' purpose with or without fee is hereby granted, provided that the above
' copyright notice and this permission notice appear in all copies.
'
' THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
' WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
' MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
' ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
' WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
' ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
' OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
'
'Script takes syslog output sent from an Aerohive device to a Kiwi syslog server and updates userdata
'log data is expected to look like: 2013-04-01 14:06:05 info ah auth: Station 1cab:a7e6:cf7f ip10.5.50.52 username astrong hostname Strong-iPad3-6 OS Apple iOS
Function Main() 'Kiwi syslog requires the content of the script to be contained in a Main() function

'----CHANGE THESE TO MATCH AGENT OR FIREWALL----
strAgentServer="10.5.1.3"
strAgentPort="3088"
'----CHANGE THIS TO MATCH AD DOMAIN NAME!----
strDomain = "Domain1"
'-----ADD API KEY HERE FOR AGENTLESS OPERATION
strKey=""
set xmlHttp = CreateObject("Msxml2.ServerXMLHTTP")
strLog = Fields.VarCleanMessageText 'This is a Kiwi variable for the content of the log message
ptrn = "ip (\d+\.\d+\.\d+\.\d+).*username (\w+).*hostname (.*) OS (.*)"
if InStr(strLog,"n/a")=0 then 'Will not run script if there is no username
'// Create the regular expression.
Set re = New RegExp
re.Pattern = ptrn
re.IgnoreCase = False
re.Global = True
'// Perform the search.
Set Matches = re.Execute(strLog)



'// Collect matches and assign the user and address to variables
set oMatch = Matches(0)
strUser = oMatch.subMatches(1)
strAddress = oMatch.subMatches(0)
strHost = oMatch.subMatches(2)
strOS = oMatch.subMatches(3)
'// Build the XML message
strXMLLine = "<uid-message><version>1.0</version><type>update</type><payload><login>"
strXMLLine = strXMLLine & "<entry name=""" & strDomain & "\" & strUser & """ ip=""" & strAddress & """/>"
if strKey="" then
strXMLLine = strXMLLine & "<hip-report><md5-sum>ae413e22b34a76366a542a1dd9b1108a</md5-sum><user-name>" & strUser & "</user-name><domain>" & strDomain & "</domain><host-name>"& strHost & "</host-name><ip-address>"& strAddress & "</ip-address><generate-time>" & Now & "</generate-time><categories><entry name=""" & "host-info" & """><client-version></client-version><os>" & strOs & "</os><os-vendor></os-vendor><domain></domain><host-name>android</host-name </entry></categories></hip-report>"
end if
strXMLLine = strXMLLine & "</login></payload></uid-message>"
'//
'// Post to the UID agent
'//
Const SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056
If strKey="" then 'Posting to software agent
'// Post data to Agent
sUrl = "https://" & strAgentServer & ":" & strAgentPort & "/"
On Error Resume Next
xmlHttp.open "put", sUrl, False
xmlhttp.setRequestHeader "Content-type", "text/xml"
xmlHttp.setOption 2, SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS
xmlHttp.send strXMLLine
xmlHttp.close



else 'posting to firewall agent
'//Post using REST API
sUrl = "https://" & strAgentServer & "/api/?type=user-id&action=set&key=" & strKey & "&cmd=" & strXMLLine
On Error Resume Next
xmlHttp.open "put", sUrl, False
xmlhttp.setRequestHeader "Content-type", "text/xml"
xmlHttp.setOption 2, SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS
xmlHttp.send
xmlHttp.close
end if
end if
Main="OK" 'return value for Kiwi
End Function