SHOW:
|
|
- or go back to the newest paste.
| 1 | ' purpose with or without fee is hereby granted, provided that the above | |
| 2 | ' copyright notice and this permission notice appear in all copies. | |
| 3 | ' | |
| 4 | ' THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | |
| 5 | ' WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | |
| 6 | ' MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | |
| 7 | ' ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | |
| 8 | ' WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | |
| 9 | ' ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | |
| 10 | ' OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | |
| 11 | ' | |
| 12 | 'Script takes syslog output sent from an Aerohive device to a Kiwi syslog server and updates userdata | |
| 13 | 'log data is expected to look like: 2013-04-01 14:06:05 info ah auth: Station 1cab:a7e6:cf7f ip10.5.50.52 username astrong hostname Strong-iPad3-6 OS Apple iOS | |
| 14 | Function Main() 'Kiwi syslog requires the content of the script to be contained in a Main() function | |
| 15 | - | |
| 15 | + | |
| 16 | '----CHANGE THESE TO MATCH AGENT OR FIREWALL---- | |
| 17 | strAgentServer="10.5.1.3" | |
| 18 | strAgentPort="3088" | |
| 19 | '----CHANGE THIS TO MATCH AD DOMAIN NAME!---- | |
| 20 | strDomain = "Domain1" | |
| 21 | '-----ADD API KEY HERE FOR AGENTLESS OPERATION | |
| 22 | strKey="" | |
| 23 | set xmlHttp = CreateObject("Msxml2.ServerXMLHTTP")
| |
| 24 | strLog = Fields.VarCleanMessageText 'This is a Kiwi variable for the content of the log message | |
| 25 | ptrn = "ip (\d+\.\d+\.\d+\.\d+).*username (\w+).*hostname (.*) OS (.*)" | |
| 26 | if InStr(strLog,"n/a")=0 then 'Will not run script if there is no username | |
| 27 | '// Create the regular expression. | |
| 28 | Set re = New RegExp | |
| 29 | re.Pattern = ptrn | |
| 30 | re.IgnoreCase = False | |
| 31 | re.Global = True | |
| 32 | '// Perform the search. | |
| 33 | Set Matches = re.Execute(strLog) | |
| 34 | - | |
| 34 | + | |
| 35 | - | |
| 35 | + | |
| 36 | - | |
| 36 | + | |
| 37 | '// Collect matches and assign the user and address to variables | |
| 38 | set oMatch = Matches(0) | |
| 39 | strUser = oMatch.subMatches(1) | |
| 40 | strAddress = oMatch.subMatches(0) | |
| 41 | strHost = oMatch.subMatches(2) | |
| 42 | strOS = oMatch.subMatches(3) | |
| 43 | '// Build the XML message | |
| 44 | strXMLLine = "<uid-message><version>1.0</version><type>update</type><payload><login>" | |
| 45 | strXMLLine = strXMLLine & "<entry name=""" & strDomain & "\" & strUser & """ ip=""" & strAddress & """/>" | |
| 46 | if strKey="" then | |
| 47 | strXMLLine = strXMLLine & "<hip-report><md5-sum>ae413e22b34a76366a542a1dd9b1108a</md5-sum><user-name>" & strUser & "</user-name><domain>" & strDomain & "</domain><host-name>"& strHost & "</host-name><ip-address>"& strAddress & "</ip-address><generate-time>" & Now & "</generate-time><categories><entry name=""" & "host-info" & """><client-version></client-version><os>" & strOs & "</os><os-vendor></os-vendor><domain></domain><host-name>android</host-name </entry></categories></hip-report>" | |
| 48 | end if | |
| 49 | strXMLLine = strXMLLine & "</login></payload></uid-message>" | |
| 50 | '// | |
| 51 | '// Post to the UID agent | |
| 52 | '// | |
| 53 | Const SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056 | |
| 54 | If strKey="" then 'Posting to software agent | |
| 55 | '// Post data to Agent | |
| 56 | sUrl = "https://" & strAgentServer & ":" & strAgentPort & "/" | |
| 57 | On Error Resume Next | |
| 58 | xmlHttp.open "put", sUrl, False | |
| 59 | xmlhttp.setRequestHeader "Content-type", "text/xml" | |
| 60 | xmlHttp.setOption 2, SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS | |
| 61 | xmlHttp.send strXMLLine | |
| 62 | xmlHttp.close | |
| 63 | - | |
| 63 | + | |
| 64 | - | |
| 64 | + | |
| 65 | - | |
| 65 | + | |
| 66 | else 'posting to firewall agent | |
| 67 | '//Post using REST API | |
| 68 | sUrl = "https://" & strAgentServer & "/api/?type=user-id&action=set&key=" & strKey & "&cmd=" & strXMLLine | |
| 69 | On Error Resume Next | |
| 70 | xmlHttp.open "put", sUrl, False | |
| 71 | xmlhttp.setRequestHeader "Content-type", "text/xml" | |
| 72 | xmlHttp.setOption 2, SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS | |
| 73 | xmlHttp.send | |
| 74 | xmlHttp.close | |
| 75 | end if | |
| 76 | end if | |
| 77 | Main="OK" 'return value for Kiwi | |
| 78 | End Function |