relations.relationship UDM field is set to MEMBER. Else, if the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then the relations.relationship UDM field is set to ADMINISTERS. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern, if the group_name extracted field value is not empty, then the relations.relationship UDM field is set to MEMBER.
	relations.entity.group.group_display_name	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, group_name is extracted from the index using a Grok pattern and mapped to the relations.entity.group.group_display_name UDM field. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern and mapped to the relations.entity.group.group_display_name UDM field.
	relations.entity_type	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, the relations.entity_type UDM field is set to GROUP. Else, if the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then the relations.entity_type UDM field is set to ASSET. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern, if the group_name extracted field value is not empty, then the relations.entity_type UDM field is set to GROUP.
	relations.direction	If the ObjectClass log field value is equal to user or is empty, then if the MemberOf log field value is not empty, then for index in MemberOf, the relations.direction UDM field is set to UNIDIRECTIONAL. Else, if the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then the relations.direction UDM field is set to UNIDIRECTIONAL. If the PrimaryGroup log field value is not empty, then group_name is extracted from the PrimaryGroup log field using a Grok pattern, if the group_name extracted field value is not empty, then the relations.direction UDM field is set to UNIDIRECTIONAL.
	relations.entity.user.user_display_name	If the ObjectClass log field value is equal to computer, then if the ManagedBy log field value is not empty, then user_name is extracted from the ManagedBy log field using a Grok pattern and mapped to the relations.entity.user.user_display_name UDM field.
proxyAddresses	entity.user.group_identifiers	If the ObjectClass log field value is equal to user or is empty, then for index in proxyAddresses the index is mapped to entity.user.group_identifiers UDM field.
	entity.user.attribute.labels[Bad Password Count]	If the ObjectClass log field value is equal to user or is empty, then if the badPwdCount log field value is not empty, then the entity.user.attribute.labels.key UDM field is set to Bad Password Count and the badPwdCount log field is mapped to the entity.user.attribute.labels.value UDM field.
LastBadPasswordAttempt	entity.user.last_bad_password_attempt_time	If the ObjectClass log field value is equal to user or is empty, then if the LastBadPasswordAttempt log field value is not empty, then last_bad_password_attempt is extracted from the LastBadPasswordAttempt log field using a Grok pattern and mapped to the entity.user.last_bad_password_attempt_time UDM field. Else, if the ObjectClass log field value is equal to computer, then last_bad_password_attempt is extracted from the LastBadPasswordAttempt log field using a Grok pattern and mapped to the entity.user.last_bad_password_attempt_time UDM field.
AccountExpirationDate	entity.user.account_expiration_time	If the ObjectClass log field value is equal to user or is empty, then if the AccountExpirationDate log field value is not empty, then account_expiration_date is extracted from the AccountExpirationDate log field using a Grok pattern and mapped to the entity.user.account_expiration_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the AccountExpirationDate log field value is not empty, then account_expiration_date is extracted from the AccountExpirationDate log field using a Grok pattern and mapped to the entity.user.account_expiration_time UDM field.
PasswordLastSet	entity.user.last_password_change_time	If the ObjectClass log field value is equal to user or is empty, then if the PasswordLastSet log field value is not empty, then password_last_set is extracted from the PasswordLastSet log field using a Grok pattern and mapped to the entity.user.last_password_change_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the PasswordLastSet log field value is not empty, then password_last_set is extracted from the PasswordLastSet log field using a Grok pattern and mapped to the entity.user.last_password_change_time UDM field.
PasswordNotRequired	entity.user.attribute.labels[Password Not Required]	If the ObjectClass log field value is equal to user or is empty, then if the PasswordNotRequired log field value is not empty, then the PasswordNotRequired log field is mapped to the entity.user.attribute.labels.value UDM field. If the ObjectClass log field value is equal to computer, then if the PasswordNotRequired log field value is not empty, then the PasswordNotRequired log field is mapped to the entity.asset.attribute.labels.value UDM field.
ServicePrincipalNames	entity.user.attribute.labels[Service Principal Names]	If the ObjectClass log field value is equal to user or is empty, then if ServicePrincipalNames log field value is not empty, then for index in ServicePrincipalNames the index is mapped to the entity.user.attribute.labels.value UDM field. Else, if the ObjectClass log field value is equal to computer, then if ServicePrincipalNames log field value is not empty, then for index in ServicePrincipalNames, if index is equal to 0, then the index is mapped to the entity.user.attribute.labels.value UDM field.
AccountLockoutTime	entity.user.account_lockout_time	If the ObjectClass log field value is equal to user or is empty, then if the AccountLockoutTime log field value is not empty, then account_lockout_time is extracted from the AccountLockoutTime log field using a Grok pattern and mapped to the entity.user.account_lockout_time UDM field. Else, if the ObjectClass log field value is equal to computer, then if the AccountLockoutTime log field value is not empty, then account_lockout_time is extracted from the AccountLockoutTime log field using a Grok pattern and mapped to the entity.user.account_lockout_time UDM field.
whenChanged	entity.asset.attribute.last_update_time	If the ObjectClass log field value is equal to computer, then when_changed is extracted from the whenChanged log field using a Grok pattern, if whenChanged is not empty, then when_changed is mapped to the entity.asset.attribute.last_update_time UDM field. Else, timestamp and timezone is extracted from whenChanged log field using a Grok pattern and tz_left and tz_right is extracted from the timezone using a Grok pattern and timestamp tz_left tz_right is mapped to entity.asset.attribute.creation_time UDM field.
DNSHostName	entity.asset.hostname	If the ObjectClass log field value is equal to computer, then if the DNSHostName log field value is not empty, then the DNSHostName log field is mapped to the entity.asset.hostname UDM field.
countryCode	entity.asset.location.country_or_region	If the ObjectClass log field value is equal to computer, then if the countryCode log field value is not empty, then the countryCode log field is mapped to the entity.asset.location.country_or_region UDM field.
	entity.asset.platform_software.platform	If the ObjectClass log field value is equal to computer, then if the OperatingSystem log field value is not empty, then if the OperatingSystem log field value matches the regular expression pattern (?i)windows, then the entity.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the OperatingSystem log field value matches the regular expression pattern (?i)mac or the OperatingSystem log field value matches the regular expression pattern (?i)osx, then the entity.asset.platform_software.platform UDM field is set to MAC. Else, if the OperatingSystem log field value matches the regular expression pattern (?i)linux, then the entity.asset.platform_software.platform UDM field is set to LINUX.
OperatingSystemVersion	entity.asset.platform_software.platform_version	If the ObjectClass log field value is equal to computer, then if the OperatingSystem log field value is not empty, then if the OperatingSystemVersion log field value is not empty, then OperatingSystem - OperatingSystemVersion is mapped to the entity.asset.platform_software.platform_version UDM field. Else if the OperatingSystemVersion log field value is not empty, then the OperatingSystemVersion log field is mapped to the entity.asset.platform_software.platform_version UDM field.
OperatingSystemServicePack	entity.asset.platform_software.platform_patch_level	If the ObjectClass log field value is equal to computer, then if the OperatingSystemServicePack log field value is not empty, then the OperatingSystemServicePack log field is mapped to the entity.asset.platform_software.platform_patch_level UDM field.
IPv4Address	entity.asset.ip	If the ObjectClass log field value is equal to computer, then if the IPv4Address log field value is not empty, then the IPv4Address log field is mapped to the entity.asset.ip UDM field.
IPv6Address	entity.asset.ip	If the ObjectClass log field value is equal to computer, then if the IPv6Address log field value is not empty, then the IPv6Address log field is mapped to the entity.asset.ip UDM field.
Location	entity.asset.location.name	If the ObjectClass log field value is equal to computer, then if the Location log field value is not empty, then the Location log field is mapped to the entity.asset.location.name UDM field.
ObjectCategory	entity.asset.category	If the ObjectClass log field value is equal to computer, then if the ObjectCategory log field value is not empty, then object_category is extracted from the ObjectCategory log field using a Grok pattern, and mapped to the entity.asset.category UDM field.
PasswordExpired	entity.asset.attribute.labels[Password Expired]	If the ObjectClass log field value is equal to computer, then if the PasswordExpired log field value is not empty, then the PasswordExpired log field is mapped to the entity.asset.attribute.labels.value UDM field. If the ObjectClass log field value is equal to user or is empty, then if the PasswordExpired log field value is not empty, then the PasswordExpired log field is mapped to the entity.user.attribute.labels.value UDM field.
PasswordNeverExpires	entity.asset.attribute.labels[Password Never Expires]	If the ObjectClass log field value is equal to computer, then if the PasswordNeverExpires log field value is not empty, then the PasswordNeverExpires log field is mapped to the entity.asset.attribute.labels.value UDM field. If the ObjectClass log field value is equal to user or is empty, then if the PasswordNeverExpires log field value is not empty, then the PasswordNeverExpires log field is mapped to the entity.user.attribute.labels.value UDM field.
	entity.user.attribute.labels[Last Logon]	If the ObjectClass log field value is equal to user or is empty, then if the lastLogon log field value is not equal to 0, then the entity.user.attribute.labels.key UDM field is set to Last Logon and the lastLogon log field is mapped to the entity.user.attribute.labels.value UDM field. If the ObjectClass log field value is equal to computer, then if the lastLogon log field value is not equal to 0, then the entity.asset.attribute.labels.key UDM field is set to Last Logon and the lastLogon log field is mapped to the entity.asset.attribute.labels.value UDM field.
lastLogoff	entity.asset.attribute.labels[Last Logoff]	If the ObjectClass log field value is equal to computer, then if the lastLogoff log field value does not contain one of the following values, then the lastLogoff log field is mapped to the entity.asset.attribute.labels.value UDM field. "0" 0 .
LastLogonDate	entity.user.last_login_time	If the ObjectClass log field value is equal to user or is empty, then if the LastLogonDate log field value is not empty, then last_logon_date is extracted from the LastLogonDate log field using a Grok pattern, and mapped to the entity.user.last_login_time UDM field. Else if the ObjectClass log field value is equal to computer,then if the LastLogonDate log field value is not empty, then last_logon_date is extracted from the LastLogonDate log field using a Grok pattern, and mapped to the entity.user.last_login_time UDM field.
HomePage	entity.url	If the HomePage log field value is not empty, then the HomePage log field is mapped to the entity.url UDM field.
	entity.administrative_domain	If the CanonicalName log field value is not empty, then domain_name is extracted from the CanonicalName log field using a Grok pattern, and mapped to the entity.administrative_domain UDM field.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Microsoft.
	metadata.product_name	The metadata.product_name UDM field is set to Windows Active Directory.
Description	metadata.description	The Description log field is mapped to the metadata.description UDM field.

需要更多帮助？向社区成员和 Google SecOps 专业人士寻求解答。