View difference between Paste ID: Zp6BJy6u and nzTkJMPS
SHOW: | | - or go back to the newest paste.
1
' purpose with or without fee is hereby granted, provided that the above
2
' copyright notice and this permission notice appear in all copies.
3
'
4
' THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
5
' WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
6
' MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
7
' ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
8
' WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
9
' ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
10
' OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
11
'
12
'Script takes syslog output sent from an Aerohive device to a Kiwi syslog server and updates userdata
13
'log data is expected to look like: 2013-04-01 14:06:05 info ah auth: Station 1cab:a7e6:cf7f ip10.5.50.52 username astrong hostname Strong-iPad3-6 OS Apple iOS
14
Function Main() 'Kiwi syslog requires the content of the script to be contained in a Main() function
15-
15+
 
16
'----CHANGE THESE TO MATCH AGENT OR FIREWALL----
17
strAgentServer="10.5.1.3"
18
strAgentPort="3088"
19
'----CHANGE THIS TO MATCH AD DOMAIN NAME!----
20
strDomain = "Domain1"
21
'-----ADD API KEY HERE FOR AGENTLESS OPERATION
22
strKey=""
23
set xmlHttp = CreateObject("Msxml2.ServerXMLHTTP")
24
strLog = Fields.VarCleanMessageText 'This is a Kiwi variable for the content of the log message
25
ptrn = "ip (\d+\.\d+\.\d+\.\d+).*username (\w+).*hostname (.*) OS (.*)"
26
if InStr(strLog,"n/a")=0 then 'Will not run script if there is no username
27
'// Create the regular expression.
28
Set re = New RegExp
29
re.Pattern = ptrn
30
re.IgnoreCase = False
31
re.Global = True
32
'// Perform the search.
33
Set Matches = re.Execute(strLog)
34-
34+
 
35-
35+
 
36-
36+
 
37
'// Collect matches and assign the user and address to variables
38
set oMatch = Matches(0)
39
strUser = oMatch.subMatches(1)
40
strAddress = oMatch.subMatches(0)
41
strHost = oMatch.subMatches(2)
42
strOS = oMatch.subMatches(3)
43
'// Build the XML message
44
strXMLLine = "<uid-message><version>1.0</version><type>update</type><payload><login>"
45
strXMLLine = strXMLLine & "<entry name=""" & strDomain & "\" & strUser & """ ip=""" & strAddress & """/>"
46
if strKey="" then
47
strXMLLine = strXMLLine & "<hip-report><md5-sum>ae413e22b34a76366a542a1dd9b1108a</md5-sum><user-name>" & strUser & "</user-name><domain>" & strDomain & "</domain><host-name>"& strHost & "</host-name><ip-address>"& strAddress & "</ip-address><generate-time>" & Now & "</generate-time><categories><entry name=""" & "host-info" & """><client-version></client-version><os>" & strOs & "</os><os-vendor></os-vendor><domain></domain><host-name>android</host-name </entry></categories></hip-report>"
48
end if
49
strXMLLine = strXMLLine & "</login></payload></uid-message>"
50
'//
51
'// Post to the UID agent
52
'//
53
Const SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056
54
If strKey="" then 'Posting to software agent
55
'// Post data to Agent
56
sUrl = "https://" & strAgentServer & ":" & strAgentPort & "/"
57
On Error Resume Next
58
xmlHttp.open "put", sUrl, False
59
xmlhttp.setRequestHeader "Content-type", "text/xml"
60
xmlHttp.setOption 2, SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS
61
xmlHttp.send strXMLLine
62
xmlHttp.close
63-
63+
 
64-
64+
 
65-
65+
 
66
else 'posting to firewall agent
67
'//Post using REST API
68
sUrl = "https://" & strAgentServer & "/api/?type=user-id&action=set&key=" & strKey & "&cmd=" & strXMLLine
69
On Error Resume Next
70
xmlHttp.open "put", sUrl, False
71
xmlhttp.setRequestHeader "Content-type", "text/xml"
72
xmlHttp.setOption 2, SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS
73
xmlHttp.send
74
xmlHttp.close
75
end if
76
end if
77
Main="OK" 'return value for Kiwi
78
End Function