Customers that would like the SIEM data sent in JSON format can use the following format as a default. This format has been tested against a variety of SIEM solutions.
- Create a new SIEM Template named “JSON”
- Fill in the Description field with the appropriate information - i.e. “Custom JSON output”
- Type \” for the ‘Characters to Escape’ to ensure that the output renders correctly in Rapid7 and Splunk
- Type \ as the ‘Escape Character’
- Copy and paste the following text in to the ‘Format’ field.
{“Date”: “%SYSLOG_DATE%”, “Host”: “%HOST%”, “Template”: “%TEMPLATENAME%:%TEMPLATEVERSION%”, “Company”: “%COMPANY%”, “Product”: “%PRODUCT%”, “ProductVersion”: “%PRODUCT_VERSION%”, “LogLevelStatus”: “%LOGLEVELSTATUS%”, “LogLevel”: “%LOGLEVEL%”, “EventTimeUtc”: “%EVENTTIMEUTC%”, “EventLoggedInUserName”: “%EVENTLOGGEDINUSERNAME%”, “EventLoggedInFromIPAddress”: “%EVENTLOGGEDINFROMIPADDRESS%”, “EventAccessPolicyName”: “%EVENTACCESSPOLICYNAME%”, “EventSourceHost”: “%EVENTSOURCEHOST%”, “EventServiceType”: “%EVENTSERVICETYPE%”, “EventType”: “%EVENTTYPE%”, “EventStatus”: “%EVENTSTATUS%”, “EventMessage”: “%EVENTMESSAGE%”, “ActivitySessionCreatedByUserName”: “%ACTIVITYSESSIONCREATEDBYUSERNAME%”, “ActivitySessionCreateFromAddress”: “%ACTIVITYSESSIONCREATEDFROMADDRESS%”, “ActivitySessionCreatedDateTimeUtc”: “%ACTIVITYSESSIONCREATEDDATETIMEUTC%”, “ActivitySessionLoginAccountName”: “%ACTIVITYSESSIONLOGINACCOUNTNAME%”, “ActivitySessionSattus”: “%ACTIVITYSESSIONSTATUS%”, “ActivitySessionStatusDescription”: “%ACTIVITYSESSIONSTATUSDESCRIPTION%”, “ManagedAccountName”: “%MANAGEDACCOUNTNAME%”, “ManagedAccounttype”: “%MANAGEDACCOUNTTYPE%”, “ManagedResourceName”: “%MANAGEDRESOURCENAME%”, “ManagedResourceType”: “%MANAGEDRESOURCETYPE%”, “ManagedSourceHostName”: “%MANAGEDRESOURCEHOSTNAME%”, “ManagedResourceHostDistinguishedName”: “%MANAGEDRESOURCEHOSTDISTINGUISHEDNAME%”, “ManagedResourceHostIPAddress”: “%MANAGEDRESOURCEHOSTIPADDRESS%”, “ManagedResourceHostOS”: “%MANAGEDRESOURCEHOSTOS%”, “ManagedResourceHostDNSHostName”: “%MANAGEDRESOURCEHOSTDNSHOSTNAME%”, “ManagedResourceHostNetBIOSName”: “%MANAGEDRESOURCEHOSTNETBIOSNAME%” }
The result should look similar to the following, in NPS
When looking at the output, depending on the Siem solution, you can view the data in its raw format (which will show the escaped characters) or the highlighted view, which will show a nicer view of the data (notice that the escaped \ doesn’t show up in this view).
