Trying to pull a username from a description.

Question

I am new to InTust and I am trying to setup a rule that sends an alert when someone fails to logon for either a bad password or a bad username. The issue is that the logs come in entirely under insertion string 1 and Event ID 0. I have used the 3 parameters thus far. Threshold for the 3 attempts, Time Period, and Keys to define the failed logon message within the field. I need it to now read the username written in that same field. If someone could help me out I would greatly appreciate it. Thank you!

Igor.Ilyin · Accepted Answer

And the whole rule with threshold might look as follows. The only thing that is not good - this REL language cannot return the whole list of user names, the list is not accessible from outside. So, you can only see the last User who triggered the rule, the User Name is accessible by %UserName%. "0/00/0 01:00:00" 3 "*AFTRAK: Access Denied. This user is inactive.*","*AFTRAK: Access Denied. This user account does not exist.*" ".*Access Denied.*User Account: (.*)" EventID = 0; EventID = 0 and in(String1, "wi", array()) and count(select_filtered( EventID = 0 and in( String1, "wi", array() ), Z.EventID = 0 and in( Z.String1, "wi", array() ) and substr(String1, regexp(array(), String1, "i")[1][0], regexp(array(), String1, "i")[1][1]) != substr(Z.String1, regexp(array(), Z.String1, "i")[1][0], regexp(array(), Z.String1, "i")[1][1]), )) >= and empty(select_matches( EventID = 0, )) and set_alert_field("UserName", substr(String1, regexp(array(), String1, "i")[1][0], regexp(array(), String1, "i")[1][1]));

Igor.Ilyin · Answer

Hi Brian, does this topic continue the thread https://www.quest.com/community/intrust/f/forum/31182/application-log-and-realtime-alert ? OK, this can be done with regular expressions, you should write a regex for the String1. Since you did not provide any details, I will give you an example based on previous thread plus my guess-work. If we have two events: An attempt was made to login under dom\flast. Access Denied. This user is inactive. An attempt was made to login under dom\flast. Access Denied. This user account does not exist. The example of the rule that "reads the user name" might be as follows: ".*\s([a-zA-Z][a-zA-Z0-9\-\.]{1,61}[a-zA-Z]\\\w[\w\.\-]+)\.\s.*" EventID = 0 and set_alert_field("UserName", substr(String1, regexp(array(), String1, "i")[1][0], regexp(array(), String1, "i")[1][1])); The regex function returns an array of numbers, the index where regexp matched, and the length of the match, https://support.quest.com/technical-documents/intrust/11.4.1/customization-kit/7#String . Then indexes are used in substr function. My regexp is .*?\s([a-zA-Z][a-zA-Z0-9\-\.]{1,61}[a-zA-Z]\\w[\w\.\-]+)\.\s.*, it searches for something that contains \ inside and ends with . Note that you should double all backslashes after you copy the regexp into the rule.

Trying to pull a username from a description.

Top Replies