Trying to add workforceID to eDirectory Collector

Question

I'm trying to add WorkforceID to the eDirectory collector.
I have Eclipse installed and working with the Senitnel SDK plug-in.
I have the edirectory collector imported and have been looking through
the various files to get some sort of understanding.
Could you give me some guidance as to where to start? I need to add
workforceID to the audit message that is sent to Sentinel and need to
know which files within the collector I need to make modifications to.
Also, which file do i need to modify to change the severity levels? I
need to make some changes to a few different collectors.
Thanks in advance.
brembold
brembold's Profile: http://forums.novell.com/member.php?userid=4186
View this thread: http://forums.novell.com/showthread.php?t=417817

Answer 1

Thanks for the feedback... I'll point the customer in the direction of
the CMP as that is a can of worms i'm not interested in opening.
Also good feedback on the severity level, they just wanted to see
different levels of severity for different events for their own internal
purposes...
DCorlette;2008652 Wrote:
> Hi brembold,
>
> OK, well this is a lot more complicated then I think you realize.
>
> First off, let's be clear: modification of the existing eDirectory
> Collector is NOT SUPPORTED and will likely break things. There is an
> approved, controlled process used to modify existing shipping Collectors
> which is documented on the SDK website:
> 'Custom Execution Mode - Developer Community'
> (http://developer.novell.com/wiki/ind...Execution_Mode)
>
> In essence, the idea is that you add (not replace) files to the
> Collector, and extend existing maps and methods as needed to change the
> Collector's behavior. On the other hand, you will probably need to walk
> through the existing Collector code to understand how it works, as you
> may need to manipulate internal variables and so forth that you won't
> know about unless you browse through the existing Collector code (and
> maybe debug it, too).
>
> OK, that said, let's look at your two issues:
>
> 1) Add workforce ID to eDir events. At first blush, this isn't
> actually possible because eDir doesn't report workforce ID with every
> event. I am assuming here that you mean that each employee in the
> enterprise is assigned a workforce ID, and you want to be able to always
> have that as part of any events that are initiated by that employee.
> Correct?
> This won't happen simply be editing the Collector; there's a whole
> contextual state that the Collector does not have access to. On the
> other hand, the entire purpose in life of the Compliance Management
> Platform that we sell is to allow you to inject exactly that contextual
> state into eDirectory event data, and in the CMP workforceID is most
> decidedly supported. But, since we spent 9 months with 10 people or so
> developing that solution, you're not likely to be able to replicate its
> functionality on your own.
> If you want to try, however, what I'd suggest is perhaps using a
> correlation rule to automatically create a map when a workforce ID is
> assigned to a user DN, and then using the Mapping Service to apply that
> map when it sees that DN of future input. You can pre-create the map for
> any pre-existing accounts, since otherwise Sentinel will never know
> their workforce IDs. Note that none of this requires touching the
> Collector.
>
> 2) Modifying the Severity: Before we get into the HOW, let's discuss
> the WHY: in Sentinel, the Severity field is defined as a mapping from
> the original event source's assigned severity, log level, or whatever to
> Sentinel's 0-5 Severity levels. For many devices, this is fixed and
> shouldn't be changed, so for example the standard syslog severity levels
> (7-0, with 0 as most critical) are mapped to Sentinel's 0-5, with 5 as
> the most critical. Changing this for a Collector or even specific events
> could potentially break downstream content, and should not be undertaken
> by the faint of heart. Of course, there are also cases where the event
> source does NOT assign a severity, and we are forced to invent them
> based on say the type of event and other "key values" in the event.
>
> Now, there are certainly cases where people want to change the
> "Severity", but in my experience these boil down into three categories:
>
> 1) They disagree with the severity assigned by the original event
> source vendor. So for example they think that a "user add" event that
> fails in LDAP should have an elevated severity, and the vendor, for
> whatever reason, didn't do so. The only recourse in this case is really
> to go complain to the vendor, as we have no control over what they
> produce. We could certainly override their settings, but then if they
> went and corrected their side...
>
> 2) They disagree with the mappings that we provide by default in our
> Collector, either the standard level-to-level mappings or, if not
> available, the mapping we've assigned to some specific event. In this
> case, feel free to suggest an enhancement or even a bugfix to the
> specific Collector via Novell's bugzilla, as this is important feedback
> we want to hear.
>
> 3) They really aren't looking for Severity, they're trying to calculate
> a "risk rating" and, for their specific enterprise, there are certain
> events that they can define as higher or lower risk than the normal
> severity assignments. In some cases the customer just isn't interested
> in, say, modification of certain attributes, or something like that. In
> other cases the customer wants to lower the risk rating based on what
> type of asset (server vs. desktop) that the event is coming from. In any
> case, the point is that the narrowly defined "Severity" field is not
> really the place to do this; what you really want to do is create a map
> that combines Severity with some other set of fields (maybe ObserverIP,
> and create a list of critical assets) and then populates some custom
> field with your internal risk rating.
>
> Now, if you want to just ignore what I said above and really do want to
> change the standard assigned severities, you can in some cases look for
> a file like 'severity.map' in the Collector, and if found, duplicate the
> format and assign your own severities, import that file into the
> Collector, then import a custom.js file that, in the initialize()
> method, uses the KeyMap.extend() method to read in your new file and
> extend/replace the existing mappings.
>
> Hope this helps, and if you'd like more assistance please follow up.
brembold
brembold's Profile: http://forums.novell.com/member.php?userid=4186
View this thread: http://forums.novell.com/showthread.php?t=417817