User Context logs
| NXLog field | UDM field |
|---|---|
GivenName |
entity.entity.user.first_name |
Surname |
entity.entity.user.last_name |
SamAccountName |
entity.entity.user.userid |
SID.Value |
entity.entity.user.windows_sid |
ObjectClass |
If the value is user,entity.metadata.entity_type is set to USER |
ObjectGuid |
If the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.entity.user.product_object_id UDM field.
Else, If the objectGUID log field value is not empty, then the objectGUID log field is mapped to the entity.entity.user.product_object_id UDM field.
Else, If the ObjectGUID log field value is not empty, then the ObjectGUID log field is mapped to the
entity.entity.user.product_object_id UDM field.
|
objectGUID |
If the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.entity.user.product_object_id UDM field.
Else, If the objectGUID log field value is not empty, then the objectGUID log field is mapped to the entity.entity.user.product_object_id UDM field.
Else, If the ObjectGUID log field value is not empty, then the ObjectGUID log field is mapped to the entity.entity.user.product_object_id UDM field.
|
ObjectGUID |
If the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.entity.user.product_object_id UDM field.
Else, If the objectGUID log field value is not empty, then the objectGUID log field is mapped to the entity.entity.user.product_object_id UDM field.
Else, If the ObjectGUID log field value is not empty, then the ObjectGUID log field is mapped to the entity.entity.user.product_object_id UDM field.
|
AccountExpirationDate |
entity.entity.user.account_expiration_time |
badPwdCount |
entity.entity.user.attribute.label.key and entity.entity.user.attribute.label.value |
CanonicalName |
entity.entity.administrative_domain |
City |
entity.entity.user.personal_address.city |
Company |
entity.entity.user.company_name |
Country |
entity.entity.user.personal_address.country_or_region |
Department |
entity.entity.user.department |
Description |
entity.metadata.description |
DisplayName |
entity.entity.user.user_display_name |
EmailAddress |
entity.entity.user.email_addresses |
EmployeeID |
entity.entity.user.employee_id |
HomeDirectory |
entity.entity.file.full_path |
HomePage |
entity.entity.url |
HomePhone |
entity.entity.user.phone_numbers |
LastBadPasswordAttempt |
entity.entity.user.last_bad_password_attempt_time |
lastLogoff |
entity.entity.user.attribute.label.key and entity.entity.user.attribute.label.value |
lastLogon |
entity.entity.user.attribute.label.key and entity.entity.user.attribute.label.value |
LastLogonDate |
entity.entity.user.last_login_time |
Manager |
Values for GUID, SAMAccountname, SID all mapped to different UDM fields:- SID is stored in manager.windows_sid- Distinguished name (i.e. value in first CN) is stored in
manager.user_display_name- GUID,SamAccountName is stored in manager.userid |
MemberOf |
The following fields in the first occurrence of CN are set:entity.relations.entity.group.group_display_nameentity.relations.entity_type set to GROUPentity.relations.relationship set t0 MEMBERentity.relations.direction set to UNIDIRECTIONAL |
MobilePhone |
entity.entity.user.phone_numbers |
Office |
entity.entity.user.office_address.name |
PasswordExpired |
entity.entity.user.attribute.label.key and entity.entity.user.attribute.label.value |
PasswordLastSet |
entity.entity.user.last_password_change_time |
PasswordNeverExpires |
entity.entity.user.attribute.label.key and entity.entity.user.attribute.label.value |
PasswordNotRequired |
entity.entity.user.attribute.label.key and entity.entity.user.attribute.label.value |
PrimaryGroup |
Following fields are set: - entity.relations.entity.group.group_display_name- entity.relations.entity_type set to GROUP- entity.relations.relationship set to MEMBER- entity.relations.direction set to UNIDIRECTIONAL |
ServicePrincipalNames |
entity.entity.user.attribute.label.key and entity.entity.user.attribute.label.value |
State |
entity.entity.user.personal_address.state |
StreetAddress |
entity.entity.user.personal_address.name |
Title |
entity.entity.user.title |
whenCreated |
entity.user.attribute.creation_time |
AccountLockoutTime |
entity.entity.user.account_lockout_time |
Asset Context logs
| NXLog Field | UDM Field |
|---|---|
DNSHostName |
entity.entity.asset.hostname |
SamAccountName |
entity.entity.asset.asset_id |
SID.Value |
entity.entity.user.windows_sid |
ObjectClass |
If the value is computer, entity.metadata.entity_type set to ASSET |
ObjectGuid |
If the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.entity.asset.product_object_id UDM field.
Else, If the ObjectGUID log field value is not empty, then the ObjectGUID log field is mapped to the entity.entity.asset.product_object_id UDM field. |
ObjectGUID |
If the ObjectGuid log field value is not empty, then the ObjectGuid log field is mapped to the entity.entity.asset.product_object_id UDM field.
Else, If the ObjectGUID log field value is not empty, then the ObjectGUID log field is mapped to the entity.entity.asset.product_object_id UDM field. |
AccountExpirationDate |
entity.entity.user.account_expiration_time |
badPwdCount |
entity.entity.asset.attribute.label.key and entity.entity.asset.attribute.label.value |
CanonicalName |
entity.entity.administrative_domain |
countryCode |
entity.entity.asset.location.country_or_region |
Description |
entity.entity.metadata.description |
HomePage |
entity.entity.url |
IPv4Address |
entity.entity.asset.ip |
IPv6Address |
entity.entity.asset.ip |
LastBadPasswordAttempt |
entity.entity.user.last_bad_password_attempt_time |
lastLogoff |
entity.entity.asset.attribute.label.key and entity.entity.asset.attribute.label.value |
lastLogon |
entity.entity.asset.attribute.label.key and entity.entity.asset.attribute.label.value |
LastLogonDate |
entity.entity.user.last_login_time |
Location |
entity.entity.asset.location.name |
ManagedBy |
The following fields are set:entity.entity.user.user_display_nameentity.relations.entity_type set to USERentity.relations.relationship set to ADMINISTERSentity.relations.direction set to UNIDIRECTIONAL |
ObjectCategory |
entity.entity.asset.category |
OperatingSystem |
If the name contains Windows,
entity.entity.asset.platform_software.platform field is set to
WINDOWS. |
OperatingSystemServicePack |
entity.entity.asset.platform_software.platform_patch_level |
OperatingSystemVersion |
The field entity.entity.asset.platform_software.platform_version is set to
%{OperatingSystem} - %{OperatingSystemVersion} |
PasswordExpired |
entity.entity.asset.attribute.label.key and entity.entity.asset.attribute.label.value |
PasswordLastSet |
entity.entity.user.last_password_change_time |
PasswordNeverExpires |
entity.entity.asset.attribute.label.key and entity.entity.asset.attribute.label.value |
PasswordNotRequired |
entity.entity.asset.attribute.label.key and entity.entity.asset.attribute.label.value |
PrimaryGroup |
The following fields are set: - entity.relations.entity.group.group_display_name- entity.relations.entity_type set to GROUP- entity.relations.relationship set to MEMBER- entity.relations.direction set to UNIDIRECTIONAL |
ServicePrincipalNames |
entity.entity.asset.attribute.label.key and entity.entity.asset.attribute.label.value |
whenChanged |
entity.entity.asset.attribute.last_update_time |
whenCreated |
entity.entity.asset.attribute.creation_time |
AccountLockoutTime |
entity.entity.user.account_lockout_time |