vuln.beyondtrust

[ 1 Introduction ] [ 2 Valid tags and data tables ] [ 3 Send it ] [ 4 Table structure ]

Introduction

The tags beginning with vuln.beyondtrust identify events generated by BeyondTrust vulnerability management.

Valid tags and data tables

The full tag must have 3 levels. The first two are fixed as vuln.beyondtrust. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service	Tags	Data tables

Product / Service	Tags	Data tables
Beyond Trust vulnerability management	`vuln.beyondtrust.appaudit`	`vuln.beyondtrust.appaudit`
	`vuln.beyondtrust.appaudit.csv`	`vuln.beyondtrust.appaudit`
	`vuln.beyondtrust.pbps`	`vuln.beyondtrust.pbps`
	`vuln.beyondtrust.pbps.csv`	`vuln.beyondtrust.pbps`
	`vuln.beyondtrust.retina`	`vuln.beyondtrust.retina`

For more information, read more About Devo tags.

Send it

Data should be sent using the relay.

In BeyondTrust solutions, you can set up a connector that enables syslog event forwarding. The events should be directed to a Devo relay where a relay rule applies the correct tag, then forwards the events securely to your Devo domain.

For information about setting up syslog event forwarding, see the BeyondInsight and Password Safe Third-Party Integration Guide.

Example relay rules

         Source message: 
            Source data: Agent ID: ([^ ]+)
             Source tag: 
             Target tag: vuln.beyondtrust.\\D1
Sent without syslog tag: false
        Stop processing: true

Table structure

These are the fields displayed in these tables:

vuln.beyondtrust.appaudit
vuln.beyondtrust.pbps
vuln.beyondtrust.retina

vuln.beyondtrust.applaudit

Field	Type	Field transformation	Source field name	Extra fields

Field	Type	Field transformation	Source field name	Extra fields
eventdate	`timestamp`
host	`str`
agent_desc	`str`
agent_id	`str`
agent_ver	`str`
category	`str`
source_host	`str`
event_desc	`str`
event_name	`str`
os	`str`
event_severity	`int4`
source_ip	`ip4`
event_subject	`str`
event_type	`str`
user	`str`
workgroup_desc	`str`
workgroup_id	`str`
workgroup_location	`str`
audit_id	`int8`
action_type	`str`
system_name	`str`
app_user_id	`int4`
create_date	`timestamp`	`parsedate(mycreatedate, "M/DD/YYYY h:mm:ss A")`	mycreatedate
ip_address	`ip4`
user_name2	`str`
groupp	`str`
auth_type	`str`
domain_name	`str`
sam_account_name	`str`
source	`str`
message	`str`
address_group_name	`str`
id	`int4`
smart_rule_name	`str`
report_name	`str`
asset_name	`str`
unknown	`str`
rawMessage	`str`
hostchain	`str`			✓
tag	`str`			✓

vuln.beyondtrust.pbps

Field	Type	Field transformation	Source field name	Extra fields

Field	Type	Field transformation	Source field name	Extra fields
eventdate	`timestamp`
host	`str`	`split(hostchain, "=", 0)`	hostchain
agent_desc	`str`
agent_id	`str`
agent_ver	`str`
category	`str`
source_host	`str`
event_desc	`str`
event_name	`str`
os	`str`
event_severity	`int4`
source_ip	`ip4`
event_subject	`str`
event_type	`str`
user	`str`
workgroup_desc	`str`
workgroup_id	`str`
workgroup_location	`str`
log_system_id	`int8`
log_time	`str`
user_name	`str`
role_used	`str`
object_type_id	`int4`	`parsedate(mycreatedate, "M/DD/YYYY h:mm:ss A")`	mycreatedate
object_type	`str`
object_id	`int4`
operation	`str`
failed	`str`
target	`str`
details	`str`
user_id	`int4`
time_stamp	`str`
ip_address	`ip4`
unknown	`str`
rawMessage	`str`
hostchain	`str`			✓
tag	`str`			✓

vuln.beyondtrust.retina

Field	Type	Field transformation	Source field name	Extra fields

Field	Type	Field transformation	Source field name
eventdate	`timestamp`
host	`str`	`split(hostchain, "=", 0)`	hostchain
agent_desc	`str`
agent_id	`str`
agent_ver	`str`
category	`str`