diff --git a/deployment-apps/ms_windows_ad_objects/app.manifest b/deployment-apps/ms_windows_ad_objects/app.manifest new file mode 100644 index 00000000..31b0a1d6 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/app.manifest @@ -0,0 +1,38 @@ +{ + "schemaVersion": "1.0.0", + "info": { + "title": "MS Windows AD Objects", + "id": { + "group": null, + "name": "ms_windows_ad_objects", + "version": "4.1.1" + }, + "author": [ + { + "name": "Steve Hogan", + "email": "shogan@splunk.com", + "company": "Splunk, Inc." + } + ], + "releaseDate": null, + "description": "Splunk Application to build and update AD Object Lookup Files using admon data collected from Splunk Universal Forwarders on a domain controller in the Active Directory environment.", + "classification": { + "intendedAudience": "IT", + "categories": [ + "IT Operations", + "Utilities", + "Security, Fraud & Compliance" + ], + "developmentStatus": "Production/Stable" + }, + "commonInformationModels": null, + "releaseNotes": { + "name": "README", + "text": "README.txt", + "uri": "https://splunkbase.splunk.com/app/3177/#/details" + } + }, + "dependencies": null, + "supportedDeployments": ["_standalone", "_distributed", "_search_head_clustering"], + "targetWorkloads": ["_search_heads"] +} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/addons/Indexes_conf_ex.zip b/deployment-apps/ms_windows_ad_objects/appserver/addons/Indexes_conf_ex.zip new file mode 100644 index 00000000..6863dad6 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/addons/Indexes_conf_ex.zip differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/addons/splunk_apps_cfg_winfra_exch.zip b/deployment-apps/ms_windows_ad_objects/appserver/addons/splunk_apps_cfg_winfra_exch.zip new file mode 100644 index 00000000..8328871c Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/addons/splunk_apps_cfg_winfra_exch.zip differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/app_arch_base_lookups.png b/deployment-apps/ms_windows_ad_objects/appserver/static/app_arch_base_lookups.png new file mode 100644 index 00000000..541bad28 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/app_arch_base_lookups.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/app_arch_option_a_admon.png b/deployment-apps/ms_windows_ad_objects/appserver/static/app_arch_option_a_admon.png new file mode 100644 index 00000000..361f9489 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/app_arch_option_a_admon.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/audit_report.js b/deployment-apps/ms_windows_ad_objects/appserver/static/audit_report.js new file mode 100644 index 00000000..b29137e6 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/audit_report.js @@ -0,0 +1,23 @@ +require.config({ + paths: { + "common": "../app/ms_windows_ad_objects/js/common", + "ms_windows_ad_objects": "../app/ms_windows_ad_objects/js/ms_windows_ad_objects", + }, +}); +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc/utils', + 'splunkjs/mvc', + "splunkjs/mvc/utils", + 'ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview', + "splunkjs/mvc/searchmanager", + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, utils, mvc, utils, LDAPRecordView, SearchManager) { + + var report = new LDAPRecordView({ + "id": "audit_report", + "managerid": "audit_query", + "el": $("#audit_report") + }).render(); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/basic_winfra_arch.png b/deployment-apps/ms_windows_ad_objects/appserver/static/basic_winfra_arch.png new file mode 100644 index 00000000..b8ff2ac5 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/basic_winfra_arch.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/basic_winfra_dc_arch.png b/deployment-apps/ms_windows_ad_objects/appserver/static/basic_winfra_dc_arch.png new file mode 100644 index 00000000..7ccf89dd Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/basic_winfra_dc_arch.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/coming-soon-icon.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/coming-soon-icon.jpg new file mode 100644 index 00000000..b788bc3e Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/coming-soon-icon.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/coming_soon_icon.png b/deployment-apps/ms_windows_ad_objects/appserver/static/coming_soon_icon.png new file mode 100644 index 00000000..fa66f21c Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/coming_soon_icon.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/components/ms_ad_obj_modal/ms_ad_obj_modal_popup.js b/deployment-apps/ms_windows_ad_objects/appserver/static/components/ms_ad_obj_modal/ms_ad_obj_modal_popup.js new file mode 100644 index 00000000..4bcc84ea --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/components/ms_ad_obj_modal/ms_ad_obj_modal_popup.js @@ -0,0 +1,69 @@ +define([ + 'underscore', + 'backbone', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/simplexml/element/table' + ], function(_, Backbone, $, mvc, TableElement) { + var ms_ad_obj_modal_template = "
" + + "

<%- title %>

" + + "

" + + "
Subject: <%- prev_ms_ad_obj_modal_subject %>

" + + "

Message Content:

" + + "
" + + "
" + + "
" + + "
" + + "
"; + var ms_ad_obj_modal_template_o = "
" + + "<%- t_inner_html %>" + + "
" + + "
"; + var submittedTokens = mvc.Components.get('submitted'); + var defaultTokens = mvc.Components.get('default'); + var url_em_body_msg= "" + var ms_ad_obj_modal_preview = Backbone.View.extend({ + defaults: { + title: 'Not set' + }, + initialize: function(options) { + this.options = options; + this.options = _.extend({}, this.defaults, this.options); + this.childViews = []; + this.template = _.template(ms_ad_obj_modal_template_o); + }, + events: { + 'click .close': 'close', + 'click .close_btn': 'close', + 'click .modal-backdrop': 'close' + }, + render: function() { + var data = { title : this.options.t_title,t_inner_html : this.options.t_inner_p_html}; + var msg_p="
" + this.options.t_inner_p_html + "
" + this.$el.html(msg_p); + return this; + }, + show: function() { + $(document.body).append(this.render().el); + //width:'80%', + $(this.el).find('.prev_ms_ad_obj_modal').css({ + 'max-width': '90%', + width:'70%', + height:'auto', + left: '15%', + 'margin-left': '0', + 'max-height':'90%', + overflow: 'none' + }); + }, + close: function() { + this.unbind(); + this.remove(); + _.each(this.childViews, function(childView) { + childView.unbind(); + childView.remove(); + }); + } + }); + return ms_ad_obj_modal_preview; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/customized_chart_preload.js b/deployment-apps/ms_windows_ad_objects/appserver/static/customized_chart_preload.js new file mode 100644 index 00000000..106ca5f4 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/customized_chart_preload.js @@ -0,0 +1,10 @@ +require.config({ + paths: { + "app": "../app" + } +}); +require(['splunkjs/mvc/simplexml/ready!'], function(){ + require(['splunkjs/ready!'], function(){ + + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/dashboard.css b/deployment-apps/ms_windows_ad_objects/appserver/static/dashboard.css new file mode 100644 index 00000000..1f4b41aa --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/dashboard.css @@ -0,0 +1,14 @@ +.app-bar.shared-appbar .nav-pills>li>a{ + color: black; + } + + .btn_build { + background-color: #4CAF50; /* Green */ + border: 2px solid #555555; /* Green */ + color: white; + border-radius: 4px; +} + + .btn_build:hover { + box-shadow: 0 12px 16px 0 rgba(0,0,0,0.24), 0 17px 50px 0 rgba(0,0,0,0.19); +} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/dashboard.js b/deployment-apps/ms_windows_ad_objects/appserver/static/dashboard.js new file mode 100644 index 00000000..a0e9b127 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/dashboard.js @@ -0,0 +1,155 @@ +(function() { + require([ + 'underscore', + 'backbone', + 'splunkjs/mvc', + '../app/ms_windows_ad_objects/components/ms_ad_obj_modal/ms_ad_obj_modal_popup', + 'splunkjs/mvc/simplexml/ready!' + ], function(_, Backbone, mvc, ms_ad_obj_modal_preview) { + $(document).ready(function () { + function setToken(name, value) { + var defaultTokenModel = mvc.Components.get('default'); + if (defaultTokenModel) { + defaultTokenModel.set(name, value); + } + var submittedTokenModel = mvc.Components.get('submitted'); + if (submittedTokenModel) { + submittedTokenModel.set(name, value); + } + } + var defaultTokenModel = mvc.Components.get("default"); + var submittedTokenModel = mvc.Components.get("submitted"); + defaultTokenModel.on("change:set_dyn_object_embed_val", function(e) { + //Hide the html content whenever a new one is selected // + $("#content_obj").hide(); + $("#content_obj_title").hide(); + $("#dyn_pan_content_obj").hide(); + //Get the updated tokens for the object content + var object_set_val = defaultTokenModel.get("set_dyn_object_embed_val"); + var object_show_flag = defaultTokenModel.get("tok_show_object_flag"); + //If token (tok_show_object_flag) is True then add the html object to the #content_obj html id Otherwise show default if used + if(object_show_flag==="True") { + setToken("tok_object_src", object_set_val) + var addDObjView = ''+ + '

Click Here to open video or document in a seperate browser window.

' + $("#content_obj").html(addDObjView) + $("#main_content_obj").show(); + $("#content_obj").show(); + $("#content_obj_title").show(); + $("#dyn_pan_content_obj").show(); + } else { + setToken("tok_show_object_flag", undefined); + setToken("tok_show_obj_default", "True"); + }; + }); + $('.dashboard-body').on("click", '[data-t-mod-id]', function (ms_ad_obj_modal_pop) { + var target = $(ms_ad_obj_modal_pop.currentTarget); + t_modal = target.data('t-mod-id'); + var t_m_obj=document.getElementById(t_modal); + var t_obj_i_html=t_m_obj.innerHTML + var prev_ms_ad_obj_modal = new ms_ad_obj_modal_preview({ t_title: t_modal,t_inner_p_html: t_obj_i_html}); + prev_ms_ad_obj_modal.show(); + }); + var defaultTokenModel = mvc.Components.get("default"); + var submittedTokenModel = mvc.Components.get("submitted"); + var items_icon_array = defaultTokenModel.get("tok_dash_mod_icons"); + if(items_icon_array) { + var items_icon_array_set = items_icon_array.split(","); + for(var i = 0; i <= items_icon_array_set.length; i++) { + var item_src = items_icon_array_set[i] + + if(item_src !== undefined,item_src){ + console.log("item_src",item_src) + var item_src_array = item_src.split(":") + var mod_trigger_m_id = item_src_array[0]; + var mod_trigger_h_id = '#'+mod_trigger_m_id + var mod_trigger_icon = item_src_array[1]; + var mod_link_label = '#'+mod_trigger_h_id + ' label:first-child' + var w_mod_input_trigger = '' + $(mod_trigger_h_id).find("label:first-child").prepend(w_mod_input_trigger) + } + } + } + + + $('.dashboard-body').on("click", '[data-ms-ad-obj-obj-type],[data-ms-ad-obj-obj-used],[data-ms-ad-obj-obj-title],[data-ms-ad-obj-obj-src],[data-ms-ad-obj-obj-refresh]', function (ms_ad_obj_obj_set) { + var target = $(ms_ad_obj_obj_set.currentTarget); + var object_used = target.data('ms-ad-obj-obj-used'); + var object_type = target.data('ms-ad-obj-obj-type'); + var object_h_id = "#content_"+object_type + var object_h_dyn_id = "#content_dyn_"+object_type + var object_title = target.data('ms-ad-obj-obj-title'); + var object_src = target.data('ms-ad-obj-obj-src'); + var object_refresh = target.data('ms-ad-obj-obj-refresh'); + $("#content_f_object").hide(); + $("#content_dyn_f_object").hide(); + $("#content_dyn_f_title").hide(); + $("#content_vid_object").hide(); + $("#content_view_object").hide(); + $("#content_srch_object").hide(); + $("#content_dash_object").hide(); + $("#content_rpt_object").hide(); + $(object_h_id).show() + $(object_h_dyn_id).attr("src",object_src); + $(object_h_dyn_id).show() + var object_w_title='

'+object_title+'

' + if(object_used==="True") { + $("#pan_right_f").show(); + $("#h_r_f_object").show(); + if(object_title==="none"){ + $("#content_dyn_f_title").hide(); + } else { + $("#content_dyn_f_title").show(); + } + $("#pan_right_p_o").hide(); + } else { + //Hide the html content whenever a new one is selected // + if(object_type==="Hide_Object_Show_Page"){ + $("#pan_right_p_o").show(); + $("#h_r_n_page").show(); + $("#h_r_n_page .panel-body.html").show(); + $("#pan_right_f").hide(); + $("#h_r_f_object").hide(); + } else { + $("#pan_right_p_o").hide(); + $("#h_r_n_page").hide(); + $("#h_r_n_page .panel-body.html").hide(); + $("#pan_right_f").hide(); + $("#h_r_f_object").hide(); + } + }; + }); + $('.dashboard-body').on('click', '[data-set-token],[data-unset-token],[data-token-json]', function(e) { + e.preventDefault(); + var target = $(e.currentTarget); + var setTokenName = target.data('set-token'); + if (setTokenName) { + setToken(setTokenName, target.data('value')); + } + var unsetTokenName = target.data('unset-token'); + if (unsetTokenName) { + setToken(unsetTokenName, undefined); + } + var tokenJson = target.data('token-json'); + if (tokenJson) { + try { + if (_.isObject(tokenJson)) { + _(tokenJson).each(function(value, key) { + if (value == null ) { + // Unset the token + setToken(key, undefined); + } else if (value =='undefined') { + setToken(key, undefined); + } else { + setToken(key, value); + } + }); + } + } catch (e) { + console.warn('Cannot parse token JSON: ', e); + } + } + }); + }); + }); +}).call(this); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ex_win_ta/ms_ad_obj_ta_acl.zip b/deployment-apps/ms_windows_ad_objects/appserver/static/ex_win_ta/ms_ad_obj_ta_acl.zip new file mode 100644 index 00000000..23a55a8e Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/ex_win_ta/ms_ad_obj_ta_acl.zip differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ex_win_ta/ms_ad_obj_ta_examples.zip b/deployment-apps/ms_windows_ad_objects/appserver/static/ex_win_ta/ms_ad_obj_ta_examples.zip new file mode 100644 index 00000000..cfefa78e Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/ex_win_ta/ms_ad_obj_ta_examples.zip differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_activedirectory.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_activedirectory.png new file mode 100644 index 00000000..c2065e5a Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_activedirectory.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_app_download.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_app_download.png new file mode 100644 index 00000000..625ff702 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_app_download.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_check.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_check.png new file mode 100644 index 00000000..67146802 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_check.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_cloud_warning.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_cloud_warning.png new file mode 100644 index 00000000..c448610e Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_cloud_warning.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_consolidate.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_consolidate.png new file mode 100644 index 00000000..d6dbf002 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_consolidate.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_custom_input.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_custom_input.png new file mode 100644 index 00000000..2fc0941d Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_custom_input.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_desktop.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_desktop.png new file mode 100644 index 00000000..fa7c2a9d Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_desktop.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_edit_input.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_edit_input.png new file mode 100644 index 00000000..80e2bb0d Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_edit_input.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder.png new file mode 100644 index 00000000..9b7e787a Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder_src.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder_src.png new file mode 100644 index 00000000..68b181ca Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder_src.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder_tgt.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder_tgt.png new file mode 100644 index 00000000..64909a58 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_folder_tgt.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_gear.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_gear.png new file mode 100644 index 00000000..6584bb86 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_gear.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_inputs_conf_src.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_inputs_conf_src.png new file mode 100644 index 00000000..6758d12c Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_inputs_conf_src.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_inputs_conf_tgt.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_inputs_conf_tgt.png new file mode 100644 index 00000000..56a9b83d Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_inputs_conf_tgt.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_log_mgmt.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_log_mgmt.png new file mode 100644 index 00000000..349750bc Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_log_mgmt.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_op_inteligent.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_op_inteligent.png new file mode 100644 index 00000000..300cd78a Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_op_inteligent.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_os_app.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_os_app.png new file mode 100644 index 00000000..868e05f6 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_os_app.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_os_folder.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_os_folder.png new file mode 100644 index 00000000..9b7e787a Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_os_folder.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_pre_check.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_pre_check.png new file mode 100644 index 00000000..2e68d758 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_pre_check.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_priority_list.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_priority_list.png new file mode 100644 index 00000000..ffaa31e0 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_priority_list.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_priority_sec_list.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_priority_sec_list.png new file mode 100644 index 00000000..c9686641 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_priority_sec_list.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_script.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_script.png new file mode 100644 index 00000000..4d3cbb5b Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_script.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_security_compliance.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_security_compliance.png new file mode 100644 index 00000000..aadbe6d5 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_security_compliance.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_server_db.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_server_db.png new file mode 100644 index 00000000..dae378de Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_server_db.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_app_addons.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_app_addons.png new file mode 100644 index 00000000..374d08be Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_app_addons.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_app_mgmt.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_app_mgmt.png new file mode 100644 index 00000000..abeffac8 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_app_mgmt.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_cloud.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_cloud.png new file mode 100644 index 00000000..203be458 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_cloud.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_cloud_hybrid.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_cloud_hybrid.png new file mode 100644 index 00000000..9f653306 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_cloud_hybrid.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_data_model.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_data_model.png new file mode 100644 index 00000000..75ec2e3a Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_data_model.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_enterprise.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_enterprise.png new file mode 100644 index 00000000..4930bf4f Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_enterprise.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_forwarder.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_forwarder.png new file mode 100644 index 00000000..3d018d04 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_forwarder.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_indexer.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_indexer.png new file mode 100644 index 00000000..05d2a579 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_indexer.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_sbase.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_sbase.png new file mode 100644 index 00000000..0f7ee72d Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_sbase.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_search_head.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_search_head.png new file mode 100644 index 00000000..0b71afb3 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_splk_search_head.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_stop.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_stop.png new file mode 100644 index 00000000..652d0f31 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_stop.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_user_check.png b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_user_check.png new file mode 100644 index 00000000..6a19f1f7 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/icons/icon_user_check.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_apple-icon.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_apple-icon.png new file mode 100644 index 00000000..a3fe84dd Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_apple-icon.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_cantvalidate.gif b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_cantvalidate.gif new file mode 100644 index 00000000..70cefa95 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_cantvalidate.gif differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_gap.gif b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_gap.gif new file mode 100644 index 00000000..e72322e9 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_gap.gif differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_tampered.gif b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_tampered.gif new file mode 100644 index 00000000..f066465c Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_tampered.gif differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_valid.gif b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_valid.gif new file mode 100644 index 00000000..fe9c3067 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_audit_valid.gif differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_cloud_idx_wineventlog.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_cloud_idx_wineventlog.png new file mode 100644 index 00000000..efc5105a Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_cloud_idx_wineventlog.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_ent_idx_wineventlog.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_ent_idx_wineventlog.png new file mode 100644 index 00000000..c1df938e Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_ent_idx_wineventlog.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_icon-link-sm.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_icon-link-sm.png new file mode 100644 index 00000000..709fd711 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_icon-link-sm.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_icon-success-sm.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_icon-success-sm.png new file mode 100644 index 00000000..58bfadaf Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_icon-success-sm.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_iosicon.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_iosicon.png new file mode 100644 index 00000000..6768336c Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_iosicon.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_1.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_1.jpg new file mode 100644 index 00000000..60486ca9 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_1.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_1.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_1.png new file mode 100644 index 00000000..7dc5c926 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_1.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_2.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_2.jpg new file mode 100644 index 00000000..5f32a374 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_2.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_2.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_2.png new file mode 100644 index 00000000..1145e56a Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_2.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_3.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_3.jpg new file mode 100644 index 00000000..7de00f6d Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_3.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_3.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_3.png new file mode 100644 index 00000000..503981d9 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_3.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_4.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_4.jpg new file mode 100644 index 00000000..483662d5 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_4.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_4.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_4.png new file mode 100644 index 00000000..6985b971 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_4.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_5.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_5.jpg new file mode 100644 index 00000000..cc771fad Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_5.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_5.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_5.png new file mode 100644 index 00000000..4c3a3d7f Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_5.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_6.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_6.jpg new file mode 100644 index 00000000..ae0bea43 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_6.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_6.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_6.png new file mode 100644 index 00000000..294ea344 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_6.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_7.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_7.jpg new file mode 100644 index 00000000..8b305f98 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_7.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_7.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_7.png new file mode 100644 index 00000000..d06eac50 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_ent_inst_7.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_1.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_1.jpg new file mode 100644 index 00000000..952ce6ef Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_1.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_1.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_1.png new file mode 100644 index 00000000..d12df634 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_1.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_2_cloud.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_2_cloud.png new file mode 100644 index 00000000..682de9d1 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_2_cloud.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_3_cloud.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_3_cloud.png new file mode 100644 index 00000000..3f1e7a9f Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_3_cloud.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_4_cloud.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_4_cloud.png new file mode 100644 index 00000000..eb6d4ef6 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_ds_inst_4_cloud.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cloud_0.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cloud_0.png new file mode 100644 index 00000000..75583ef5 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cloud_0.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_1_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_1_both.png new file mode 100644 index 00000000..9b471e35 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_1_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_2_ent.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_2_ent.png new file mode 100644 index 00000000..4ce7d8b6 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_2_ent.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_3_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_3_both.png new file mode 100644 index 00000000..569e6fbf Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_3_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_4_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_4_both.png new file mode 100644 index 00000000..30a835af Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_4_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_5_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_5_both.png new file mode 100644 index 00000000..74a3829e Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_5_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_6_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_6_both.png new file mode 100644 index 00000000..211b5f51 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_6_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_7_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_7_both.png new file mode 100644 index 00000000..db553655 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_7_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_8_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_8_both.png new file mode 100644 index 00000000..5a7b74c3 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_8_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_9_both.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_9_both.png new file mode 100644 index 00000000..0316c7b3 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_cust_9_both.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_ent_0.png b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_ent_0.png new file mode 100644 index 00000000..7ad21c4d Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_ad_obj_win_uf_ent_0.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_windows_ad_objects_icon.jpg b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_windows_ad_objects_icon.jpg new file mode 100644 index 00000000..01624332 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/img/ms_windows_ad_objects_icon.jpg differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/info_pages/init_build/init_build_dom_warn.html b/deployment-apps/ms_windows_ad_objects/appserver/static/info_pages/init_build/init_build_dom_warn.html new file mode 100644 index 00000000..040b8b00 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/info_pages/init_build/init_build_dom_warn.html @@ -0,0 +1,328 @@ +
+

Warning: Missing Required Data Needed to build the AD Object Lookups

+

The MS Windows AD Objects application can not complete the configuration because required data is missing. Review the below troubleshooting steps to resolve the issue.

+
+ + + + + + + + +
+
+

Missing Active Directory Domain Details - Troubleshooting Steps

+

In order to build the AD Object Lookups leveraged by this application, AD Domain details need to be either collected or manually entered. Below are the two options for either collecting the data used to automatically gather the AD Domain information or Manually Entering this data.

+
+
+ + Option 1: Auto Build using Collected ActiveDirectory Topology data: + +
+
+
+ + + + +
+
+ + + + +
+
+

Follow the below troubleshooting Steps for resolving the issue of missing the required Domain Health data

+ + + + + + + +
+
    +
  • Make Sure that atleast one (Depends on Windows OS Version) of the following inputs is enabled on the Active Directory Domain Controllers:
    • +
  • If you renamed the Splunk pre-configured TA that was provided by the MS Windows AD Objects application (Splunk_TA_windows_dc), or you are using a different TA to collect the sourcetype=MSAD:NT6:Health data, then make sure you have updated the [powershell://AD-Health] input with the updated TA name for the script setting.
    • +
+
+ +
    +
  1. Login to one of your AD Domain Controllers
    2. +
  2. Open File Explorer and navigate to ...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_dc\local directory.
    3. +
  3. Running Wordpad in "RunAs Administrator" mode, open the inputs.conf file.
    4. +
  4. Search for the [script://.\bin\runpowershell.cmd nt6-health.ps1] input stanza
    +
      +
    • +
      The MSAD Health data inputs are dependent on the Windows Version. See the below input settings to determine which one needs to be enabled: +
        +
      • Health and Topology Information Windows (Version 2008):
        + 
        +			[script://.\bin\runpowershell.cmd nt6-health.ps1]
+			source=Powershell
+			sourcetype=MSAD:NT6:Health
+			interval=300
+			disabled=0
+			index=msad
        +
        • +
      • >Or Health and Topology Information Windows (Version 2012r2 and 2016 +):
        + 
        +			[powershell://AD-Health]
+			script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1"
+			schedule = 0 */5 * ? * *
+			source=Powershell
+			sourcetype=MSAD:NT6:Health
+			disabled=0
+			index=msad
        +
        • +
      +
      +
      • +
    +
    5. +
  5. Make sure the disabled setting is set to disabled = 0 for input that matches your Windows Version
    6. +
  6. Also, double check that the index setting matches the index that you created for your AD Data
    7. +
  7. Last check, if you are using a different name then Splunk_TA_windows_dc then you will need to update the script setting, (script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1" to the name you are using for the TA's folder.
    8. +
  8. If you made any changes then Restart the Splunk Forwarder Service
    9. +
+ + +
    +
  1. Login to one of your Splunk Deployment Server
    2. +
  2. Using terminal or File Explorer and navigate to ...\Splunk\etc\deployment-apps\Splunk_TA_windows_dc\local directory.
    3. +
  3. Open the inputs.conf file.
    4. +
  4. +
    Search for the [script://.\bin\runpowershell.cmd nt6-health.ps1] input stanza
    +
      +
    • +
      The MSAD Health data inputs are dependent on the Windows Version. See the below input settings to determine which one needs to be enabled: +
        +
      • Health and Topology Information Windows (Version 2008):
        + 
        +			[script://.\bin\runpowershell.cmd nt6-health.ps1]
+			source=Powershell
+			sourcetype=MSAD:NT6:Health
+			interval=300
+			disabled=0
+			index=msad
        +
        • +
      • >Or Health and Topology Information Windows (Version 2012r2 and 2016 +):
        + 
        +			[powershell://AD-Health]
+			script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1"
+			schedule = 0 */5 * ? * *
+			source=Powershell
+			sourcetype=MSAD:NT6:Health
+			disabled=0
+			index=msad
        +
        • +
      +
      +
      • +
    +
    5. +
  5. Make sure the disabled setting is set to disabled = 0 for input that matches your Windows Version
    6. +
  6. Also, doublecheck that the index setting matches the index that you created for your AD Data
    7. +
  7. Last check, if you are using a different name then Splunk_TA_windows_dc then you will need to update the script setting, (script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1" to the name you are using for the TA's folder.
    8. +
  8. If you made any changes then open a command line/terminal and navigate to ...\Splunk\bin\ directory and run the following command: + 
    splunk reload deploy-server
    +
    9. +
+ +
+
+
+
+
+
+
+
+
+
+ + Option 2: Manually enter AD Domain Details: + +
+
+ + + + +
+
+ + + + +
+
+

Follow the below troubleshooting Steps for manually entering in the required Active Directory Domain details into the AD_Obj_Domain lookup table.

+ + + + +
+ +
    +
  1. Click Open Add Domain Form to open the manual Domain Input form below.
    2. +
  2. Enter the AD Details into all of the input fields. +
      +
    • DC Host Name: This is the name of one of the AD Domain Controllers for the Domain.
      • +
    • Forest FQDN:This is the Root level Fully Qualified Name. (Ex: testdemo.local)
      • +
    • Domain FQDN:This is the Domain level Fully Qualified Name. (Ex: contoso.testdemo.local)
      • +
    • Domain NetBIOSName:This is NetBIOSName for the Domain. A Simple example is when a user logs in; for example a user logs in with Contoso\joe_user, the NetBIOSName is Contoso
      • +
    • Domain Site Name:This is the Site Name for the AD Domain. (Ex: Default-First-Site-Name)
      • +
    +
    +
    3. +
  3. Click the Add Above Values button after entering in the required values for the individual AD Domain.
    4. +
  4. Repeat the Steps for each Active Directory Domain.
    5. +
  5. After Entering in All of the required values for All of your target Active Directory Domains click the Rerun Check button below to open the Lookup Builder table. + +
    6. +
+ +
+
+
+
+
+
+
+
+
+
+

Missing Active Directory admon Sync data - Troubleshooting Steps

+

To ensure that all of the Active Directory Objects are collected, and not just the Updated, Created, or Deleted ones, admon baseline data needs to be collected.

This troubleshooting step is shown because admon "Sync" data was not found in the last 30days. Follow the below steps to either adjust the time period to search for the sourcetype="ActiveDirectory" admonEventType="Sync" data, or to update/verify the [admon://default] input enabled on one of your AD Domain Controllers.

+
+
+ + First: Get Last Sync Time and Update Time Period Selection: + +
+
+ + + + +
+
+ + + + +
+

Use the Sync Time Helper +

    +
  • + Retrieve the latest admon Sync Event Time: +
      +
    1. Click Use Sync Time Helper
      .
      2. +
    2. It is important that you get the last time the admon baseline was collected, to ensure that all of the AD Objects (User/Group/Computer/OU/GPO) are added to the lookup.
      3. +
    3. Set the TimeSelector Date Range - - Begin From - - Date Value with value in the Recommended_Sync_Start_Day Column and set the End Date for today.
      4. +
    +
    • +
  • Follow the Option 2: Steps below for verifying or updating the admon input.
    • +
+

+
    +
  • +
    + If you have a large AD Object count environment, and the building process is taking too long, it is recommended follow the steps outlined in the Steps for Recollecting admon Base Line Data to recollect the "Baseline" admon data for the individual Splunk Forwarder that is collecting admon data. +
    +
    • +
  • This will allow you to select a shorter time range for picking up the Sync data used to build the Lookups.
    • +
+
+ + + + + + + + + + + + + + + + +

Time Helper Results

Message:$tok_time_helper_msg$
First Time for Sync Data:$tok_time_helper_f_time$
Last Time for Sync Data:$tok_time_helper_l_time$
+
+
+
+
+
+
+
+
+ + Second: Verify/Update admon input: + +
+
+ + + + +
+
    +
  • + After performing the below steps, Wait about 15 - 30m, depending on the size and Domain count, before clicking the Rerun Autocheck button. +
    • +
+
+ + + + + + + +
+

The below steps walk through the quick process of recollecting the required: admon baseline data.

+
    +
  • The admon baseline data is Only collected the first time the input is enabled.
    • +
  • Make sure you do not have the [admon://....] data input enabled in any of the other TA's or in the \etc\apps\SplunkUniversalForwarder\local\inputs.conf. It should only be enabled in one place, otherwise the baseline setting could possible be overridden.
    • +
+
+
    +
  1. Login to the AD Domain Controller you deployed the Splunk_TA_windows_admon TA too.
    2. +
  2. Stop the Splunk Forwarder Service
    3. +
  3. Open File Explorer and navigate to ...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_admon\local directory.
    4. +
  4. Running Wordpad in "RunAs Administrator" mode, open the inputs.conf file.
    5. +
  5. Verify that the [admon:\\default] input is enabled. See the below example: + 
    +	[admon://default]
+	disabled = 0
+	monitorSubtree = 1
+	baseline = 1
+	index=msad
    +
    6. +
  6. If it wasn't enabled, then enable it (ie. disabled = 0) and save the changes.
    7. +
  7. Navigate into the ...\SplunkUniversalForwarder\var\lib\splunk\persistentstorage\ADMon\ directory.
    8. +
  8. Delete the default.ini file.
    +
      +
    • If you see more than one file then you must have admon input enabled in either ...\SplunkUniversalForwarder\etc\system\local or in one of the applications under ...\SplunkUniversalForwarder\etc\apps directory.
      • +
    • You can also run the command splunk cmd btool inputs list admon://default --debug from a command line, where you are executing from the ...\SplunkUniversalForwarder\bin directory.
      • +
    • Once you find where it is enabled, then delete the complete [admon:\\...] input stanza from that location.
      • +
    +
    9. +
  9. Start the Splunk Forwarder Service
    10. +
+
+
+
+
+
+
+
+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/Class.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/Class.js new file mode 100644 index 00000000..15ea764d --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/Class.js @@ -0,0 +1,29 @@ +/* + * Class is an abstraction to define classes and inheritance based on the + * classes. It is a lightweight prototype chaining based inheritance abstraction. + * + * It is highly recommended to keep this implementation as simple as possible + * and only use classes in our apps when there is a demand for it. In regular + * cases use the conventional JS methodology. Examples for necessary conditions + * for using classes are: UnitTestBase class that all unit tests could extend from, + * generic classes like SyncTaskRunner that are implementation that may be extended + * for specific implementations in different scenarios, when multiple instances of an + * are to be created for a use case like two SyncTaskQueues. + */ + +define(function() { + var Class = { + makeClass: function(classFn) { + return classFn.prototype; + }, + + makeInheritedClass: function(baseClass, subClassFn) { + subClassFn.prototype = new baseClass(); + subClassFn.prototype.constructor = subClassFn; + + return subClassFn.prototype; + } + }; + + return Class; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/PageMessagesView.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/PageMessagesView.js new file mode 100644 index 00000000..b6df2150 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/PageMessagesView.js @@ -0,0 +1,66 @@ +/* + * The PageMessagesView is a wrapper to display errors on a page + */ + +define([ + 'jquery', + 'underscore', + 'common/Class' + ], + function( + $, + _, + Class + ) { + + var PageMessagesView = function(pageSel) { + this._pageSel = pageSel; + this._messagesPaneSel = this._pageSel + ' #page-messages-view'; + }; + + var PageMessagesViewClass = Class.makeClass(PageMessagesView); + + PageMessagesViewClass.addMessage = function(message, messageType, messageId) { + if (!$(this._messagesPaneSel).length) { + $(this._pageSel).prepend(' \ +
\ +
' + ); + } + + $(this._messagesPaneSel).show(); + + if (_.isUndefined(messageType) || _.isNull(messageType)) { + messageType = PageMessagesViewClass.InfoMessageType; + } + + var messageIdPart = !_.isUndefined(messageId) && !_.isNull(messageId) ? + 'id="' + messageId + '"' : ''; + + $(this._messagesPaneSel).append(' \ +
\ + \ +

' + message + '

\ +
' + ); + return this; + }; + + PageMessagesViewClass.clearMessage = function(messageId) { + $(this._messagesPaneSel).find('#' + messageId).remove(); + return this; + }; + + PageMessagesViewClass.clearAllMessages = function() { + $(this._messagesPaneSel).hide(); + $(this._messagesPaneSel).empty(); + return this; + }; + + PageMessagesViewClass.InfoMessageType = 'alert-info'; + PageMessagesViewClass.WarningMessageType = 'alert-warning'; + PageMessagesViewClass.ErrorMessageType = 'alert-error'; + + return PageMessagesView; +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/PropertyBag.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/PropertyBag.js new file mode 100644 index 00000000..f5681b9f --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/PropertyBag.js @@ -0,0 +1,67 @@ +/* + * This file implements a property bag that could be serialized for use at search + * time to construct a string representation of 'N' fields to extract and perform + * post search deserialization + */ + +define(['jquery', 'underscore', 'common/Class'], function($, _, Class) { + + var PropertyBag = function(searchFieldNames) { + if (_.isUndefined(searchFieldNames) || + _.isNull(searchFieldNames) || + !_.isArray(searchFieldNames)) { + throw('Invalid search fields list passed to PropertyBag'); + } + + // The names used here are passed into the search term in + // serializeSearchPhrase, so they must be the field names from search + this._propertyNames = searchFieldNames; + + this._separator = '|'; + } + + var PropertyBagClass = Class.makeClass(PropertyBag); + + PropertyBagClass.serializeToSearchPhrase = function() { + var that = this; + + // Serialize to format: prop1 . "|" . prop2 . "|" . prop3 + // The resulting search phrase could be used in a search command like + // eval as is to create the string representation of the concatenated fields + var searchPhrase = _.reduce( + this._propertyNames, + function(propertyName1, propertyName2) { + return propertyName1 + ' . "' + that._separator + '" . ' + propertyName2; + } + ); + + return searchPhrase; + } + + PropertyBagClass.deserialize = function(propertyValuesString) { + var that = this; + + if (_.isUndefined(propertyValuesString) || _.isNull(propertyValuesString)) { + return null; + } + + var propertyValues = propertyValuesString.split(this._separator); + + if (_.isArray(propertyValues) && + propertyValues.length == this._propertyNames.length) { + var propertyValuesDict = {}; + + _.each(propertyValues, function(propertyValue, index) { + propertyValuesDict[that._propertyNames[index]] = propertyValue; + }); + + return propertyValuesDict; + } else { + // Since inputs here come from search results, don't throw errors, + // just return null + return null; + } + } + + return PropertyBag; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchDataHelpers.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchDataHelpers.js new file mode 100644 index 00000000..49f33929 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchDataHelpers.js @@ -0,0 +1,86 @@ +/* + * This file contains helper methods that could be used in the app pages + * to manipulate data returned from searches + */ + +define(['jquery', 'underscore'], function($, _) { + var SearchDataHelpers = { + + /* + * Given a map of fields to html selectors (in fieldsToElSelsMap), search fields + * returned from running a search (in searchFields), a row returned in the result + * set of a search (in searchRow) and a html renderer function (in elRenderer) that + * does specific action to convert result from the search to the html selector + * specified element, this function extracts the values for the fields from the + * row and invokes the renderer resulting in the values from a search row + * being populated to different html elements + */ + populateSearchBasedFields: function(fieldsToElSelsMap, searchFields, searchRow, elRenderer) { + _.each(searchFields, function(fieldName, index) { + var elSel = fieldsToElSelsMap[fieldName]; + if (!_.isUndefined(elSel) && !_.isNull(elSel)) { + elRenderer(elSel, searchRow[index]); + } + }); + }, + + /* + * This is a specialization of populateSearchBasedFields to specifically + * extract and display search results as sparklines in the html elements + */ + populateSearchBasedSparklineFields: function(fieldsToSparklineSelsMap, searchFields, searchRow, sparklineSettings) { + this.populateSearchBasedFields( + fieldsToSparklineSelsMap, + searchFields, + searchRow, + function(sparklineSel, sparklineData) { + $(sparklineSel).empty(); + + var sparks = _.isArray(sparklineData) ? + _.map(sparklineData.slice(1), function(value) { + return (value && parseFloat(value)) || 0; + }) : []; + + $(sparklineSel).sparkline( + sparks, + sparklineSettings + ); + } + ); + }, + + /* + * This is a specialization of populateSearchBasedFields to specifically + * extract and display search results as texts in the html elements + */ + populateSearchBasedTextFields: function(fieldsToTextSelsMap, searchFields, searchRow) { + this.populateSearchBasedFields( + fieldsToTextSelsMap, + searchFields, + searchRow, + function(textSel, textValue) { + $(textSel).text(textValue); + } + ); + }, + + makeDisplayNameFromResultField: function(resultFieldName) { + // Convert all _ in field name to spaces + // Capitalize first character of each word part + var nameParts = resultFieldName.replace('_', ' ').split(' '); + + var displayNameParts = _.map(nameParts, function(namePart) { + if (/^[a-z]/.test(namePart)) { + var firstChar = namePart[0].toUpperCase(); + return firstChar + namePart.substr(1); + } else { + return namePart; + } + }); + + return displayNameParts.join(' '); + } + } + + return SearchDataHelpers; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchIconRenderer.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchIconRenderer.js new file mode 100644 index 00000000..ae40ddbb --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchIconRenderer.js @@ -0,0 +1,82 @@ +/* + * This file contains the code to add a search icon to launch a search in the + * Splunk Search app to any parent container + */ + +define([ + 'jquery', + 'underscore', + 'splunkjs/mvc', + 'splunkjs/mvc/searchmanager' + ], + function($, _, mvc, SearchManager) +{ + var SearchIconRenderer = { + /* + * The render function takes as input a parentContainer in which to + * add a search icon which wwhen clicked on would run the search specified + * in the searchManager passed in within the Splunk Search app. + */ + render: function(parentContainer, searchManager) { + if (_.isUndefined(searchManager) || _.isNull(searchManager) || + _.isUndefined(parentContainer) || _.isNull(parentContainer)) { + throw('SearchIconRenderer.render called with invalid arguments'); + } + + var $searchIcon = $('\ + \ + ') + .css({ + "padding": "0", + "height": "20px", + "line-height": "20px", + "width": "22px", + "font-size": "15px", + "text-align": "center" + }) + .appendTo(parentContainer) + .off('click') + .click(function() { + var parentSearchId = searchManager.get('managerid'); + var sid = null; + if (!_.isUndefined(searchManager.job) && !_.isNull(searchManager.job)) { + sid = searchManager.job.sid; + } + var earliest = searchManager.get('earliest_time'); + var latest = searchManager.get('latest_time'); + var query = (searchManager.settings || searchManager.query).get('search'); + + // If it's a post process, we need the prefix query + if (parentSearchId) { + var parentSearch = mvc.Components.getInstance(parentSearchId); + query = (parentSearch.settings || parentSearch.query).get('search') + ' | ' + query; + } + + window.open( + "/app/ms_windows_ad_objects/search?" + + "sid=" + encodeURIComponent(sid) + "&" + + "q=" + encodeURIComponent(query) + "&" + + "earliest=" + encodeURIComponent(earliest) + "&" + + "latest=" + encodeURIComponent(latest) + ); + }) + .hide(); + + // It's already resolved if settings.search (splunk 6.1) or query.search (splunk 6.0) + var alreadyResolved = (searchManager.settings || searchManager.query).get('search'); + + // Inline searches that are already resolved by now AND saved searches should just show the icon + if (alreadyResolved) { + $searchIcon.show(); + } + + // listen for tokens to change to show/hide the search icon + // Otherwise the search icon will show when it's not actually tied to a valid search + (searchManager.settings || searchManager.query).on('change:search', function(settings, newSearch) { + $searchIcon[newSearch ? 'show' : 'hide'](); + }); + } + } + + return SearchIconRenderer; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchRunner.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchRunner.js new file mode 100644 index 00000000..eba11d98 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SearchRunner.js @@ -0,0 +1,154 @@ +/* + * The SearchRunner is a wrapper to run searches via the core search manager that + * encapsulates the event handlers to ensure search manager events are handled uniformly + */ + +define([ + 'jquery', + 'underscore', + 'common/Class', + 'splunkjs/mvc/searchmanager' + ], + function( + $, + _, + Class, + SearchManager + ) { + var SearchRunner = function( + searchManager, + resultsModel, + failureCallback, + successCallback, + startCallback, + progressCallback + ) { + this.checkValidProperty(searchManager); + this.checkValidProperty(failureCallback); + this.checkValidProperty(successCallback); + this.checkValidProperty(startCallback); + this.checkValidProperty(progressCallback); + + if (_.isUndefined(resultsModel) || _.isNull(resultsModel)) { + resultsModel = searchManager.data('preview', { + count: 0, + offset: 0 + }); + } + + this.checkValidProperty(resultsModel); + + this._searchManager = searchManager; + this._resultsModel = resultsModel; + this._failureCallback = failureCallback; + this._successCallback = successCallback; + this._startCallback = startCallback; + this._progressCallback = progressCallback; + } + + var SearchRunnerClass = Class.makeClass(SearchRunner); + + SearchRunnerClass.runSearch = function(deferRun) { + var that = this; + + this._searchManager.on( + "search:cancelled", + function() { + that._failureCallback( + 'The search got cancelled.' + + ' Search string is: "' + that._searchManager.settings.get('search') + '"' + ); + }, + this + ); + + this._searchManager.on( + "search:error", + function(message, error) { + var errorMessage = 'The search returned error "' + message + '".'; + + if (!_.isUndefined(error) && !_.isNull(error)) { + errorMessage += 'Detailed error: "' + error.error + + '(' + error.status + ') - ' + error.data.messages[0].text + '"'; + } + + that._failureCallback( + errorMessage + ' Search string is: "' + that._searchManager.settings.get('search') + '"' + ); + }, + this + ); + + this._searchManager.on( + "search:fail", + function(state, job) { + that._failureCallback( + 'The search failed with error "' + state.content.messages[0].text + '".' + + ' Search string is: "' + that._searchManager.settings.get('search') + '"' + ); + }, + this + ); + + this._searchManager.on( + "search:start", + function() { + that._startCallback(); + }, + this + ); + + this._searchManager.on( + "search:progress", + function(properties) { + that._progressCallback(properties.content.isDone, properties); + }, + this + ); + + this._searchManager.on( + "search:done", + function(properties) { + that._progressCallback(properties.content.isDone, properties); + }, + this + ); + + this._resultsModel.on( + "error", + function(message, error) { + var errorMessage = 'The search returned error "' + message + '".'; + + if (!_.isUndefined(error) && !_.isNull(error)) { + errorMessage += 'Detailed error: "' + error.error + + '(' + error.status + ') - ' + error.data.messages[0].text + '"'; + } + + that._failureCallback( + errorMessage + ' Search string is: "' + that._searchManager.settings.get('search') + '"' + ); + }, + this + ); + + this._resultsModel.on( + "data", + function() { + that._successCallback(this._resultsModel.data()); + }, + this + ); + + if (_.isUndefined(deferRun) || _.isNull(deferRun) || deferRun === true) { + this._searchManager.startSearch(); + } + } + + SearchRunnerClass.checkValidProperty = function(property) { + if (_.isUndefined(property) || _.isNull(property)) { + throw property + ' is invalid'; + } + } + + return SearchRunner; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/ShareButton.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/ShareButton.js new file mode 100644 index 00000000..078e4af9 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/ShareButton.js @@ -0,0 +1,48 @@ +/*global define */ +define(function(require, exports, module) { + var $ = require('jquery'); + var _ = require('underscore'); + var Backbone = require('backbone'); + + var shareTemplate = '
\ +
\ +
\ + \ + \ +
\ +
\ +

Copy the link to share this page

\ + \ + \ + \ +
\ +
\ + \ +
\ +
\ +
'; + + return Backbone.View.extend({ + id: 'share-modal', + className: 'modal fade', + + render: function() { + this.$el.attr('tabindex', '-1') + .attr('role', 'dialog') + .attr('aria-labelledby', 'share-modal-title') + .attr('aria-hidden', 'true') + .css('display', 'none'); + this.$el.html(shareTemplate); + this.$el.on('shown.bs.modal', function(){ + this.$('#share-modal-text-field').select(); + }); + return this; + }, + + show: function() { + this.$('#share-modal-text-field').val(document.URL); + this.$('#share-modal-link').attr('href', document.URL); + this.$el.modal('show'); + } + }); +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SyncTaskQueue.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SyncTaskQueue.js new file mode 100644 index 00000000..d54bced0 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SyncTaskQueue.js @@ -0,0 +1,68 @@ +/* + * The SyncTaskQueue is a task serializer queue to enable queueing tasks to be run + * synchronously. + */ + +define([ + 'jquery', + 'underscore', + 'common/Class', + 'common/SyncTaskRunner' + ], + function( + $, + _, + Class, + SyncTaskRunner + ) { + var SyncTaskQueue = function() { + var that = this; + + this._taskQueue = []; + this._currentTask = null; + + this._waitHandle = setInterval( + function() { + if ( + (_.isNull(that._currentTask) || that._currentTask.hasCompleted()) && + that._taskQueue.length > 0 + ) { + that._currentTask = that._taskQueue.shift(); + that._currentTask.start(); + } + }, + 200 + ); + } + + var SyncTaskQueueClass = Class.makeClass(SyncTaskQueue); + + /* + * taskLabel - a label for the task to enqueue + * taskFn - the function to execute for the task + * the signature for the function is: + * function(taskRunner, ) + * taskFnArgs - array of arguments to the task. Note that this array will + * not contain the taskRunner but the rest of the arguments + * specific to the function + * timeout - optional timeout for the task in ms + * timeoutFn - a timeout handler with the signature + * function() + * timeoutFnArgs - array of arguments to the timeout handler + */ + SyncTaskQueueClass.enqueue = function( + taskLabel, + taskFn, + taskFnArgs, + timeout, + timeoutFn, + timeoutFnArgs + ) { + this._taskQueue.push( + new SyncTaskRunner(taskLabel, taskFn, taskFnArgs, timeout, timeoutFn, timeoutFnArgs) + ); + } + + return SyncTaskQueue; +}); + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SyncTaskRunner.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SyncTaskRunner.js new file mode 100644 index 00000000..270285ae --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/SyncTaskRunner.js @@ -0,0 +1,116 @@ +/* + * The SyncTaskRunner is a task serializer to enable running tasks synchronously. + * It takes as input a function to run a task, executes it and waits for completion. + * The SyncTaskRunner defines a markCompleted function to call back into to indicate + * task completion. + */ + +define([ + 'jquery', + 'underscore', + 'common/Class' + ], + function( + $, + _, + Class + ) { + /* + * taskLabel - a label for the task to enqueue + * taskFn - the function to execute for the task + * the signature for the function is: + * function(taskRunner, ) + * taskFnArgs - array of arguments to the task. Note that this array will + * not contain the taskRunner but the rest of the arguments + * specific to the function + * timeout - optional timeout for the task in ms + * timeoutFn - a timeout handler with the signature + * function() + * timeoutFnArgs - array of arguments to the timeout handler + */ + var SyncTaskRunner = function( + taskLabel, + taskFn, + taskFnArgs, + timeout /* in ms */, + timeoutFn, + timeoutFnArgs + ) { + this._taskCompleted = false; + + if (_.isUndefined(taskFn) || _.isNull(taskFn) || !_.isFunction(taskFn)) { + throw('Invalid task passed to SyncTaskRunner'); + } else { + this._taskFn = taskFn; + + this._taskFnArgs = taskFnArgs; + // First argument to the function is the runner so it could invoke markCompleted + this._taskFnArgs.unshift(this); + + this._taskLabel = taskLabel; + } + + if (_.isUndefined(timeout) || _.isNull(timeout)) { + this._timeout = 600000; // 10 minutes in ms + } else { + if (_.isNumber(timeout)) { + this._timeout = timeout; + } else { + throw('Invalid timeout passed to SyncTaskRunner. Please specify a number in ms'); + } + } + + if (_.isUndefined(timeoutFn) || _.isNull(timeoutFn) || !_.isFunction(timeoutFn)) { + throw('Invalid timeout handler passed to SyncTaskRunner'); + } else { + this._timeoutFn = timeoutFn; + this._timeoutFnArgs = timeoutFnArgs; + } + + this._waitHandle = null; + } + + var SyncTaskRunnerClass = Class.makeClass(SyncTaskRunner); + + SyncTaskRunnerClass.start = function() { + var that = this; + + if (this._taskCompleted) { + throw('The task ' + this._taskLabel + ' has already completed'); + } + + this._taskFn.apply(this, this._taskFnArgs); + + this._waitHandle = setInterval( + function() { + if (that._taskCompleted) { + clearInterval(that._waitHandle); + } + }, + 200 + ); + + this._timeoutHandle = setTimeout( + function() { + that.markCompleted(); + that._timeoutFn.apply(that, that._timeoutFnArgs); + }, + this._timeout + ); + } + + /* + * This function MUST be called by the task when done otherwise the task will timeout. + */ + SyncTaskRunnerClass.markCompleted = function() { + this._taskCompleted = true; + clearTimeout(this._timeoutHandle); + } + + SyncTaskRunnerClass.hasCompleted = function() { + return this._taskCompleted; + } + + return SyncTaskRunner; +}); + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/TimeShifter.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/TimeShifter.js new file mode 100644 index 00000000..2a82d328 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/TimeShifter.js @@ -0,0 +1,85 @@ +define(function(require, exports, module) { + var _ = require('underscore'); + var $ = require('jquery'); + var mvc = require('splunkjs/mvc') + var Class = require('common/Class'); + + var MINUTE = 60; + var HOUR = MINUTE * 60; + var DAY = HOUR * 24; + var WEEK = DAY * 7; + + var basicTemplate ='earliest=<%= earliest %> latest=<%= latest %> <%= search %>'; + + var comparisonTemplate = basicTemplate + '\ + | eval shiftBy=0 \ + | append [\ + search earliest=<%= previousEarliest %> latest=<%= previousLatest %> <%= search %> \ + | eval shifted="true" \ + | eval shiftBy=<%= shiftBy%> \ + ] \ + | eval _time=_time+shiftBy '; + + var TimeShifter = function(){ + this.service = mvc.createService(); + this.shifts = { + "Yesterday" : 86400, + "Last week": 604800, + "Last Month": 2592000, + "60 minutes ago": 3600, + "2 hours ago": 7200, + "6 hours ago": 21600, + "12 hours ago": 43200 + } + } + + var TimeShifterClass = Class.makeClass(TimeShifter); + + TimeShifterClass.fetchTimestamps = function(earliestTime, latestTime){ + return this.service.get( + 'search/timeparser', + { + 'time': [earliestTime, latestTime], + 'output_time_format': '%s.%Q' + } + ); + } + + TimeShifterClass.getSearchWithTime = function(search, earliestTime, latestTime, shiftBy){ + var that = this; + var dfd = $.Deferred(); + if(shiftBy) { + this.fetchTimestamps(earliestTime, latestTime) + .done(function(serverResponse){ + var times = JSON.parse(serverResponse); + + // Shift be a preset, or the difference between the latest time + // and the passed-in timestamp + var shiftAmount = that.shifts[shiftBy] || times[latestTime] - shiftBy; + var previousEarliest = times[earliestTime] - shiftAmount; + var previousLatest = times[latestTime] - shiftAmount; + + var response = _.template(comparisonTemplate, { + search: search, + earliest: times[earliestTime], + latest: times[latestTime], + previousEarliest: previousEarliest, + previousLatest: previousLatest, + shiftBy: shiftAmount + }); + dfd.resolve(response); + }); + } + else { + var response = _.template(basicTemplate, { + search: search, + earliest: earliestTime, + latest: latestTime + }); + dfd.resolve(response); + } + return dfd.promise(); + } + + return TimeShifter; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/UserPreferences.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/UserPreferences.js new file mode 100644 index 00000000..af9fd2ee --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/UserPreferences.js @@ -0,0 +1,170 @@ +/*global define */ +define(function(require, exports, module) { + var _ = require('underscore'); + var $ = require('jquery'); + var mvc = require('splunkjs/mvc'); + var sdk = require('splunkjs/splunk'); + var Backbone = require('backbone'); + var sharedModels = require('splunkjs/mvc/sharedmodels'); + + var UserPreferences = Backbone.Model.extend({ + /** + * An abstraction of the .conf system that allows for easy(!) + * definition of stanzas and filenames. This is a Backbone + * model; it emits the expected 'change' and 'error' events. + */ + + initialize: function(attrs, options) { + /** + * @param {options.file} The user's conf file to which to + * write the stanza. + * @param {options.stanza} The stanza name + * @param {options.field} (optional) A dictionary of + * expected field names in the stanza and how the + * value side of the conf file should be + * parsed. Currently supports 'text' (default) and + * 'json' + */ + var defoptions = { + user: sharedModels.get('user').entry.get('name'), + app: sharedModels.get('app').get('app') + }; + this.options = _.extend({}, defoptions, _.pick(options, ['file', 'stanza', 'fields'])); + if ((!this.options.file) || (!this.options.stanza)) { + throw new Error('A file and stanza is required.'); + } + this.namespace = { + app: this.options.app, + owner: this.options.user + }; + this.service = this.options.service || mvc.createService(this.namespace); + }, + + parse: function(resp, options) { + var fields = this.options.fields; + var convert = function(val, key) { + if (_.isUndefined(fields[key])) { + return [key, val]; + } + switch (fields[key]) { + case 'json': return [key, JSON.parse(val)]; break; + default: break; + } + return [key, val]; + }; + + /* Because we're not supporting ACLs or change of + * application or user, we take these out and let SplunkD + * reassert them with the defaults upon write. This lets + * our model be a representation of the stanza + * uncontaminated by .conf accounting details. + */ + var noEai = function(k) { + return (! _.contains(['disabled', 'eai:acl', 'eai:appName', 'eai:userName'], k)); + }; + + return _.chain(resp) + .map(convert) + .filter(noEai) + .object() + .value(); + }, + + toJSON: function() { + var fields = this.options.fields; + var attributes = Backbone.Model.prototype.toJSON.apply(this, arguments); + return _.object(_.map(attributes, function(val, key) { + if (_.isUndefined(fields[key])) { + return [key, val]; + } + switch (fields[key]) { + case 'json': return [key, JSON.stringify(val)]; break; + default: break; + } + return [key, val]; + })); + }, + + fetch: function(options) { + var that = this; + var dfd = $.Deferred(); + options = options ? _.clone(options) : {}; + + var requestStanza = new sdk.Service.ConfigurationStanza( + this.service, + this.options.file, + this.options.stanza, + this.namespace); + + requestStanza.fetch(function(err, resp) { + if (err) { + that.trigger('error', that, err, options); + return dfd.reject(err); + } + if (!that.set(that.parse(resp._properties, options), options)) { + that.trigger('error', that, err, options); + return dfd.reject("Parse failed", resp); + } + return dfd.resolve(resp); + }); + return dfd.promise(); + }, + + save: function(key, val, options) { + var dfd = $.Deferred(); + var that = this; + var attrs; + + if (key == null || typeof key === 'object') { + attrs = key; + options = val; + } else { + (attrs = {})[key] = val; + } + + options = _.extend({validate: true}, options); + if (! _.isNull(attrs)) { + this.set(attrs, options); + } + + var stanza = new sdk.Service.ConfigurationStanza( + this.service, + this.options.file, + this.options.stanza, + this.namespace); + + var content = this.toJSON(); + + /* The very annoying two-step of having SplunkD inform you + * that no such configuration file exists to which you can + * write your data, so go through the second-stage + * operation of creating a new file/stanza pair. + */ + stanza.update(content, function(err, written) { + if (err) { + if (err.status != 404) { + that.trigger('error', that, err, options); + dfd.reject(err); // Failed update. + return; + } + + var newFile = new sdk.Service.ConfigurationFile( + that.service, that.options.file, that.namespace); + + newFile.create(that.options.stanza, content, function(err, newstanza) { + if (err) { + that.trigger('error', that, err, options); + dfd.reject(err); + return; + } + dfd.resolve(true); // Successful create. + }); + } + dfd.resolve(true); // Succesful update + }); + return dfd.promise(); + } + }); + + return UserPreferences; +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/Utilities.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/Utilities.js new file mode 100644 index 00000000..706abe01 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/Utilities.js @@ -0,0 +1,33 @@ +define(['underscore', 'jquery'], function (_, $) { + + _.mixin({ + isMeaningless: function(v) { return (_.isUndefined(v) || _.isEmpty(v) || (v === "")); } + }); + + var Utilities = { + extractNumericValue: function(value) { + if (_.isNumber(value)) { + return value; + } + + return (value === '' ? 0 : parseInt(this.removeNonNumericCharacters(value), 10)); + }, + + removeNonNumericCharacters: function(text) { + return text.replace(/\D/g, ''); + }, + + updateUrlState: function(parameters, statename) { + statename = (! _.isUndefined(statename)) ? statename : "default"; + var queryArgs = window.location.search.substr(1) || ''; + var deleteEmpties = function(m, v, k) { + if (! (_.isMeaningless(v))) { m[k] = v; } + return m; + }; + var params = _.reduce(_.extend($.deparam(queryArgs) || {}, parameters), deleteEmpties, {}); + window.history.replaceState(params, statename, window.location.href.replace(/\?.*$/, '') + '?' + $.param(params)); + } + }; + + return Utilities; +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/common_less_imports.less b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/common_less_imports.less new file mode 100644 index 00000000..ad1f8413 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/common_less_imports.less @@ -0,0 +1,9 @@ +/*! + * less bootstrap for the apps +*/ + +// vars & mixins +@import "../base/shoestrap.less"; + +// components +@import "../components/step-wizard.less"; diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/statestore/statestorewrapper.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/statestore/statestorewrapper.js new file mode 100644 index 00000000..d99ca54e --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/common/statestore/statestorewrapper.js @@ -0,0 +1,195 @@ +/* + * This file contains wrappers for the state store end points + */ + +define(['underscore', 'jquery', 'splunkjs/mvc'], + function(_, $, mvc) { + var StateStoreWrapper = { + _splunkService: null, + + _splunkLogger: Splunk.Logger.getLogger('statestorewrapper'), + + _stateStoreBaseUrl: 'storage/collections/', + + getAllCollections: function(responseCallback) { + this.verifySetup(); + + this._splunkLogger.info('Attempting to get all KV Store collections.'); + + this._splunkService.get( + this.getCollectionConfigUrl(false, ''), + null, + responseCallback + ); + }, + + createCollection: function(collectionName, indexFieldNames, responseCallback) { + this.verifySetup(); + + this._splunkLogger.info('Creating KV Store collection named ' + collectionName); + + var that = this; + + // If the collection exists, skip the creation + this.getAllCollections(function(error, result) { + if ((_.isUndefined(error) || _.isNull(error)) && !(_.isUndefined(result) || _.isNull(result))) { + if (_.some(result.data.entry, function(item) { + return item.name == collectionName; + })) { + that._splunkLogger.info('Collection named '+ collectionName + 'already exists'); + responseCallback(error, result); + } else { + params = {}; + params['name'] = collectionName; + for (var index=0; index < indexFieldNames.length; index++) + { + indexFields = {}; + indexFields[indexFieldNames[index]] = 1; + params['accelerated_fields.' + indexFieldNames[index]] = JSON.stringify(indexFields); + } + + // Create collection with default permissions: + // write access to admin and power user roles only + // read access to all + that._splunkService.post( + that.getCollectionConfigUrl(true), + params, + responseCallback + ); + } + } else { + that._splunkLogger.info('Failed to retrieve all collections'); + responseCallback(error, result); + } + }); + }, + + deleteCollection: function(collectionName, responseCallback) { + this.verifySetup(); + + this._splunkLogger.info('Deleting KV Store collection named ' + collectionName); + + this._splunkService.del( + this.getCollectionConfigUrl(false, collectionName), + null, + responseCallback + ); + }, + + getData: function(collectionName, itemId, responseCallback) { + this.verifySetup(); + + this._splunkLogger.info( + 'Getting data from KV Store collection named ' + collectionName + ); + + // Get collection with default permissions: + // write access to admin and power user roles only + // read access to all + + this._splunkService.get( + this.getCollectionDataUrl(false, collectionName, itemId), + null, + responseCallback + ); + }, + + // setData upserts data - update (overwrite) existing or create new if _key isnt found + setData: function(collectionName, jsonBatch, responseCallback) { + this.verifySetup(); + + this._splunkLogger.info( + 'Adding data to KV Store collection named ' + collectionName + ); + + this._splunkService.request( + this.getCollectionDataUrl(true, collectionName), + 'POST', + {}, + {}, + JSON.stringify(jsonBatch), + {'Content-Type': 'application/json; charset=UTF-8'}, + responseCallback + ); + }, + + deleteItem: function(collectionName, itemId, responseCallback) { + this.verifySetup(); + + this._splunkLogger.info( + 'Adding data to KV Store collection named ' + collectionName + ); + + this._splunkService.del( + this.getCollectionDataUrl(false, collectionName, itemId), + null, + responseCallback + ); + }, + + verifySetup: function() { + if (_.isNull(this._splunkService) || _.isUndefined(this._splunkService)) + { + // State store configurations and data changes need to be reflected + // across user namespaces. If this requirement changes, modify this + // interface to enable that option + this._splunkService = mvc.createService({owner: 'nobody'}); + } + + if (_.isNull(this._splunkService) || _.isUndefined(this._splunkService)) + { + throw this.stateStoreWrapperException('Could not get Splunk service instance'); + } + }, + + stateStoreWrapperException: function(message) { + this.message = message; + this.name = 'stateStoreWrapperException'; + + var error = new Error(); + this.stack = error.stack; + + this._splunkLogger.error( + 'stateStoreWrapperException thrown with message: \"' + this.message + + '\" and stack trace: ' + this.stack + ); + }, + + getCollectionConfigUrl: function(isCreate, collectionName) { + var url = this._stateStoreBaseUrl + 'config/'; + + if (!isCreate) { + url += this._encodeForUrl(collectionName); + } + + return url; + }, + + getCollectionDataUrl: function(isSave, collectionName, itemId) { + var url = this._stateStoreBaseUrl + 'data/' + + this._encodeForUrl(collectionName) + '/'; + + if (isSave) + { + url += 'batch_save/'; + } else { + url += this._encodeForUrl(itemId); + } + + return url; + }, + + _encodeForUrl: function(rawString) { + if (!_.isNull(rawString) && !_.isUndefined(rawString)) { + // This function is called for portions of the URLs that contain + // the / character, but not to denote path separation for the URL + // To preserve the / charcater, replace with encoding %2F + return rawString.replace('/', '%2F'); + } + + return ''; + } + }; + + return StateStoreWrapper; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ldaprecordview.css b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ldaprecordview.css new file mode 100644 index 00000000..701e3450 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ldaprecordview.css @@ -0,0 +1,31 @@ +.splunk-app-microsoft-ldaprecordview { + width: 100%; + overflow-x: scroll; +} + +.splunk-app-microsoft-ldaprecordview div.oc { + width: 100%; +} + +.splunk-app-microsoft-ldaprecordview div.oc h3.title { + padding: 6px; + background: #C7DBB9; + font: italic bold 8pt/14pt Helvetica,sans-serif; +} + +.splunk-app-microsoft-ldaprecordview div.oc div.content { + padding-left: 10px; + padding-right: 10px; + font: black 10pt Arial,Helvetica,sans-serif; +} + +.splunk-app-microsoft-ldaprecordview div.oc div.content div.attr div.attrname { + float: left; + width: 30%; +} + +.splunk-app-microsoft-ldaprecordview div.oc div.content div.attr div.attrval { + width: 70%; + white-space: nowrap; + display: inline-block; +} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ldaprecordview.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ldaprecordview.js new file mode 100644 index 00000000..3714be0c --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ldaprecordview.js @@ -0,0 +1,5587 @@ +define(function(require, exports, module) { + + var _ = require('underscore'); + var SimpleSplunkView = require("splunkjs/mvc/simplesplunkview"); + require("css!./ldaprecordview.css"); + + var LDAPRecordView = SimpleSplunkView.extend({ + + className: "splunk-app-microsoft-ldaprecordview", + + output_mode: "json", + + createView: function() { + return true; + }, + + formatData: function(data){ + return data; + }, + + updateView: function(viz, data) { + if (data.length === 0) { + return; + } + // The LDAP Record is a single record, but the JSON response is always an array + // so just take the first one. + var ldapRecord = data[0]; + if (!('objectClass' in ldapRecord)) { + return; + } + + // We have a proper record, so let's reset the UI and get on to display + this.$el.empty(); + + var ocMap = {}; + // For each object class, convert the name to the AD name, and add on + // any auxiliary classes + var ocList; + if (ldapRecord.objectClass instanceof Array) { + ocList = ldapRecord.objectClass; + } else { + ocList = [ ldapRecord.objectClass ]; + } + for (var i = 0 ; i < ocList.length ; i++) { + if (ocList[i] in this.adLDAPClasses) { + var oc = this.adLDAPClasses[ocList[i]]; + // Our AD Class is one + ocMap[oc] = 1; + // Add on any auxiliary classes + if ('classes' in this.adSchemaClasses[oc]) { + for (var j = 0 ; j < this.adSchemaClasses[oc].classes.length ; j++) { + ocMap[this.adSchemaClasses[oc].classes[j]] = 1; + } + } + } + } + // Convert back to an array + var ocArray = []; + for (var p in ocMap) { + ocArray.push(p); + } + var objectClasses = ocArray.sort(this.caseInsensitive); + + // Each objectclass has it's own display mechanics as a panel. The panel is + // constructed as a pair of DIVs, one on top of the other, with a switcher on + // the side. We do "top" first, which is every single LDAP record + this.buildOC("Top", ldapRecord); + for (var ocidx = 0 ; ocidx < objectClasses.length ; ocidx++) { + if (objectClasses[ocidx] != "Top") + this.buildOC(objectClasses[ocidx], ldapRecord); + } + }, + + getData: function(){ + return this.resultsModel.data().results; + }, + + + // Builds the Object Class + buildOC: function(oc, ldapRecord) { + // MAIN BLOCK + var block = $('

'+oc+'

').appendTo(this.$el); + var title = $('div#'+oc+' > h3.title'); + var content = $('div#'+oc+' > div.content'); + + // Now populate the content. There are three possibilities here: + // 1) We have a distinct method of rendering the object class + // 2) We know about the objectclass and it's attributes + // 3) We don't know about the objectclass + // + // 1) We have a distinct method of rendering the object class + // None of these yet + + // 2) We know about the objectClass + if (oc in this.adSchemaClasses) { + this.buildKnownSchemaClass(oc, ldapRecord, content); + return; + } + + // 3) We don't know about the objectClass + $('

Unknown Object Class - Add Knowledge to LDAPRecord

').appendTo(content); + return; + }, + + buildKnownSchemaClass: function(oc, ldapRecord, container) { + var attrs = this.adSchemaClasses[oc].attributes; + + for (var i = 0 ; i < attrs.length ; i++) { + if (attrs[i] in this.adSchemaAttributes) { + var ldapAttr = this.adSchemaAttributes[attrs[i]]; + if (ldapAttr in ldapRecord) { + var v = ldapRecord[ldapAttr]; + if (ldapRecord[ldapAttr] instanceof Array) { + v = ldapRecord[ldapAttr].join('
'); + } + $('
' + attrs[i] + '
' + v + '
') + .appendTo(container); + } + } + } + }, + + /** + * Sort Method for Array.sort() to do a case insensitive sort + */ + caseInsensitive: function(x,y) { + var a = String(x).toLowerCase(); + var b = String(y).toLowerCase(); + + if (a > b) return 1; + if (a < b) return -1; + return 0; + }, + + /** + * Knowledge for the Active Directory Schema - Attributes + * + * Each Attribute has an LDAP name and a Active Directory name. + * + * See: http://msdn.microsoft.com/en-us/library/windows/desktop/ms675090%28v=vs.85%29.aspx + * + * This content is generated by get-ad-attributes.pl and converts between + * a CN and an LDAP-Attribute-Name. + */ + adSchemaAttributes: { + 'ACS-Aggregate-Token-Rate-Per-User': 'aCSAggregateTokenRatePerUser', + 'ACS-Allocable-RSVP-Bandwidth': 'aCSAllocableRSVPBandwidth', + 'ACS-Cache-Timeout': 'aCSCacheTimeout', + 'ACS-DSBM-DeadTime': 'aCSDSBMDeadTime', + 'ACS-DSBM-Priority': 'aCSDSBMPriority', + 'ACS-DSBM-Refresh': 'aCSDSBMRefresh', + 'ACS-Direction': 'aCSDirection', + 'ACS-Enable-ACS-Service': 'aCSEnableACSService', + 'ACS-Enable-RSVP-Accounting': 'aCSEnableRSVPAccounting', + 'ACS-Enable-RSVP-Message-Logging': 'aCSEnableRSVPMessageLogging', + 'ACS-Event-Log-Level': 'aCSEventLogLevel', + 'ACS-Identity-Name': 'aCSIdentityName', + 'ACS-Max-Aggregate-Peak-Rate-Per-User': 'aCSMaxAggregatePeakRatePerUser', + 'ACS-Max-Duration-Per-Flow': 'aCSMaxDurationPerFlow', + 'ACS-Max-No-Of-Account-Files': 'aCSMaxNoOfAccountFiles', + 'ACS-Max-No-Of-Log-Files': 'aCSMaxNoOfLogFiles', + 'ACS-Max-Peak-Bandwidth': 'aCSMaxPeakBandwidth', + 'ACS-Max-Peak-Bandwidth-Per-Flow': 'aCSMaxPeakBandwidthPerFlow', + 'ACS-Max-Size-Of-RSVP-Account-File': 'aCSMaxSizeOfRSVPAccountFile', + 'ACS-Max-Size-Of-RSVP-Log-File': 'aCSMaxSizeOfRSVPLogFile', + 'ACS-Max-Token-Bucket-Per-Flow': 'aCSMaxTokenBucketPerFlow', + 'ACS-Max-Token-Rate-Per-Flow': 'aCSMaxTokenRatePerFlow', + 'ACS-Maximum-SDU-Size': 'aCSMaximumSDUSize', + 'ACS-Minimum-Delay-Variation': 'aCSMinimumDelayVariation', + 'ACS-Minimum-Latency': 'aCSMinimumLatency', + 'ACS-Minimum-Policed-Size': 'aCSMinimumPolicedSize', + 'ACS-Non-Reserved-Max-SDU-Size': 'aCSNonReservedMaxSDUSize', + 'ACS-Non-Reserved-Min-Policed-Size': 'aCSNonReservedMinPolicedSize', + 'ACS-Non-Reserved-Peak-Rate': 'aCSNonReservedPeakRate', + 'ACS-Non-Reserved-Token-Size': 'aCSNonReservedTokenSize', + 'ACS-Non-Reserved-Tx-Limit': 'aCSNonReservedTxLimit', + 'ACS-Non-Reserved-Tx-Size': 'aCSNonReservedTxSize', + 'ACS-Permission-Bits': 'aCSPermissionBits', + 'ACS-Policy-Name': 'aCSPolicyName', + 'ACS-Priority': 'aCSPriority', + 'ACS-RSVP-Account-Files-Location': 'aCSRSVPAccountFilesLocation', + 'ACS-RSVP-Log-Files-Location': 'aCSRSVPLogFilesLocation', + 'ACS-Server-List': 'aCSServerList', + 'ACS-Service-Type': 'aCSServiceType', + 'ACS-Time-Of-Day': 'aCSTimeOfDay', + 'ACS-Total-No-Of-Flows': 'aCSTotalNoOfFlows', + 'ANR': 'aNR', + 'Account-Expires': 'accountExpires', + 'Account-Name-History': 'accountNameHistory', + 'Additional-Information': 'notes', + 'Additional-Trusted-Service-Names': 'additionalTrustedServiceNames', + 'Address': 'streetAddress', + 'Address-Book-Roots': 'addressBookRoots', + 'Address-Book-Roots2': 'addressBookRoots2', + 'Address-Entry-Display-Table': 'addressEntryDisplayTable', + 'Address-Entry-Display-Table-MSDOS': 'addressEntryDisplayTableMSDOS', + 'Address-Home': 'homePostalAddress', + 'Address-Syntax': 'addressSyntax', + 'Address-Type': 'addressType', + 'Admin-Context-Menu': 'adminContextMenu', + 'Admin-Count': 'adminCount', + 'Admin-Description': 'adminDescription', + 'Admin-Display-Name': 'adminDisplayName', + 'Admin-Multiselect-Property-Pages': 'adminMultiselectPropertyPages', + 'Admin-Property-Pages': 'adminPropertyPages', + 'Allowed-Attributes': 'allowedAttributes', + 'Allowed-Attributes-Effective': 'allowedAttributesEffective', + 'Allowed-Child-Classes': 'allowedChildClasses', + 'Allowed-Child-Classes-Effective': 'allowedChildClassesEffective', + 'Alt-Security-Identities': 'altSecurityIdentities', + 'App-Schema-Version': 'appSchemaVersion', + 'Application-Name': 'applicationName', + 'Applies-To': 'appliesTo', + 'Asset-Number': 'assetNumber', + 'Assistant': 'assistant', + 'Assoc-NT-Account': 'assocNTAccount', + 'Attribute-Display-Names': 'attributeDisplayNames', + 'Attribute-ID': 'attributeID', + 'Attribute-Security-GUID': 'attributeSecurityGUID', + 'Attribute-Syntax': 'attributeSyntax', + 'Attribute-Types': 'attributeTypes', + 'Auditing-Policy': 'auditingPolicy', + 'Authentication-Options': 'authenticationOptions', + 'Authority-Revocation-List': 'authorityRevocationList', + 'Auxiliary-Class': 'auxiliaryClass', + 'Bad-Password-Time': 'badPasswordTime', + 'Bad-Pwd-Count': 'badPwdCount', + 'Birth-Location': 'birthLocation', + 'Bridgehead-Server-List-BL': 'bridgeheadServerListBL', + 'Bridgehead-Transport-List': 'bridgeheadTransportList', + 'Builtin-Creation-Time': 'builtinCreationTime', + 'Builtin-Modified-Count': 'builtinModifiedCount', + 'Business-Category': 'businessCategory', + 'Bytes-Per-Minute': 'bytesPerMinute', + 'CA-Certificate': 'cACertificate', + 'CA-Certificate-DN': 'cACertificateDN', + 'CA-Connect': 'cAConnect', + 'CA-Usages': 'cAUsages', + 'CA-WEB-URL': 'cAWEBURL', + 'COM-CLSID': 'cOMCLSID', + 'COM-ClassID': 'cOMClassID', + 'COM-InterfaceID': 'cOMInterfaceID', + 'COM-Other-Prog-Id': 'cOMOtherProgId', + 'COM-ProgID': 'cOMProgID', + 'COM-Treat-As-Class-Id': 'cOMTreatAsClassId', + 'COM-Typelib-Id': 'cOMTypelibId', + 'COM-Unique-LIBID': 'cOMUniqueLIBID', + 'CRL-Object': 'cRLObject', + 'CRL-Partitioned-Revocation-List': 'cRLPartitionedRevocationList', + 'Can-Upgrade-Script': 'canUpgradeScript', + 'Canonical-Name': 'canonicalName', + 'Catalogs': 'catalogs', + 'Categories': 'categories', + 'Category-Id': 'categoryId', + 'Certificate-Authority-Object': 'certificateAuthorityObject', + 'Certificate-Revocation-List': 'certificateRevocationList', + 'Certificate-Templates': 'certificateTemplates', + 'Class-Display-Name': 'classDisplayName', + 'Code-Page': 'codePage', + 'Comment': 'info', + 'Common-Name': 'cn', + 'Company': 'company', + 'Content-Indexing-Allowed': 'contentIndexingAllowed', + 'Context-Menu': 'contextMenu', + 'Control-Access-Rights': 'controlAccessRights', + 'Cost': 'cost', + 'Country-Code': 'countryCode', + 'Country-Name': 'c', + 'Create-Dialog': 'createDialog', + 'Create-Time-Stamp': 'createTimeStamp', + 'Create-Wizard-Ext': 'createWizardExt', + 'Creation-Time': 'creationTime', + 'Creation-Wizard': 'creationWizard', + 'Creator': 'creator', + 'Cross-Certificate-Pair': 'crossCertificatePair', + 'Curr-Machine-Id': 'currMachineId', + 'Current-Location': 'currentLocation', + 'Current-Parent-CA': 'currentParentCA', + 'Current-Value': 'currentValue', + 'DBCS-Pwd': 'dBCSPwd', + 'DIT-Content-Rules': 'dITContentRules', + 'DMD-Location': 'dMDLocation', + 'DMD-Name': 'dmdName', + 'DN-Reference-Update': 'dNReferenceUpdate', + 'DNS-Host-Name': 'dNSHostName', + 'DNS-Property': 'dNSProperty', + 'DNS-Tombstoned': 'dNSTombstoned', + 'DS-Core-Propagation-Data': 'dSCorePropagationData', + 'DS-Heuristics': 'dSHeuristics', + 'DS-UI-Admin-Maximum': 'dSUIAdminMaximum', + 'DS-UI-Admin-Notification': 'dSUIAdminNotification', + 'DS-UI-Shell-Maximum': 'dSUIShellMaximum', + 'DSA-Signature': 'dSASignature', + 'Default-Class-Store': 'defaultClassStore', + 'Default-Group': 'defaultGroup', + 'Default-Hiding-Value': 'defaultHidingValue', + 'Default-Local-Policy-Object': 'defaultLocalPolicyObject', + 'Default-Object-Category': 'defaultObjectCategory', + 'Default-Priority': 'defaultPriority', + 'Default-Security-Descriptor': 'defaultSecurityDescriptor', + 'Delta-Revocation-List': 'deltaRevocationList', + 'Department': 'department', + 'Description': 'description', + 'Desktop-Profile': 'desktopProfile', + 'Destination-Indicator': 'destinationIndicator', + 'Display-Name': 'displayName', + 'Display-Name-Printable': 'displayNamePrintable', + 'Division': 'division', + 'Dns-Allow-Dynamic': 'dnsAllowDynamic', + 'Dns-Allow-XFR': 'dnsAllowXFR', + 'Dns-Notify-Secondaries': 'dnsNotifySecondaries', + 'Dns-Record': 'dnsRecord', + 'Dns-Root': 'dnsRoot', + 'Dns-Secure-Secondaries': 'dnsSecureSecondaries', + 'Domain-Certificate-Authorities': 'domainCAs', + 'Domain-Component': 'dc', + 'Domain-Cross-Ref': 'domainCrossRef', + 'Domain-ID': 'domainID', + 'Domain-Identifier': 'domainIdentifier', + 'Domain-Policy-Object': 'domainPolicyObject', + 'Domain-Policy-Reference': 'domainPolicyReference', + 'Domain-Replica': 'domainReplica', + 'Domain-Wide-Policy': 'domainWidePolicy', + 'Driver-Name': 'driverName', + 'Driver-Version': 'driverVersion', + 'Dynamic-LDAP-Server': 'dynamicLDAPServer', + 'E-mail-Addresses': 'mail', + 'EFSPolicy': 'eFSPolicy', + 'Employee-ID': 'employeeID', + 'Employee-Number': 'employeeNumber', + 'Employee-Type': 'employeeType', + 'Enabled': 'Enabled', + 'Enabled-Connection': 'enabledConnection', + 'Enrollment-Providers': 'enrollmentProviders', + 'Entry-TTL': 'entryTTL', + 'Extended-Attribute-Info': 'extendedAttributeInfo', + 'Extended-Chars-Allowed': 'extendedCharsAllowed', + 'Extended-Class-Info': 'extendedClassInfo', + 'Extension-Name': 'extensionName', + 'Extra-Columns': 'extraColumns', + 'FRS-Control-Data-Creation': 'fRSControlDataCreation', + 'FRS-Control-Inbound-Backlog': 'fRSControlInboundBacklog', + 'FRS-Control-Outbound-Backlog': 'fRSControlOutboundBacklog', + 'FRS-DS-Poll': 'fRSDSPoll', + 'FRS-Directory-Filter': 'fRSDirectoryFilter', + 'FRS-Extensions': 'fRSExtensions', + 'FRS-Fault-Condition': 'fRSFaultCondition', + 'FRS-File-Filter': 'fRSFileFilter', + 'FRS-Flags': 'fRSFlags', + 'FRS-Level-Limit': 'fRSLevelLimit', + 'FRS-Member-Reference': 'fRSMemberReference', + 'FRS-Member-Reference-BL': 'fRSMemberReferenceBL', + 'FRS-Partner-Auth-Level': 'fRSPartnerAuthLevel', + 'FRS-Primary-Member': 'fRSPrimaryMember', + 'FRS-Replica-Set-GUID': 'fRSReplicaSetGUID', + 'FRS-Replica-Set-Type': 'fRSReplicaSetType', + 'FRS-Root-Path': 'fRSRootPath', + 'FRS-Root-Security': 'fRSRootSecurity', + 'FRS-Service-Command': 'fRSServiceCommand', + 'FRS-Service-Command-Status': 'fRSServiceCommandStatus', + 'FRS-Staging-Path': 'fRSStagingPath', + 'FRS-Time-Last-Command': 'fRSTimeLastCommand', + 'FRS-Time-Last-Config-Change': 'fRSTimeLastConfigChange', + 'FRS-Update-Timeout': 'fRSUpdateTimeout', + 'FRS-Version': 'fRSVersion', + 'FRS-Version-GUID': 'fRSVersionGUID', + 'FRS-Working-Path': 'fRSWorkingPath', + 'FSMO-Role-Owner': 'fSMORoleOwner', + 'Facsimile-Telephone-Number': 'facsimileTelephoneNumber', + 'File-Ext-Priority': 'fileExtPriority', + 'Flags': 'flags', + 'Flat-Name': 'flatName', + 'Force-Logoff': 'forceLogoff', + 'Foreign-Identifier': 'foreignIdentifier', + 'Friendly-Names': 'friendlyNames', + 'From-Entry': 'fromEntry', + 'From-Server': 'fromServer', + 'Frs-Computer-Reference': 'frsComputerReference', + 'Frs-Computer-Reference-BL': 'frsComputerReferenceBL', + 'GP-Link': 'gPLink', + 'GP-Options': 'gPOptions', + 'GPC-File-Sys-Path': 'gPCFileSysPath', + 'GPC-Functionality-Version': 'gPCFunctionalityVersion', + 'GPC-Machine-Extension-Names': 'gPCMachineExtensionNames', + 'GPC-User-Extension-Names': 'gPCUserExtensionNames', + 'GPC-WQL-Filter': 'gPCWQLFilter', + 'Garbage-Coll-Period': 'garbageCollPeriod', + 'Generated-Connection': 'generatedConnection', + 'Generation-Qualifier': 'generationQualifier', + 'Given-Name': 'givenName', + 'Global-Address-List': 'globalAddressList', + 'Global-Address-List2': 'globalAddressList2', + 'Governs-ID': 'governsID', + 'Group-Attributes': 'groupAttributes', + 'Group-Membership-SAM': 'groupMembershipSAM', + 'Group-Priority': 'groupPriority', + 'Group-Type': 'groupType', + 'Groups-to-Ignore': 'groupsToIgnore', + 'Has-Master-NCs': 'hasMasterNCs', + 'Has-Partial-Replica-NCs': 'hasPartialReplicaNCs', + 'Help-Data16': 'helpData16', + 'Help-Data32': 'helpData32', + 'Help-File-Name': 'helpFileName', + 'Hide-From-AB': 'hideFromAB', + 'Home-Directory': 'homeDirectory', + 'Home-Drive': 'homeDrive', + 'IPSEC-Negotiation-Policy-Action': 'iPSECNegotiationPolicyAction', + 'IPSEC-Negotiation-Policy-Type': 'iPSECNegotiationPolicyType', + 'Icon-Path': 'iconPath', + 'Implemented-Categories': 'implementedCategories', + 'IndexedScopes': 'indexedScopes', + 'Initial-Auth-Incoming': 'initialAuthIncoming', + 'Initial-Auth-Outgoing': 'initialAuthOutgoing', + 'Initials': 'initials', + 'Install-Ui-Level': 'installUiLevel', + 'Instance-Type': 'instanceType', + 'Inter-Site-Topology-Failover': 'interSiteTopologyFailover', + 'Inter-Site-Topology-Generator': 'interSiteTopologyGenerator', + 'Inter-Site-Topology-Renew': 'interSiteTopologyRenew', + 'International-ISDN-Number': 'internationalISDNNumber', + 'Invocation-Id': 'invocationId', + 'Ipsec-Data': 'ipsecData', + 'Ipsec-Data-Type': 'ipsecDataType', + 'Ipsec-Filter-Reference': 'ipsecFilterReference', + 'Ipsec-ID': 'ipsecID', + 'Ipsec-ISAKMP-Reference': 'ipsecISAKMPReference', + 'Ipsec-NFA-Reference': 'ipsecNFAReference', + 'Ipsec-Name': 'ipsecName', + 'Ipsec-Negotiation-Policy-Reference': 'ipsecNegotiationPolicyReference', + 'Ipsec-Owners-Reference': 'ipsecOwnersReference', + 'Ipsec-Policy-Reference': 'ipsecPolicyReference', + 'Is-Critical-System-Object': 'isCriticalSystemObject', + 'Is-Defunct': 'isDefunct', + 'Is-Deleted': 'isDeleted', + 'Is-Ephemeral': 'isEphemeral', + 'Is-Member-Of-DL': 'memberOf', + 'Is-Member-Of-Partial-Attribute-Set': 'isMemberOfPartialAttributeSet', + 'Is-Privilege-Holder': 'isPrivilegeHolder', + 'Is-Recycled': 'isRecycled', + 'Is-Single-Valued': 'isSingleValued', + 'Keywords': 'keywords', + 'Knowledge-Information': 'knowledgeInformation', + 'LDAP-Admin-Limits': 'lDAPAdminLimits', + 'LDAP-Display-Name': 'lDAPDisplayName', + 'LDAP-IPDeny-List': 'lDAPIPDenyList', + 'LSA-Creation-Time': 'lSACreationTime', + 'LSA-Modified-Count': 'lSAModifiedCount', + 'Last-Backup-Restoration-Time': 'lastBackupRestorationTime', + 'Last-Content-Indexed': 'lastContentIndexed', + 'Last-Known-Parent': 'lastKnownParent', + 'Last-Logoff': 'lastLogoff', + 'Last-Logon': 'lastLogon', + 'Last-Logon-Timestamp': 'lastLogonTimestamp', + 'Last-Set-Time': 'lastSetTime', + 'Last-Update-Sequence': 'lastUpdateSequence', + 'Legacy-Exchange-DN': 'legacyExchangeDN', + 'Link-ID': 'linkID', + 'Link-Track-Secret': 'linkTrackSecret', + 'Lm-Pwd-History': 'lmPwdHistory', + 'Local-Policy-Flags': 'localPolicyFlags', + 'Local-Policy-Reference': 'localPolicyReference', + 'Locale-ID': 'localeID', + 'Locality-Name': 'l', + 'Localization-Display-Id': 'localizationDisplayId', + 'Localized-Description': 'localizedDescription', + 'Location': 'location', + 'Lock-Out-Observation-Window': 'lockOutObservationWindow', + 'Lockout-Duration': 'lockoutDuration', + 'Lockout-Threshold': 'lockoutThreshold', + 'Lockout-Time': 'lockoutTime', + 'Logo': 'thumbnailLogo', + 'Logon-Count': 'logonCount', + 'Logon-Hours': 'logonHours', + 'Logon-Workstation': 'logonWorkstation', + 'MAPI-ID': 'mAPIID', + 'MHS-OR-Address': 'mhsORAddress', + 'MS-DRM-Identity-Certificate': 'msDRM-IdentityCertificate', + 'MS-DS-All-Users-Trust-Quota': 'msDS-AllUsersTrustQuota', + 'MS-DS-Consistency-Child-Count': 'mS-DS-ConsistencyChildCount', + 'MS-DS-Consistency-Guid': 'mS-DS-ConsistencyGuid', + 'MS-DS-Creator-SID': 'mS-DS-CreatorSID', + 'MS-DS-Machine-Account-Quota': 'ms-DS-MachineAccountQuota', + 'MS-DS-Per-User-Trust-Quota': 'msDS-PerUserTrustQuota', + 'MS-DS-Per-User-Trust-Tombstones-Quota': 'msDS-PerUserTrustTombstonesQuota', + 'MS-DS-Replicates-NC-Reason': 'mS-DS-ReplicatesNCReason', + 'MS-SQL-Alias': 'mS-SQL-Alias', + 'MS-SQL-AllowAnonymousSubscription': 'mS-SQL-AllowAnonymousSubscription', + 'MS-SQL-AllowImmediateUpdatingSubscription': 'mS-SQL-AllowImmediateUpdatingSubscription', + 'MS-SQL-AllowKnownPullSubscription': 'mS-SQL-AllowKnownPullSubscription', + 'MS-SQL-AllowQueuedUpdatingSubscription': 'mS-SQL-AllowQueuedUpdatingSubscription', + 'MS-SQL-AllowSnapshotFilesFTPDownloading': 'mS-SQL-AllowSnapshotFilesFTPDownloading', + 'MS-SQL-AppleTalk': 'mS-SQL-AppleTalk', + 'MS-SQL-Applications': 'mS-SQL-Applications', + 'MS-SQL-Build': 'mS-SQL-Build', + 'MS-SQL-CharacterSet': 'mS-SQL-CharacterSet', + 'MS-SQL-Clustered': 'mS-SQL-Clustered', + 'MS-SQL-ConnectionURL': 'mS-SQL-ConnectionURL', + 'MS-SQL-Contact': 'mS-SQL-Contact', + 'MS-SQL-CreationDate': 'mS-SQL-CreationDate', + 'MS-SQL-Database': 'mS-SQL-Database', + 'MS-SQL-Description': 'mS-SQL-Description', + 'MS-SQL-GPSHeight': 'mS-SQL-GPSHeight', + 'MS-SQL-GPSLatitude': 'mS-SQL-GPSLatitude', + 'MS-SQL-GPSLongitude': 'mS-SQL-GPSLongitude', + 'MS-SQL-InformationDirectory': 'mS-SQL-InformationDirectory', + 'MS-SQL-InformationURL': 'mS-SQL-InformationURL', + 'MS-SQL-Keywords': 'mS-SQL-Keywords', + 'MS-SQL-Language': 'mS-SQL-Language', + 'MS-SQL-LastBackupDate': 'mS-SQL-LastBackupDate', + 'MS-SQL-LastDiagnosticDate': 'mS-SQL-LastDiagnosticDate', + 'MS-SQL-LastUpdatedDate': 'mS-SQL-LastUpdatedDate', + 'MS-SQL-Location': 'mS-SQL-Location', + 'MS-SQL-Memory': 'mS-SQL-Memory', + 'MS-SQL-MultiProtocol': 'mS-SQL-MultiProtocol', + 'MS-SQL-Name': 'mS-SQL-Name', + 'MS-SQL-NamedPipe': 'mS-SQL-NamedPipe', + 'MS-SQL-PublicationURL': 'mS-SQL-PublicationURL', + 'MS-SQL-Publisher': 'mS-SQL-Publisher', + 'MS-SQL-RegisteredOwner': 'mS-SQL-RegisteredOwner', + 'MS-SQL-SPX': 'mS-SQL-SPX', + 'MS-SQL-ServiceAccount': 'mS-SQL-ServiceAccount', + 'MS-SQL-Size': 'mS-SQL-Size', + 'MS-SQL-SortOrder': 'mS-SQL-SortOrder', + 'MS-SQL-Status': 'mS-SQL-Status', + 'MS-SQL-TCPIP': 'mS-SQL-TCPIP', + 'MS-SQL-ThirdParty': 'mS-SQL-ThirdParty', + 'MS-SQL-Type': 'mS-SQL-Type', + 'MS-SQL-UnicodeSortOrder': 'mS-SQL-UnicodeSortOrder', + 'MS-SQL-Version': 'mS-SQL-Version', + 'MS-SQL-Vines': 'mS-SQL-Vines', + 'MS-TS-ExpireDate': 'msTSExpireDate', + 'MS-TS-ExpireDate2': 'msTSExpireDate2', + 'MS-TS-ExpireDate3': 'msTSExpireDate3', + 'MS-TS-ExpireDate4': 'msTSExpireDate4', + 'MS-TS-LicenseVersion': 'msTSLicenseVersion', + 'MS-TS-LicenseVersion2': 'msTSLicenseVersion2', + 'MS-TS-LicenseVersion3': 'msTSLicenseVersion3', + 'MS-TS-LicenseVersion4': 'msTSLicenseVersion4', + 'MS-TS-ManagingLS': 'msTSManagingLS', + 'MS-TS-ManagingLS2': 'msTSManagingLS2', + 'MS-TS-ManagingLS3': 'msTSManagingLS3', + 'MS-TS-ManagingLS4': 'msTSManagingLS4', + 'MS-TS-Property01': 'msTSProperty01', + 'MS-TS-Property02': 'msTSProperty02', + 'MS-TSLS-Property01': 'msTSLSProperty01', + 'MS-TSLS-Property02': 'msTSLSProperty02', + 'MSMQ-Authenticate': 'mSMQAuthenticate', + 'MSMQ-Base-Priority': 'mSMQBasePriority', + 'MSMQ-CSP-Name': 'mSMQCSPName', + 'MSMQ-Computer-Type': 'mSMQComputerType', + 'MSMQ-Computer-Type-Ex': 'mSMQComputerTypeEx', + 'MSMQ-Cost': 'mSMQCost', + 'MSMQ-Dependent-Client-Service': 'mSMQDependentClientService', + 'MSMQ-Dependent-Client-Services': 'mSMQDependentClientServices', + 'MSMQ-Digests': 'mSMQDigests', + 'MSMQ-Digests-Mig': 'mSMQDigestsMig', + 'MSMQ-Ds-Service': 'mSMQDsService', + 'MSMQ-Ds-Services': 'mSMQDsServices', + 'MSMQ-Encrypt-Key': 'mSMQEncryptKey', + 'MSMQ-Foreign': 'mSMQForeign', + 'MSMQ-In-Routing-Servers': 'mSMQInRoutingServers', + 'MSMQ-Interval1': 'mSMQInterval1', + 'MSMQ-Interval2': 'mSMQInterval2', + 'MSMQ-Journal': 'mSMQJournal', + 'MSMQ-Journal-Quota': 'mSMQJournalQuota', + 'MSMQ-Label': 'mSMQLabel', + 'MSMQ-Label-Ex': 'mSMQLabelEx', + 'MSMQ-Long-Lived': 'mSMQLongLived', + 'MSMQ-Migrated': 'mSMQMigrated', + 'MSMQ-Multicast-Address': 'MSMQ-MulticastAddress', + 'MSMQ-Name-Style': 'mSMQNameStyle', + 'MSMQ-Nt4-Flags': 'mSMQNt4Flags', + 'MSMQ-Nt4-Stub': 'mSMQNt4Stub', + 'MSMQ-OS-Type': 'mSMQOSType', + 'MSMQ-Out-Routing-Servers': 'mSMQOutRoutingServers', + 'MSMQ-Owner-ID': 'mSMQOwnerID', + 'MSMQ-Prev-Site-Gates': 'mSMQPrevSiteGates', + 'MSMQ-Privacy-Level': 'mSMQPrivacyLevel', + 'MSMQ-QM-ID': 'mSMQQMID', + 'MSMQ-Queue-Journal-Quota': 'mSMQQueueJournalQuota', + 'MSMQ-Queue-Name-Ext': 'mSMQQueueNameExt', + 'MSMQ-Queue-Quota': 'mSMQQueueQuota', + 'MSMQ-Queue-Type': 'mSMQQueueType', + 'MSMQ-Quota': 'mSMQQuota', + 'MSMQ-Recipient-FormatName': 'msMQ-Recipient-FormatName', + 'MSMQ-Routing-Service': 'mSMQRoutingService', + 'MSMQ-Routing-Services': 'mSMQRoutingServices', + 'MSMQ-Secured-Source': 'MSMQ-SecuredSource', + 'MSMQ-Service-Type': 'mSMQServiceType', + 'MSMQ-Services': 'mSMQServices', + 'MSMQ-Sign-Certificates': 'mSMQSignCertificates', + 'MSMQ-Sign-Certificates-Mig': 'mSMQSignCertificatesMig', + 'MSMQ-Sign-Key': 'mSMQSignKey', + 'MSMQ-Site-1': 'mSMQSite1', + 'MSMQ-Site-2': 'mSMQSite2', + 'MSMQ-Site-Foreign': 'mSMQSiteForeign', + 'MSMQ-Site-Gates': 'mSMQSiteGates', + 'MSMQ-Site-Gates-Mig': 'mSMQSiteGatesMig', + 'MSMQ-Site-ID': 'mSMQSiteID', + 'MSMQ-Site-Name': 'mSMQSiteName', + 'MSMQ-Site-Name-Ex': 'mSMQSiteNameEx', + 'MSMQ-Sites': 'mSMQSites', + 'MSMQ-Transactional': 'mSMQTransactional', + 'MSMQ-User-Sid': 'mSMQUserSid', + 'MSMQ-Version': 'mSMQVersion', + 'Machine-Architecture': 'machineArchitecture', + 'Machine-Password-Change-Interval': 'machinePasswordChangeInterval', + 'Machine-Role': 'machineRole', + 'Machine-Wide-Policy': 'machineWidePolicy', + 'Managed-By': 'managedBy', + 'Managed-Objects': 'managedObjects', + 'Manager': 'manager', + 'Marshalled-Interface': 'marshalledInterface', + 'Mastered-By': 'masteredBy', + 'Max-Pwd-Age': 'maxPwdAge', + 'Max-Renew-Age': 'maxRenewAge', + 'Max-Storage': 'maxStorage', + 'Max-Ticket-Age': 'maxTicketAge', + 'May-Contain': 'mayContain', + 'Member': 'member', + 'Min-Pwd-Age': 'minPwdAge', + 'Min-Pwd-Length': 'minPwdLength', + 'Min-Ticket-Age': 'minTicketAge', + 'Modified-Count': 'modifiedCount', + 'Modified-Count-At-Last-Prom': 'modifiedCountAtLastProm', + 'Modify-Time-Stamp': 'modifyTimeStamp', + 'Moniker': 'moniker', + 'Moniker-Display-Name': 'monikerDisplayName', + 'Move-Tree-State': 'moveTreeState', + 'Mscope-Id': 'mscopeId', + 'Msi-File-List': 'msiFileList', + 'Msi-Script': 'msiScript', + 'Msi-Script-Name': 'msiScriptName', + 'Msi-Script-Path': 'msiScriptPath', + 'Msi-Script-Size': 'msiScriptSize', + 'Must-Contain': 'mustContain', + 'NC-Name': 'nCName', + 'NETBIOS-Name': 'nETBIOSName', + 'NT-Group-Members': 'nTGroupMembers', + 'NT-Mixed-Domain': 'nTMixedDomain', + 'NT-Security-Descriptor': 'nTSecurityDescriptor', + 'Name-Service-Flags': 'nameServiceFlags', + 'Netboot-GUID': 'netbootGUID', + 'Netboot-Initialization': 'netbootInitialization', + 'Netboot-Machine-File-Path': 'netbootMachineFilePath', + 'Netboot-Mirror-Data-File': 'netbootMirrorDataFile', + 'Netboot-SIF-File': 'netbootSIFFile', + 'Network-Address': 'networkAddress', + 'Next-Level-Store': 'nextLevelStore', + 'Next-Rid': 'nextRid', + 'Non-Security-Member': 'nonSecurityMember', + 'Non-Security-Member-BL': 'nonSecurityMemberBL', + 'Notification-List': 'notificationList', + 'Nt-Pwd-History': 'ntPwdHistory', + 'OEM-Information': 'oEMInformation', + 'OM-Object-Class': 'oMObjectClass', + 'OM-Syntax': 'oMSyntax', + 'OMT-Guid': 'oMTGuid', + 'OMT-Indx-Guid': 'oMTIndxGuid', + 'Obj-Dist-Name': 'distinguishedName', + 'Object-Category': 'objectCategory', + 'Object-Class': 'objectClass', + 'Object-Class-Category': 'objectClassCategory', + 'Object-Classes': 'objectClasses', + 'Object-Count': 'objectCount', + 'Object-Guid': 'objectGUID', + 'Object-Sid': 'objectSid', + 'Object-Version': 'objectVersion', + 'Operating-System': 'operatingSystem', + 'Operating-System-Hotfix': 'operatingSystemHotfix', + 'Operating-System-Service-Pack': 'operatingSystemServicePack', + 'Operating-System-Version': 'operatingSystemVersion', + 'Operator-Count': 'operatorCount', + 'Option-Description': 'optionDescription', + 'Options': 'options', + 'Options-Location': 'optionsLocation', + 'Organization-Name': 'o', + 'Organizational-Unit-Name': 'ou', + 'Original-Display-Table': 'originalDisplayTable', + 'Original-Display-Table-MSDOS': 'originalDisplayTableMSDOS', + 'Other-Login-Workstations': 'otherLoginWorkstations', + 'Other-Mailbox': 'otherMailbox', + 'Other-Name': 'middleName', + 'Other-Well-Known-Objects': 'otherWellKnownObjects', + 'Owner': 'owner', + 'PKI-Critical-Extensions': 'pKICriticalExtensions', + 'PKI-Default-CSPs': 'pKIDefaultCSPs', + 'PKI-Default-Key-Spec': 'pKIDefaultKeySpec', + 'PKI-Enrollment-Access': 'pKIEnrollmentAccess', + 'PKI-Expiration-Period': 'pKIExpirationPeriod', + 'PKI-Extended-Key-Usage': 'pKIExtendedKeyUsage', + 'PKI-Key-Usage': 'pKIKeyUsage', + 'PKI-Max-Issuing-Depth': 'pKIMaxIssuingDepth', + 'PKI-Overlap-Period': 'pKIOverlapPeriod', + 'PKT': 'pKT', + 'PKT-Guid': 'pKTGuid', + 'Package-Flags': 'packageFlags', + 'Package-Name': 'packageName', + 'Package-Type': 'packageType', + 'Parent-CA': 'parentCA', + 'Parent-CA-Certificate-Chain': 'parentCACertificateChain', + 'Parent-GUID': 'parentGUID', + 'Partial-Attribute-Deletion-List': 'partialAttributeDeletionList', + 'Partial-Attribute-Set': 'partialAttributeSet', + 'Pek-Key-Change-Interval': 'pekKeyChangeInterval', + 'Pek-List': 'pekList', + 'Pending-CA-Certificates': 'pendingCACertificates', + 'Pending-Parent-CA': 'pendingParentCA', + 'Per-Msg-Dialog-Display-Table': 'perMsgDialogDisplayTable', + 'Per-Recip-Dialog-Display-Table': 'perRecipDialogDisplayTable', + 'Personal-Title': 'personalTitle', + 'Phone-Fax-Other': 'otherFacsimileTelephoneNumber', + 'Phone-Home-Other': 'otherHomePhone', + 'Phone-Home-Primary': 'homePhone', + 'Phone-ISDN-Primary': 'primaryInternationalISDNNumber', + 'Phone-Ip-Other': 'otherIpPhone', + 'Phone-Ip-Primary': 'ipPhone', + 'Phone-Mobile-Other': 'otherMobile', + 'Phone-Mobile-Primary': 'mobile', + 'Phone-Office-Other': 'otherTelephone', + 'Phone-Pager-Other': 'otherPager', + 'Phone-Pager-Primary': 'pager', + 'Physical-Delivery-Office-Name': 'physicalDeliveryOfficeName', + 'Physical-Location-Object': 'physicalLocationObject', + 'Picture': 'thumbnailPhoto', + 'Policy-Replication-Flags': 'policyReplicationFlags', + 'Port-Name': 'portName', + 'Poss-Superiors': 'possSuperiors', + 'Possible-Inferiors': 'possibleInferiors', + 'Post-Office-Box': 'postOfficeBox', + 'Postal-Address': 'postalAddress', + 'Postal-Code': 'postalCode', + 'Preferred-Delivery-Method': 'preferredDeliveryMethod', + 'Preferred-OU': 'preferredOU', + 'Prefix-Map': 'prefixMap', + 'Presentation-Address': 'presentationAddress', + 'Previous-CA-Certificates': 'previousCACertificates', + 'Previous-Parent-CA': 'previousParentCA', + 'Primary-Group-ID': 'primaryGroupID', + 'Primary-Group-Token': 'primaryGroupToken', + 'Print-Attributes': 'printAttributes', + 'Print-Bin-Names': 'printBinNames', + 'Print-Collate': 'printCollate', + 'Print-Color': 'printColor', + 'Print-Duplex-Supported': 'printDuplexSupported', + 'Print-End-Time': 'printEndTime', + 'Print-Form-Name': 'printFormName', + 'Print-Keep-Printed-Jobs': 'printKeepPrintedJobs', + 'Print-Language': 'printLanguage', + 'Print-MAC-Address': 'printMACAddress', + 'Print-Max-Copies': 'printMaxCopies', + 'Print-Max-Resolution-Supported': 'printMaxResolutionSupported', + 'Print-Max-X-Extent': 'printMaxXExtent', + 'Print-Max-Y-Extent': 'printMaxYExtent', + 'Print-Media-Ready': 'printMediaReady', + 'Print-Media-Supported': 'printMediaSupported', + 'Print-Memory': 'printMemory', + 'Print-Min-X-Extent': 'printMinXExtent', + 'Print-Min-Y-Extent': 'printMinYExtent', + 'Print-Network-Address': 'printNetworkAddress', + 'Print-Notify': 'printNotify', + 'Print-Number-Up': 'printNumberUp', + 'Print-Orientations-Supported': 'printOrientationsSupported', + 'Print-Owner': 'printOwner', + 'Print-Pages-Per-Minute': 'printPagesPerMinute', + 'Print-Rate': 'printRate', + 'Print-Rate-Unit': 'printRateUnit', + 'Print-Separator-File': 'printSeparatorFile', + 'Print-Share-Name': 'printShareName', + 'Print-Spooling': 'printSpooling', + 'Print-Stapling-Supported': 'printStaplingSupported', + 'Print-Start-Time': 'printStartTime', + 'Print-Status': 'printStatus', + 'Printer-Name': 'printerName', + 'Prior-Set-Time': 'priorSetTime', + 'Prior-Value': 'priorValue', + 'Priority': 'priority', + 'Private-Key': 'privateKey', + 'Privilege-Attributes': 'privilegeAttributes', + 'Privilege-Display-Name': 'privilegeDisplayName', + 'Privilege-Holder': 'privilegeHolder', + 'Privilege-Value': 'privilegeValue', + 'Product-Code': 'productCode', + 'Profile-Path': 'profilePath', + 'Proxied-Object-Name': 'proxiedObjectName', + 'Proxy-Addresses': 'proxyAddresses', + 'Proxy-Generation-Enabled': 'proxyGenerationEnabled', + 'Proxy-Lifetime': 'proxyLifetime', + 'Public-Key-Policy': 'publicKeyPolicy', + 'Purported-Search': 'purportedSearch', + 'Pwd-History-Length': 'pwdHistoryLength', + 'Pwd-Last-Set': 'pwdLastSet', + 'Pwd-Properties': 'pwdProperties', + 'Quality-Of-Service': 'qualityOfService', + 'Query-Filter': 'queryFilter', + 'Query-Policy-BL': 'queryPolicyBL', + 'Query-Policy-Object': 'queryPolicyObject', + 'QueryPoint': 'queryPoint', + 'RDN': 'name', + 'RDN-Att-ID': 'rDNAttID', + 'RID-Allocation-Pool': 'rIDAllocationPool', + 'RID-Available-Pool': 'rIDAvailablePool', + 'RID-Manager-Reference': 'rIDManagerReference', + 'RID-Next-RID': 'rIDNextRID', + 'RID-Previous-Allocation-Pool': 'rIDPreviousAllocationPool', + 'RID-Set-References': 'rIDSetReferences', + 'RID-Used-Pool': 'rIDUsedPool', + 'Range-Lower': 'rangeLower', + 'Range-Upper': 'rangeUpper', + 'Registered-Address': 'registeredAddress', + 'Remote-Server-Name': 'remoteServerName', + 'Remote-Source': 'remoteSource', + 'Remote-Source-Type': 'remoteSourceType', + 'Remote-Storage-GUID': 'remoteStorageGUID', + 'Repl-Interval': 'replInterval', + 'Repl-Property-Meta-Data': 'replPropertyMetaData', + 'Repl-Topology-Stay-Of-Execution': 'replTopologyStayOfExecution', + 'Repl-UpToDate-Vector': 'replUpToDateVector', + 'Replica-Source': 'replicaSource', + 'Reports': 'directReports', + 'Reps-From': 'repsFrom', + 'Reps-To': 'repsTo', + 'Required-Categories': 'requiredCategories', + 'Retired-Repl-DSA-Signatures': 'retiredReplDSASignatures', + 'Revision': 'revision', + 'Rid': 'rid', + 'Rights-Guid': 'rightsGuid', + 'Role-Occupant': 'roleOccupant', + 'Root-Trust': 'rootTrust', + 'SAM-Account-Name': 'sAMAccountName', + 'SAM-Account-Type': 'sAMAccountType', + 'SAM-Domain-Updates': 'samDomainUpdates', + 'SD-Rights-Effective': 'sDRightsEffective', + 'SID-History': 'sIDHistory', + 'SMTP-Mail-Address': 'mailAddress', + 'SPN-Mappings': 'sPNMappings', + 'Schedule': 'schedule', + 'Schema-Flags-Ex': 'schemaFlagsEx', + 'Schema-ID-GUID': 'schemaIDGUID', + 'Schema-Info': 'schemaInfo', + 'Schema-Update': 'schemaUpdate', + 'Schema-Version': 'schemaVersion', + 'Scope-Flags': 'scopeFlags', + 'Script-Path': 'scriptPath', + 'Search-Flags': 'searchFlags', + 'Search-Guide': 'searchGuide', + 'Security-Identifier': 'securityIdentifier', + 'See-Also': 'seeAlso', + 'Seq-Notification': 'seqNotification', + 'Serial-Number': 'serialNumber', + 'Server-Name': 'serverName', + 'Server-Reference': 'serverReference', + 'Server-Reference-BL': 'serverReferenceBL', + 'Server-Role': 'serverRole', + 'Server-State': 'serverState', + 'Service-Binding-Information': 'serviceBindingInformation', + 'Service-Class-ID': 'serviceClassID', + 'Service-Class-Info': 'serviceClassInfo', + 'Service-Class-Name': 'serviceClassName', + 'Service-DNS-Name': 'serviceDNSName', + 'Service-DNS-Name-Type': 'serviceDNSNameType', + 'Service-Instance-Version': 'serviceInstanceVersion', + 'Service-Principal-Name': 'servicePrincipalName', + 'Setup-Command': 'setupCommand', + 'Shell-Context-Menu': 'shellContextMenu', + 'Shell-Property-Pages': 'shellPropertyPages', + 'Short-Server-Name': 'shortServerName', + 'Show-In-Address-Book': 'showInAddressBook', + 'Show-In-Advanced-View-Only': 'showInAdvancedViewOnly', + 'Signature-Algorithms': 'signatureAlgorithms', + 'Site-GUID': 'siteGUID', + 'Site-Link-List': 'siteLinkList', + 'Site-List': 'siteList', + 'Site-Object': 'siteObject', + 'Site-Object-BL': 'siteObjectBL', + 'Site-Server': 'siteServer', + 'State-Or-Province-Name': 'st', + 'Street-Address': 'street', + 'Structural-Object-Class': 'structuralObjectClass', + 'Sub-Class-Of': 'subClassOf', + 'Sub-Refs': 'subRefs', + 'SubSchemaSubEntry': 'subSchemaSubEntry', + 'Super-Scope-Description': 'superScopeDescription', + 'Super-Scopes': 'superScopes', + 'Superior-DNS-Root': 'superiorDNSRoot', + 'Supplemental-Credentials': 'supplementalCredentials', + 'Supported-Application-Context': 'supportedApplicationContext', + 'Surname': 'sn', + 'Sync-Attributes': 'syncAttributes', + 'Sync-Membership': 'syncMembership', + 'Sync-With-Object': 'syncWithObject', + 'Sync-With-SID': 'syncWithSID', + 'System-Auxiliary-Class': 'systemAuxiliaryClass', + 'System-Flags': 'systemFlags', + 'System-May-Contain': 'systemMayContain', + 'System-Must-Contain': 'systemMustContain', + 'System-Only': 'systemOnly', + 'System-Poss-Superiors': 'systemPossSuperiors', + 'Telephone-Number': 'telephoneNumber', + 'Teletex-Terminal-Identifier': 'teletexTerminalIdentifier', + 'Telex-Number': 'telexNumber', + 'Telex-Primary': 'primaryTelexNumber', + 'Template-Roots': 'templateRoots', + 'Template-Roots2': 'templateRoots2', + 'Terminal-Server': 'terminalServer', + 'Text-Country': 'co', + 'Text-Encoded-OR-Address': 'textEncodedORAddress', + 'Time-Refresh': 'timeRefresh', + 'Time-Vol-Change': 'timeVolChange', + 'Title': 'title', + 'Token-Groups': 'tokenGroups', + 'Token-Groups-Global-And-Universal': 'tokenGroupsGlobalAndUniversal', + 'Token-Groups-No-GC-Acceptable': 'tokenGroupsNoGCAcceptable', + 'Tombstone-Lifetime': 'tombstoneLifetime', + 'Transport-Address-Attribute': 'transportAddressAttribute', + 'Transport-DLL-Name': 'transportDLLName', + 'Transport-Type': 'transportType', + 'Treat-As-Leaf': 'treatAsLeaf', + 'Tree-Name': 'treeName', + 'Trust-Attributes': 'trustAttributes', + 'Trust-Auth-Incoming': 'trustAuthIncoming', + 'Trust-Auth-Outgoing': 'trustAuthOutgoing', + 'Trust-Direction': 'trustDirection', + 'Trust-Parent': 'trustParent', + 'Trust-Partner': 'trustPartner', + 'Trust-Posix-Offset': 'trustPosixOffset', + 'Trust-Type': 'trustType', + 'UAS-Compat': 'uASCompat', + 'UNC-Name': 'uNCName', + 'UPN-Suffixes': 'uPNSuffixes', + 'USN-Changed': 'uSNChanged', + 'USN-Created': 'uSNCreated', + 'USN-DSA-Last-Obj-Removed': 'uSNDSALastObjRemoved', + 'USN-Intersite': 'USNIntersite', + 'USN-Last-Obj-Rem': 'uSNLastObjRem', + 'USN-Source': 'uSNSource', + 'Unicode-Pwd': 'unicodePwd', + 'Upgrade-Product-Code': 'upgradeProductCode', + 'User-Account-Control': 'userAccountControl', + 'User-Cert': 'userCert', + 'User-Comment': 'comment', + 'User-Parameters': 'userParameters', + 'User-Password': 'userPassword', + 'User-Principal-Name': 'userPrincipalName', + 'User-SMIME-Certificate': 'userSMIMECertificate', + 'User-Shared-Folder': 'userSharedFolder', + 'User-Shared-Folder-Other': 'userSharedFolderOther', + 'User-Workstations': 'userWorkstations', + 'Valid-Accesses': 'validAccesses', + 'Vendor': 'vendor', + 'Version-Number': 'versionNumber', + 'Version-Number-Hi': 'versionNumberHi', + 'Version-Number-Lo': 'versionNumberLo', + 'Vol-Table-GUID': 'volTableGUID', + 'Vol-Table-Idx-GUID': 'volTableIdxGUID', + 'Volume-Count': 'volumeCount', + 'WWW-Home-Page': 'wWWHomePage', + 'WWW-Page-Other': 'url', + 'Wbem-Path': 'wbemPath', + 'Well-Known-Objects': 'wellKnownObjects', + 'When-Changed': 'whenChanged', + 'When-Created': 'whenCreated', + 'Winsock-Addresses': 'winsockAddresses', + 'X121-Address': 'x121Address', + 'X509-Cert': 'userCertificate', + 'associatedDomain': 'associatedDomain', + 'associatedName': 'associatedName', + 'attributeCertificateAttribute': 'attributeCertificateAttribute', + 'audio': 'audio', + 'bootFile': 'bootFile', + 'bootParameter': 'bootParameter', + 'buildingName': 'buildingName', + 'carLicense': 'carLicense', + 'departmentNumber': 'departmentNumber', + 'dhcp-Classes': 'dhcpClasses', + 'dhcp-Flags': 'dhcpFlags', + 'dhcp-Identification': 'dhcpIdentification', + 'dhcp-Mask': 'dhcpMask', + 'dhcp-MaxKey': 'dhcpMaxKey', + 'dhcp-Obj-Description': 'dhcpObjDescription', + 'dhcp-Obj-Name': 'dhcpObjName', + 'dhcp-Options': 'dhcpOptions', + 'dhcp-Properties': 'dhcpProperties', + 'dhcp-Ranges': 'dhcpRanges', + 'dhcp-Reservations': 'dhcpReservations', + 'dhcp-Servers': 'dhcpServers', + 'dhcp-Sites': 'dhcpSites', + 'dhcp-State': 'dhcpState', + 'dhcp-Subnets': 'dhcpSubnets', + 'dhcp-Type': 'dhcpType', + 'dhcp-Unique-Key': 'dhcpUniqueKey', + 'dhcp-Update-Time': 'dhcpUpdateTime', + 'documentAuthor': 'documentAuthor', + 'documentIdentifier': 'documentIdentifier', + 'documentLocation': 'documentLocation', + 'documentPublisher': 'documentPublisher', + 'documentTitle': 'documentTitle', + 'documentVersion': 'documentVersion', + 'drink': 'drink', + 'gecos': 'gecos', + 'gidNumber': 'gidNumber', + 'host': 'host', + 'houseIdentifier': 'houseIdentifier', + 'ipHostNumber': 'ipHostNumber', + 'ipNetmaskNumber': 'ipNetmaskNumber', + 'ipNetworkNumber': 'ipNetworkNumber', + 'ipProtocolNumber': 'ipProtocolNumber', + 'ipServicePort': 'ipServicePort', + 'ipServiceProtocol': 'ipServiceProtocol', + 'jpegPhoto': 'jpegPhoto', + 'labeledURI': 'labeledURI', + 'loginShell': 'loginShell', + 'macAddress': 'macAddress', + 'meetingAdvertiseScope': 'meetingAdvertiseScope', + 'meetingApplication': 'meetingApplication', + 'meetingBandwidth': 'meetingBandwidth', + 'meetingBlob': 'meetingBlob', + 'meetingContactInfo': 'meetingContactInfo', + 'meetingDescription': 'meetingDescription', + 'meetingEndTime': 'meetingEndTime', + 'meetingID': 'meetingID', + 'meetingIP': 'meetingIP', + 'meetingIsEncrypted': 'meetingIsEncrypted', + 'meetingKeyword': 'meetingKeyword', + 'meetingLanguage': 'meetingLanguage', + 'meetingLocation': 'meetingLocation', + 'meetingMaxParticipants': 'meetingMaxParticipants', + 'meetingName': 'meetingName', + 'meetingOriginator': 'meetingOriginator', + 'meetingOwner': 'meetingOwner', + 'meetingProtocol': 'meetingProtocol', + 'meetingRating': 'meetingRating', + 'meetingRecurrence': 'meetingRecurrence', + 'meetingScope': 'meetingScope', + 'meetingStartTime': 'meetingStartTime', + 'meetingType': 'meetingType', + 'meetingURL': 'meetingURL', + 'memberNisNetgroup': 'memberNisNetgroup', + 'memberUid': 'memberUid', + 'ms-Authz-Central-Access-Policy-ID': 'msAuthz-CentralAccessPolicyID', + 'ms-Authz-Effective-Security-Policy': 'msAuthz-EffectiveSecurityPolicy', + 'ms-Authz-Last-Effective-Security-Policy': 'msAuthz-LastEffectiveSecurityPolicy', + 'ms-Authz-Member-Rules-In-Central-Access-Policy': 'msAuthz-MemberRulesInCentralAccessPolicy', + 'ms-Authz-Member-Rules-In-Central-Access-Policy-BL': 'msAuthz-MemberRulesInCentralAccessPolicyBL', + 'ms-Authz-Proposed-Security-Policy': 'msAuthz-ProposedSecurityPolicy', + 'ms-Authz-Resource-Condition': 'msAuthz-ResourceCondition', + 'ms-COM-DefaultPartitionLink': 'msCOM-DefaultPartitionLink', + 'ms-COM-ObjectId': 'msCOM-ObjectId', + 'ms-COM-PartitionLink': 'msCOM-PartitionLink', + 'ms-COM-PartitionSetLink': 'msCOM-PartitionSetLink', + 'ms-COM-UserLink': 'msCOM-UserLink', + 'ms-COM-UserPartitionSetLink': 'msCOM-UserPartitionSetLink', + 'ms-DFS-Comment-v2': 'msDFS-Commentv2', + 'ms-DFS-Generation-GUID-v2': 'msDFS-GenerationGUIDv2', + 'ms-DFS-Last-Modified-v2': 'msDFS-LastModifiedv2', + 'ms-DFS-Link-Identity-GUID-v2': 'msDFS-LinkIdentityGUIDv2', + 'ms-DFS-Link-Path-v2': 'msDFS-LinkPathv2', + 'ms-DFS-Link-Security-Descriptor-v2': 'msDFS-LinkSecurityDescriptorv2', + 'ms-DFS-Namespace-Identity-GUID-v2': 'msDFS-NamespaceIdentityGUIDv2', + 'ms-DFS-Properties-v2': 'msDFS-Propertiesv2', + 'ms-DFS-Schema-Major-Version': 'msDFS-SchemaMajorVersion', + 'ms-DFS-Schema-Minor-Version': 'msDFS-SchemaMinorVersion', + 'ms-DFS-Short-Name-Link-Path-v2': 'msDFS-ShortNameLinkPathv2', + 'ms-DFS-Target-List-v2': 'msDFS-TargetListv2', + 'ms-DFS-Ttl-v2': 'msDFS-Ttlv2', + 'ms-DFSR-CachePolicy': 'msDFSR-CachePolicy', + 'ms-DFSR-CommonStagingPath': 'msDFSR-CommonStagingPath', + 'ms-DFSR-CommonStagingSizeInMb': 'msDFSR-CommonStagingSizeInMb', + 'ms-DFSR-ComputerReference': 'msDFSR-ComputerReference', + 'ms-DFSR-ComputerReferenceBL': 'msDFSR-ComputerReferenceBL', + 'ms-DFSR-ConflictPath': 'msDFSR-ConflictPath', + 'ms-DFSR-ConflictSizeInMb': 'msDFSR-ConflictSizeInMb', + 'ms-DFSR-ContentSetGuid': 'msDFSR-ContentSetGuid', + 'ms-DFSR-DefaultCompressionExclusionFilter': 'msDFSR-DefaultCompressionExclusionFilter', + 'ms-DFSR-DeletedPath': 'msDFSR-DeletedPath', + 'ms-DFSR-DeletedSizeInMb': 'msDFSR-DeletedSizeInMb', + 'ms-DFSR-DfsLinkTarget': 'msDFSR-DfsLinkTarget', + 'ms-DFSR-DfsPath': 'msDFSR-DfsPath', + 'ms-DFSR-DirectoryFilter': 'msDFSR-DirectoryFilter', + 'ms-DFSR-DisablePacketPrivacy': 'msDFSR-DisablePacketPrivacy', + 'ms-DFSR-Enabled': 'msDFSR-Enabled', + 'ms-DFSR-Extension': 'msDFSR-Extension', + 'ms-DFSR-FileFilter': 'msDFSR-FileFilter', + 'ms-DFSR-Flags': 'msDFSR-Flags', + 'ms-DFSR-Keywords': 'msDFSR-Keywords', + 'ms-DFSR-MaxAgeInCacheInMin': 'msDFSR-MaxAgeInCacheInMin', + 'ms-DFSR-MemberReference': 'msDFSR-MemberReference', + 'ms-DFSR-MemberReferenceBL': 'msDFSR-MemberReferenceBL', + 'ms-DFSR-MinDurationCacheInMin': 'msDFSR-MinDurationCacheInMin', + 'ms-DFSR-OnDemandExclusionDirectoryFilter': 'msDFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter': 'msDFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options': 'msDFSR-Options', + 'ms-DFSR-Options2': 'msDFSR-Options2', + 'ms-DFSR-Priority': 'msDFSR-Priority', + 'ms-DFSR-RdcEnabled': 'msDFSR-RdcEnabled', + 'ms-DFSR-RdcMinFileSizeInKb': 'msDFSR-RdcMinFileSizeInKb', + 'ms-DFSR-ReadOnly': 'msDFSR-ReadOnly', + 'ms-DFSR-ReplicationGroupGuid': 'msDFSR-ReplicationGroupGuid', + 'ms-DFSR-ReplicationGroupType': 'msDFSR-ReplicationGroupType', + 'ms-DFSR-RootFence': 'msDFSR-RootFence', + 'ms-DFSR-RootPath': 'msDFSR-RootPath', + 'ms-DFSR-RootSizeInMb': 'msDFSR-RootSizeInMb', + 'ms-DFSR-Schedule': 'msDFSR-Schedule', + 'ms-DFSR-StagingCleanupTriggerInPercent': 'msDFSR-StagingCleanupTriggerInPercent', + 'ms-DFSR-StagingPath': 'msDFSR-StagingPath', + 'ms-DFSR-StagingSizeInMb': 'msDFSR-StagingSizeInMb', + 'ms-DFSR-TombstoneExpiryInMin': 'msDFSR-TombstoneExpiryInMin', + 'ms-DFSR-Version': 'msDFSR-Version', + 'ms-DNS-DNSKEY-Record-Set-TTL': 'msDNS-DNSKEYRecordSetTTL', + 'ms-DNS-DNSKEY-Records': 'msDNS-DNSKEYRecords', + 'ms-DNS-DS-Record-Algorithms': 'msDNS-DSRecordAlgorithms', + 'ms-DNS-DS-Record-Set-TTL': 'msDNS-DSRecordSetTTL', + 'ms-DNS-Is-Signed': 'msDNS-IsSigned', + 'ms-DNS-Keymaster-Zones': 'msDNS-KeymasterZones', + 'ms-DNS-Maintain-Trust-Anchor': 'msDNS-MaintainTrustAnchor', + 'ms-DNS-NSEC3-Current-Salt': 'msDNS-NSEC3CurrentSalt', + 'ms-DNS-NSEC3-Hash-Algorithm': 'msDNS-NSEC3HashAlgorithm', + 'ms-DNS-NSEC3-Iterations': 'msDNS-NSEC3Iterations', + 'ms-DNS-NSEC3-OptOut': 'msDNS-NSEC3OptOut', + 'ms-DNS-NSEC3-Random-Salt-Length': 'msDNS-NSEC3RandomSaltLength', + 'ms-DNS-NSEC3-User-Salt': 'msDNS-NSEC3UserSalt', + 'ms-DNS-Parent-Has-Secure-Delegation': 'msDNS-ParentHasSecureDelegation', + 'ms-DNS-Propagation-Time': 'msDNS-PropagationTime', + 'ms-DNS-RFC5011-Key-Rollovers': 'msDNS-RFC5011KeyRollovers', + 'ms-DNS-Secure-Delegation-Polling-Period': 'msDNS-SecureDelegationPollingPeriod', + 'ms-DNS-Sign-With-NSEC3': 'msDNS-SignWithNSEC3', + 'ms-DNS-Signature-Inception-Offset': 'msDNS-SignatureInceptionOffset', + 'ms-DNS-Signing-Key-Descriptors': 'msDNS-SigningKeyDescriptors', + 'ms-DNS-Signing-Keys': 'msDNS-SigningKeys', + 'ms-DS-Additional-Dns-Host-Name': 'msDS-AdditionalDnsHostName', + 'ms-DS-Additional-Sam-Account-Name': 'msDS-AdditionalSamAccountName', + 'ms-DS-Allowed-DNS-Suffixes': 'msDS-AllowedDNSSuffixes', + 'ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity': 'msDS-AllowedToActOnBehalfOfOtherIdentity', + 'ms-DS-Allowed-To-Delegate-To': 'msDS-AllowedToDelegateTo', + 'ms-DS-Applies-To-Resource-Types': 'msDS-AppliesToResourceTypes', + 'ms-DS-Approx-Immed-Subordinates': 'msDS-Approx-Immed-Subordinates', + 'ms-DS-AuthenticatedAt-DC': 'msDS-AuthenticatedAtDC', + 'ms-DS-AuthenticatedTo-Accountlist': 'msDS-AuthenticatedToAccountlist', + 'ms-DS-Auxiliary-Classes': 'msDS-Auxiliary-Classes', + 'ms-DS-Az-Application-Data': 'msDS-AzApplicationData', + 'ms-DS-Az-Application-Name': 'msDS-AzApplicationName', + 'ms-DS-Az-Application-Version': 'msDS-AzApplicationVersion', + 'ms-DS-Az-Biz-Rule': 'msDS-AzBizRule', + 'ms-DS-Az-Biz-Rule-Language': 'msDS-AzBizRuleLanguage', + 'ms-DS-Az-Class-ID': 'msDS-AzClassId', + 'ms-DS-Az-Domain-Timeout': 'msDS-AzDomainTimeout', + 'ms-DS-Az-Generate-Audits': 'msDS-AzGenerateAudits', + 'ms-DS-Az-Generic-Data': 'msDS-AzGenericData', + 'ms-DS-Az-LDAP-Query': 'msDS-AzLDAPQuery', + 'ms-DS-Az-Last-Imported-Biz-Rule-Path': 'msDS-AzLastImportedBizRulePath', + 'ms-DS-Az-Major-Version': 'msDS-AzMajorVersion', + 'ms-DS-Az-Minor-Version': 'msDS-AzMinorVersion', + 'ms-DS-Az-Object-Guid': 'msDS-AzObjectGuid', + 'ms-DS-Az-Operation-ID': 'msDS-AzOperationID', + 'ms-DS-Az-Scope-Name': 'msDS-AzScopeName', + 'ms-DS-Az-Script-Engine-Cache-Max': 'msDS-AzScriptEngineCacheMax', + 'ms-DS-Az-Script-Timeout': 'msDS-AzScriptTimeout', + 'ms-DS-Az-Task-Is-Role-Definition': 'msDS-AzTaskIsRoleDefinition', + 'ms-DS-Behavior-Version': 'msDS-Behavior-Version', + 'ms-DS-BridgeHead-Servers-Used': 'msDS-BridgeHeadServersUsed', + 'ms-DS-Byte-Array': 'msDS-ByteArray', + 'ms-DS-Cached-Membership': 'msDS-Cached-Membership', + 'ms-DS-Cached-Membership-Time-Stamp': 'msDS-Cached-Membership-Time-Stamp', + 'ms-DS-Claim-Attribute-Source': 'msDS-ClaimAttributeSource', + 'ms-DS-Claim-Is-Single-Valued': 'msDS-ClaimIsSingleValued', + 'ms-DS-Claim-Is-Value-Space-Restricted': 'msDS-ClaimIsValueSpaceRestricted', + 'ms-DS-Claim-Possible-Values': 'msDS-ClaimPossibleValues', + 'ms-DS-Claim-Shares-Possible-Values-With': 'msDS-ClaimSharesPossibleValuesWith', + 'ms-DS-Claim-Shares-Possible-Values-With-BL': 'msDS-ClaimSharesPossibleValuesWithBL', + 'ms-DS-Claim-Source': 'msDS-ClaimSource', + 'ms-DS-Claim-Source-Type': 'msDS-ClaimSourceType', + 'ms-DS-Claim-Type-Applies-To-Class': 'msDS-ClaimTypeAppliesToClass', + 'ms-DS-Claim-Value-Type': 'msDS-ClaimValueType', + 'ms-DS-Date-Time': 'msDS-DateTime', + 'ms-DS-Default-Quota': 'msDS-DefaultQuota', + 'ms-DS-Deleted-Object-Lifetime': 'msDS-DeletedObjectLifetime', + 'ms-DS-Disable-For-Instances': 'msDS-DisableForInstances', + 'ms-DS-Disable-For-Instances-BL': 'msDS-DisableForInstancesBL', + 'ms-DS-DnsRootAlias': 'msDS-DnsRootAlias', + 'ms-DS-Egress-Claims-Transformation-Policy': 'msDS-EgressClaimsTransformationPolicy', + 'ms-DS-Enabled-Feature': 'msDS-EnabledFeature', + 'ms-DS-Enabled-Feature-BL': 'msDS-EnabledFeatureBL', + 'ms-DS-Entry-Time-To-Die': 'msDS-Entry-Time-To-Die', + 'ms-DS-ExecuteScriptPassword': 'msDS-ExecuteScriptPassword', + 'ms-DS-External-Key': 'msDS-ExternalKey', + 'ms-DS-External-Store': 'msDS-ExternalStore', + 'ms-DS-Failed-Interactive-Logon-Count': 'msDS-FailedInteractiveLogonCount', + 'ms-DS-Failed-Interactive-Logon-Count-At-Last-Successful-Logon': 'msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon', + 'ms-DS-Filter-Containers': 'msDS-FilterContainers', + 'ms-DS-Generation-Id': 'msDS-GenerationId', + 'ms-DS-GeoCoordinates-Altitude': 'msDS-GeoCoordinatesAltitude', + 'ms-DS-GeoCoordinates-Latitude': 'msDS-GeoCoordinatesLatitude', + 'ms-DS-GeoCoordinates-Longitude': 'msDS-GeoCoordinatesLongitude', + 'ms-DS-GroupMSAMembership': 'msDS-GroupMSAMembership', + 'ms-DS-HAB-Seniority-Index': 'msDS-HABSeniorityIndex', + 'ms-DS-Has-Domain-NCs': 'msDS-HasDomainNCs', + 'ms-DS-Has-Full-Replica-NCs': 'msDS-hasFullReplicaNCs', + 'ms-DS-Has-Instantiated-NCs': 'msDS-HasInstantiatedNCs', + 'ms-DS-Has-Master-NCs': 'msDS-hasMasterNCs', + 'ms-DS-Host-Service-Account': 'msDS-HostServiceAccount', + 'ms-DS-Host-Service-Account-BL': 'msDS-HostServiceAccountBL', + 'ms-DS-Ingress-Claims-Transformation-Policy': 'msDS-IngressClaimsTransformationPolicy', + 'ms-DS-IntId': 'msDS-IntId', + 'ms-DS-Integer': 'msDS-Integer', + 'ms-DS-Is-Domain-For': 'msDS-IsDomainFor', + 'ms-DS-Is-Full-Replica-For': 'msDS-IsFullReplicaFor', + 'ms-DS-Is-Partial-Replica-For': 'msDS-IsPartialReplicaFor', + 'ms-DS-Is-Possible-Values-Present': 'msDS-IsPossibleValuesPresent', + 'ms-DS-Is-Primary-Computer-For': 'msDS-IsPrimaryComputerFor', + 'ms-DS-Is-Used-As-Resource-Security-Attribute': 'msDS-IsUsedAsResourceSecurityAttribute', + 'ms-DS-Is-User-Cachable-At-Rodc': 'msDS-IsUserCachableAtRodc', + 'ms-DS-KeyVersionNumber': 'msDS-KeyVersionNumber', + 'ms-DS-KrbTgt-Link': 'msDS-KrbTgtLink', + 'ms-DS-KrbTgt-Link-BL': 'msDS-KrbTgtLinkBl', + 'ms-DS-Last-Failed-Interactive-Logon-Time': 'msDS-LastFailedInteractiveLogonTime', + 'ms-DS-Last-Known-RDN': 'msDS-LastKnownRDN', + 'ms-DS-Last-Successful-Interactive-Logon-Time': 'msDS-LastSuccessfulInteractiveLogonTime', + 'ms-DS-Lockout-Duration': 'msDS-LockoutDuration', + 'ms-DS-Lockout-Observation-Window': 'msDS-LockoutObservationWindow', + 'ms-DS-Lockout-Threshold': 'msDS-LockoutThreshold', + 'ms-DS-Logon-Time-Sync-Interval': 'msDS-LogonTimeSyncInterval', + 'ms-DS-ManagedPassword': 'msDS-ManagedPassword', + 'ms-DS-ManagedPasswordId': 'msDS-ManagedPasswordId', + 'ms-DS-ManagedPasswordInterval': 'msDS-ManagedPasswordInterval', + 'ms-DS-ManagedPasswordPreviousId': 'msDS-ManagedPasswordPreviousId', + 'ms-DS-Mastered-By': 'msDs-masteredBy', + 'ms-DS-Max-Values': 'msDs-MaxValues', + 'ms-DS-Maximum-Password-Age': 'msDS-MaximumPasswordAge', + 'ms-DS-Members-For-Az-Role': 'msDS-MembersForAzRole', + 'ms-DS-Members-For-Az-Role-BL': 'msDS-MembersForAzRoleBL', + 'ms-DS-Members-Of-Resource-Property-List': 'msDS-MembersOfResourcePropertyList', + 'ms-DS-Members-Of-Resource-Property-List-BL': 'msDS-MembersOfResourcePropertyListBL', + 'ms-DS-Minimum-Password-Age': 'msDS-MinimumPasswordAge', + 'ms-DS-Minimum-Password-Length': 'msDS-MinimumPasswordLength', + 'ms-DS-NC-RO-Replica-Locations': 'msDS-NC-RO-Replica-Locations', + 'ms-DS-NC-RO-Replica-Locations-BL': 'msDS-NC-RO-Replica-Locations-BL', + 'ms-DS-NC-Repl-Cursors': 'msDS-NCReplCursors', + 'ms-DS-NC-Repl-Inbound-Neighbors': 'msDS-NCReplInboundNeighbors', + 'ms-DS-NC-Repl-Outbound-Neighbors': 'msDS-NCReplOutboundNeighbors', + 'ms-DS-NC-Replica-Locations': 'msDS-NC-Replica-Locations', + 'ms-DS-NC-Type': 'msDS-NcType', + 'ms-DS-Never-Reveal-Group': 'msDS-NeverRevealGroup', + 'ms-DS-Non-Members': 'msDS-NonMembers', + 'ms-DS-Non-Members-BL': 'msDS-NonMembersBL', + 'ms-DS-Non-Security-Group-Extra-Classes': 'msDS-Non-Security-Group-Extra-Classes', + 'ms-DS-OIDToGroup-Link': 'msDS-OIDToGroupLink', + 'ms-DS-OIDToGroup-Link-BL': 'msDS-OIDToGroupLinkBl', + 'ms-DS-Object-Reference': 'msDS-ObjectReference', + 'ms-DS-Object-Reference-BL': 'msDS-ObjectReferenceBL', + 'ms-DS-Operations-For-Az-Role': 'msDS-OperationsForAzRole', + 'ms-DS-Operations-For-Az-Role-BL': 'msDS-OperationsForAzRoleBL', + 'ms-DS-Operations-For-Az-Task': 'msDS-OperationsForAzTask', + 'ms-DS-Operations-For-Az-Task-BL': 'msDS-OperationsForAzTaskBL', + 'ms-DS-Optional-Feature-Flags': 'msDS-OptionalFeatureFlags', + 'ms-DS-Optional-Feature-GUID': 'msDS-OptionalFeatureGUID', + 'ms-DS-Other-Settings': 'msDS-Other-Settings', + 'ms-DS-PSO-Applied': 'msDS-PSOApplied', + 'ms-DS-PSO-Applies-To': 'msDS-PSOAppliesTo', + 'ms-DS-Password-Complexity-Enabled': 'msDS-PasswordComplexityEnabled', + 'ms-DS-Password-History-Length': 'msDS-PasswordHistoryLength', + 'ms-DS-Password-Reversible-Encryption-Enabled': 'msDS-PasswordReversibleEncryptionEnabled', + 'ms-DS-Password-Settings-Precedence': 'msDS-PasswordSettingsPrecedence', + 'ms-DS-Phonetic-Company-Name': 'msDS-PhoneticCompanyName', + 'ms-DS-Phonetic-Department': 'msDS-PhoneticDepartment', + 'ms-DS-Phonetic-Display-Name': 'msDS-PhoneticDisplayName', + 'ms-DS-Phonetic-First-Name': 'msDS-PhoneticFirstName', + 'ms-DS-Phonetic-Last-Name': 'msDS-PhoneticLastName', + 'ms-DS-Port-LDAP': 'msDS-PortLDAP', + 'ms-DS-Port-SSL': 'msDS-PortSSL', + 'ms-DS-Preferred-GC-Site': 'msDS-Preferred-GC-Site', + 'ms-DS-Primary-Computer': 'msDS-PrimaryComputer', + 'ms-DS-Principal-Name': 'msDS-PrincipalName', + 'ms-DS-Promotion-Settings': 'msDS-PromotionSettings', + 'ms-DS-Quota-Amount': 'msDS-QuotaAmount', + 'ms-DS-Quota-Effective': 'msDS-QuotaEffective', + 'ms-DS-Quota-Trustee': 'msDS-QuotaTrustee', + 'ms-DS-Quota-Used': 'msDS-QuotaUsed', + 'ms-DS-Repl-Attribute-Meta-Data': 'msDS-ReplAttributeMetaData', + 'ms-DS-Repl-Authentication-Mode': 'msDS-ReplAuthenticationMode', + 'ms-DS-Repl-Value-Meta-Data': 'msDS-ReplValueMetaData', + 'ms-DS-Replication-Notify-First-DSA-Delay': 'msDS-Replication-Notify-First-DSA-Delay', + 'ms-DS-Replication-Notify-Subsequent-DSA-Delay': 'msDS-Replication-Notify-Subsequent-DSA-Delay', + 'ms-DS-ReplicationEpoch': 'msDS-ReplicationEpoch', + 'ms-DS-Required-Domain-Behavior-Version': 'msDS-RequiredDomainBehaviorVersion', + 'ms-DS-Required-Forest-Behavior-Version': 'msDS-RequiredForestBehaviorVersion', + 'ms-DS-Resultant-PSO': 'msDS-ResultantPSO', + 'ms-DS-Retired-Repl-NC-Signatures': 'msDS-RetiredReplNCSignatures', + 'ms-DS-Reveal-OnDemand-Group': 'msDS-RevealOnDemandGroup', + 'ms-DS-Revealed-DSAs': 'msDS-RevealedDSAs', + 'ms-DS-Revealed-List': 'msDS-RevealedList', + 'ms-DS-Revealed-List-BL': 'msDS-RevealedListBL', + 'ms-DS-Revealed-Users': 'msDS-RevealedUsers', + 'ms-DS-SCP-Container': 'msDS-SCPContainer', + 'ms-DS-SD-Reference-Domain': 'msDS-SDReferenceDomain', + 'ms-DS-SPN-Suffixes': 'msDS-SPNSuffixes', + 'ms-DS-Secondary-KrbTgt-Number': 'msDS-SecondaryKrbTgtNumber', + 'ms-DS-Security-Group-Extra-Classes': 'msDS-Security-Group-Extra-Classes', + 'ms-DS-Seniority-Index': 'msDS-SeniorityIndex', + 'ms-DS-Service-Account': 'msDS-ServiceAccount', + 'ms-DS-Service-Account-BL': 'msDS-ServiceAccountBL', + 'ms-DS-Service-Account-DNS-Domain': 'msDS-ServiceAccountDNSDomain', + 'ms-DS-Settings': 'msDS-Settings', + 'ms-DS-Site-Affinity': 'msDS-Site-Affinity', + 'ms-DS-SiteName': 'msDS-SiteName', + 'ms-DS-Source-Object-DN': 'msDS-SourceObjectDN', + 'ms-DS-Supported-Encryption-Types': 'msDS-SupportedEncryptionTypes', + 'ms-DS-TDO-Egress-BL': 'msDS-TDOEgressBL', + 'ms-DS-TDO-Ingress-BL': 'msDS-TDOIngressBL', + 'ms-DS-Tasks-For-Az-Role': 'msDS-TasksForAzRole', + 'ms-DS-Tasks-For-Az-Role-BL': 'msDS-TasksForAzRoleBL', + 'ms-DS-Tasks-For-Az-Task': 'msDS-TasksForAzTask', + 'ms-DS-Tasks-For-Az-Task-BL': 'msDS-TasksForAzTaskBL', + 'ms-DS-Tombstone-Quota-Factor': 'msDS-TombstoneQuotaFactor', + 'ms-DS-Top-Quota-Usage': 'msDS-TopQuotaUsage', + 'ms-DS-Transformation-Rules': 'msDS-TransformationRules', + 'ms-DS-Transformation-Rules-Compiled': 'msDS-TransformationRulesCompiled', + 'ms-DS-Trust-Forest-Trust-Info': 'msDS-TrustForestTrustInfo', + 'ms-DS-USN-Last-Sync-Success': 'msDS-USNLastSyncSuccess', + 'ms-DS-UpdateScript': 'msDS-UpdateScript', + 'ms-DS-User-Account-Auto-Locked': 'ms-DS-UserAccountAutoLocked', + 'ms-DS-User-Account-Control-Computed': 'msDS-User-Account-Control-Computed', + 'ms-DS-User-Account-Disabled': 'msDS-UserAccountDisabled', + 'ms-DS-User-Dont-Expire-Password': 'msDS-UserDontExpirePassword', + 'ms-DS-User-Encrypted-Text-Password-Allowed': 'ms-DS-UserEncryptedTextPasswordAllowed', + 'ms-DS-User-Password-Expired': 'msDS-UserPasswordExpired', + 'ms-DS-User-Password-Expiry-Time-Computed': 'msDS-UserPasswordExpiryTimeComputed', + 'ms-DS-User-Password-Not-Required': 'ms-DS-UserPasswordNotRequired', + 'ms-DS-Value-Type-Reference': 'msDS-ValueTypeReference', + 'ms-DS-Value-Type-Reference-BL': 'msDS-ValueTypeReferenceBL', + 'ms-DS-isGC': 'msDS-isGC', + 'ms-DS-isRODC': 'msDS-isRODC', + 'ms-DS-local-Effective-Deletion-Time': 'msDS-LocalEffectiveDeletionTime', + 'ms-DS-local-Effective-Recycle-Time': 'msDS-LocalEffectiveRecycleTime', + 'ms-Exch-Assistant-Name': 'msExchAssistantName', + 'ms-Exch-House-Identifier': 'msExchHouseIdentifier', + 'ms-Exch-LabeledURI': 'msExchLabeledURI', + 'ms-Exch-Owner-BL': 'ownerBL', + 'ms-FRS-Hub-Member': 'msFRS-Hub-Member', + 'ms-FRS-Topology-Pref': 'msFRS-Topology-Pref', + 'ms-FVE-KeyPackage': 'msFVE-KeyPackage', + 'ms-FVE-RecoveryGuid': 'msFVE-RecoveryGuid', + 'ms-FVE-RecoveryPassword': 'msFVE-RecoveryPassword', + 'ms-FVE-VolumeGuid': 'msFVE-VolumeGuid', + 'ms-IIS-FTP-Dir': 'msIIS-FTPDir', + 'ms-IIS-FTP-Root': 'msIIS-FTPRoot', + 'ms-Imaging-Hash-Algorithm': 'msImaging-HashAlgorithm', + 'ms-Imaging-PSP-Identifier': 'msImaging-PSPIdentifier', + 'ms-Imaging-PSP-String': 'msImaging-PSPString', + 'ms-Imaging-Thumbprint-Hash': 'msImaging-ThumbprintHash', + 'ms-Kds-CreateTime': 'msKds-CreateTime', + 'ms-Kds-DomainID': 'msKds-DomainID', + 'ms-Kds-KDF-AlgorithmID': 'msKds-KDFAlgorithmID', + 'ms-Kds-KDF-Param': 'msKds-KDFParam', + 'ms-Kds-PrivateKey-Length': 'msKds-PrivateKeyLength', + 'ms-Kds-PublicKey-Length': 'msKds-PublicKeyLength', + 'ms-Kds-RootKeyData': 'msKds-RootKeyData', + 'ms-Kds-SecretAgreement-AlgorithmID': 'msKds-SecretAgreementAlgorithmID', + 'ms-Kds-SecretAgreement-Param': 'msKds-SecretAgreementParam', + 'ms-Kds-UseStartTime': 'msKds-UseStartTime', + 'ms-Kds-Version': 'msKds-Version', + 'ms-PKI-AccountCredentials': 'msPKIAccountCredentials', + 'ms-PKI-Cert-Template-OID': 'msPKI-Cert-Template-OID', + 'ms-PKI-Certificate-Application-Policy': 'msPKI-Certificate-Application-Policy', + 'ms-PKI-Certificate-Name-Flag': 'msPKI-Certificate-Name-Flag', + 'ms-PKI-Certificate-Policy': 'msPKI-Certificate-Policy', + 'ms-PKI-Credential-Roaming-Tokens': 'msPKI-CredentialRoamingTokens', + 'ms-PKI-DPAPIMasterKeys': 'msPKIDPAPIMasterKeys', + 'ms-PKI-Enrollment-Flag': 'msPKI-Enrollment-Flag', + 'ms-PKI-Enrollment-Servers': 'msPKI-Enrollment-Servers', + 'ms-PKI-Minimal-Key-Size': 'msPKI-Minimal-Key-Size', + 'ms-PKI-OID-Attribute': 'msPKI-OID-Attribute', + 'ms-PKI-OID-CPS': 'msPKI-OID-CPS', + 'ms-PKI-OID-LocalizedName': 'msPKI-OIDLocalizedName', + 'ms-PKI-OID-User-Notice': 'msPKI-OID-User-Notice', + 'ms-PKI-Private-Key-Flag': 'msPKI-Private-Key-Flag', + 'ms-PKI-RA-Application-Policies': 'msPKI-RA-Application-Policies', + 'ms-PKI-RA-Policies': 'msPKI-RA-Policies', + 'ms-PKI-RA-Signature': 'msPKI-RA-Signature', + 'ms-PKI-RoamingTimeStamp': 'msPKIRoamingTimeStamp', + 'ms-PKI-Site-Name': 'msPKI-Site-Name', + 'ms-PKI-Supersede-Templates': 'msPKI-Supersede-Templates', + 'ms-PKI-Template-Minor-Revision': 'msPKI-Template-Minor-Revision', + 'ms-PKI-Template-Schema-Version': 'msPKI-Template-Schema-Version', + 'ms-RADIUS-FramedInterfaceId': 'msRADIUS-FramedInterfaceId', + 'ms-RADIUS-FramedIpv6Prefix': 'msRADIUS-FramedIpv6Prefix', + 'ms-RADIUS-FramedIpv6Route': 'msRADIUS-FramedIpv6Route', + 'ms-RADIUS-SavedFramedInterfaceId': 'msRADIUS-SavedFramedInterfaceId', + 'ms-RADIUS-SavedFramedIpv6Prefix': 'msRADIUS-SavedFramedIpv6Prefix', + 'ms-RADIUS-SavedFramedIpv6Route': 'msRADIUS-SavedFramedIpv6Route', + 'ms-RRAS-Attribute': 'msRRASAttribute', + 'ms-RRAS-Vendor-Attribute-Entry': 'msRRASVendorAttributeEntry', + 'ms-SPP-CSVLK-Partial-Product-Key': 'msSPP-CSVLKPartialProductKey', + 'ms-SPP-CSVLK-Pid': 'msSPP-CSVLKPid', + 'ms-SPP-CSVLK-Sku-Id': 'msSPP-CSVLKSkuId', + 'ms-SPP-Config-License': 'msSPP-ConfigLicense', + 'ms-SPP-Confirmation-Id': 'msSPP-ConfirmationId', + 'ms-SPP-Installation-Id': 'msSPP-InstallationId', + 'ms-SPP-Issuance-License': 'msSPP-IssuanceLicense', + 'ms-SPP-KMS-Ids': 'msSPP-KMSIds', + 'ms-SPP-Online-License': 'msSPP-OnlineLicense', + 'ms-SPP-Phone-License': 'msSPP-PhoneLicense', + 'ms-TAPI-Conference-Blob': 'msTAPI-ConferenceBlob', + 'ms-TAPI-Ip-Address': 'msTAPI-IpAddress', + 'ms-TAPI-Protocol-Id': 'msTAPI-ProtocolId', + 'ms-TAPI-Unique-Identifier': 'msTAPI-uid', + 'ms-TPM-Owner-Information-Temp': 'msTPM-OwnerInformationTemp', + 'ms-TPM-OwnerInformation': 'msTPM-OwnerInformation', + 'ms-TPM-Srk-Pub-Thumbprint': 'msTPM-SrkPubThumbprint', + 'ms-TPM-Tpm-Information-For-Computer': 'msTPM-TpmInformationForComputer', + 'ms-TPM-Tpm-Information-For-Computer-BL': 'msTPM-TpmInformationForComputerBL', + 'ms-TS-Allow-Logon': 'msTSAllowLogon', + 'ms-TS-Broken-Connection-Action': 'msTSBrokenConnectionAction', + 'ms-TS-Connect-Client-Drives': 'msTSConnectClientDrives', + 'ms-TS-Connect-Printer-Drives': 'msTSConnectPrinterDrives', + 'ms-TS-Default-To-Main-Printer': 'msTSDefaultToMainPrinter', + 'ms-TS-Endpoint-Data': 'msTSEndpointData', + 'ms-TS-Endpoint-Plugin': 'msTSEndpointPlugin', + 'ms-TS-Endpoint-Type': 'msTSEndpointType', + 'ms-TS-Home-Directory': 'msTSHomeDirectory', + 'ms-TS-Home-Drive': 'msTSHomeDrive', + 'ms-TS-Initial-Program': 'msTSInitialProgram', + 'ms-TS-Max-Connection-Time': 'msTSMaxConnectionTime', + 'ms-TS-Max-Disconnection-Time': 'msTSMaxDisconnectionTime', + 'ms-TS-Max-Idle-Time': 'msTSMaxIdleTime', + 'ms-TS-Primary-Desktop': 'msTSPrimaryDesktop', + 'ms-TS-Primary-Desktop-BL': 'msTSPrimaryDesktopBL', + 'ms-TS-Profile-Path': 'msTSProfilePath', + 'ms-TS-Reconnection-Action': 'msTSReconnectionAction', + 'ms-TS-Remote-Control': 'msTSRemoteControl', + 'ms-TS-Secondary-Desktop-BL': 'msTSSecondaryDesktopBL', + 'ms-TS-Secondary-Desktops': 'msTSSecondaryDesktops', + 'ms-TS-Work-Directory': 'msTSWorkDirectory', + 'ms-WMI-Author': 'msWMI-Author', + 'ms-WMI-ChangeDate': 'msWMI-ChangeDate', + 'ms-WMI-Class': 'msWMI-Class', + 'ms-WMI-ClassDefinition': 'msWMI-ClassDefinition', + 'ms-WMI-CreationDate': 'msWMI-CreationDate', + 'ms-WMI-Genus': 'msWMI-Genus', + 'ms-WMI-ID': 'msWMI-ID', + 'ms-WMI-Mof': 'msWMI-Mof', + 'ms-WMI-Name': 'msWMI-Name', + 'ms-WMI-NormalizedClass': 'msWMI-NormalizedClass', + 'ms-WMI-Parm1': 'msWMI-Parm1', + 'ms-WMI-Parm2': 'msWMI-Parm2', + 'ms-WMI-Parm3': 'msWMI-Parm3', + 'ms-WMI-Parm4': 'msWMI-Parm4', + 'ms-WMI-PropertyName': 'msWMI-PropertyName', + 'ms-WMI-Query': 'msWMI-Query', + 'ms-WMI-QueryLanguage': 'msWMI-QueryLanguage', + 'ms-WMI-ScopeGuid': 'msWMI-ScopeGuid', + 'ms-WMI-SourceOrganization': 'msWMI-SourceOrganization', + 'ms-WMI-TargetClass': 'msWMI-TargetClass', + 'ms-WMI-TargetNameSpace': 'msWMI-TargetNameSpace', + 'ms-WMI-TargetObject': 'msWMI-TargetObject', + 'ms-WMI-TargetPath': 'msWMI-TargetPath', + 'ms-WMI-TargetType': 'msWMI-TargetType', + 'ms-WMI-int8Default': 'msWMI-Int8Default', + 'ms-WMI-int8Max': 'msWMI-Int8Max', + 'ms-WMI-int8Min': 'msWMI-Int8Min', + 'ms-WMI-int8ValidValues': 'msWMI-Int8ValidValues', + 'ms-WMI-intDefault': 'msWMI-IntDefault', + 'ms-WMI-intFlags1': 'msWMI-intFlags1', + 'ms-WMI-intFlags2': 'msWMI-intFlags2', + 'ms-WMI-intFlags3': 'msWMI-intFlags3', + 'ms-WMI-intFlags4': 'msWMI-intFlags4', + 'ms-WMI-intMax': 'msWMI-IntMax', + 'ms-WMI-intMin': 'msWMI-IntMin', + 'ms-WMI-intValidValues': 'msWMI-IntValidValues', + 'ms-WMI-stringDefault': 'msWMI-StringDefault', + 'ms-WMI-stringValidValues': 'msWMI-StringValidValues', + 'ms-ds-Schema-Extensions': 'msDs-Schema-Extensions', + 'ms-ieee-80211-Data': 'msieee80211-Data', + 'ms-ieee-80211-Data-Type': 'msieee80211-DataType', + 'ms-ieee-80211-ID': 'msieee80211-ID', + 'ms-net-ieee-80211-GP-PolicyData': 'ms-net-ieee-80211-GP-PolicyData', + 'ms-net-ieee-80211-GP-PolicyGUID': 'ms-net-ieee-80211-GP-PolicyGUID', + 'ms-net-ieee-80211-GP-PolicyReserved': 'ms-net-ieee-80211-GP-PolicyReserved', + 'ms-net-ieee-8023-GP-PolicyData': 'ms-net-ieee-8023-GP-PolicyData', + 'ms-net-ieee-8023-GP-PolicyGUID': 'ms-net-ieee-8023-GP-PolicyGUID', + 'ms-net-ieee-8023-GP-PolicyReserved': 'ms-net-ieee-8023-GP-PolicyReserved', + 'msNPAllowDialin': 'msNPAllowDialin', + 'msNPCalledStationID': 'msNPCalledStationID', + 'msNPCallingStationID': 'msNPCallingStationID', + 'msNPSavedCallingStationID': 'msNPSavedCallingStationID', + 'msRADIUSCallbackNumber': 'msRADIUSCallbackNumber', + 'msRADIUSFramedIPAddress': 'msRADIUSFramedIPAddress', + 'msRADIUSFramedRoute': 'msRADIUSFramedRoute', + 'msRADIUSServiceType': 'msRADIUSServiceType', + 'msRASSavedCallbackNumber': 'msRASSavedCallbackNumber', + 'msRASSavedFramedIPAddress': 'msRASSavedFramedIPAddress', + 'msRASSavedFramedRoute': 'msRASSavedFramedRoute', + 'msSFU-30-Aliases': 'msSFU30Aliases', + 'msSFU-30-Crypt-Method': 'msSFU30CryptMethod', + 'msSFU-30-Domains': 'msSFU30Domains', + 'msSFU-30-Field-Separator': 'msSFU30FieldSeparator', + 'msSFU-30-Intra-Field-Separator': 'msSFU30IntraFieldSeparator', + 'msSFU-30-Is-Valid-Container': 'msSFU30IsValidContainer', + 'msSFU-30-Key-Attributes': 'msSFU30KeyAttributes', + 'msSFU-30-Key-Values': 'msSFU30KeyValues', + 'msSFU-30-Map-Filter': 'msSFU30MapFilter', + 'msSFU-30-Master-Server-Name': 'msSFU30MasterServerName', + 'msSFU-30-Max-Gid-Number': 'msSFU30MaxGidNumber', + 'msSFU-30-Max-Uid-Number': 'msSFU30MaxUidNumber', + 'msSFU-30-NSMAP-Field-Position': 'msSFU30NSMAPFieldPosition', + 'msSFU-30-Name': 'msSFU30Name', + 'msSFU-30-Netgroup-Host-At-Domain': 'msSFU30NetgroupHostAtDomain', + 'msSFU-30-Netgroup-User-At-Domain': 'msSFU30NetgroupUserAtDomain', + 'msSFU-30-Nis-Domain': 'msSFU30NisDomain', + 'msSFU-30-Order-Number': 'msSFU30OrderNumber', + 'msSFU-30-Posix-Member': 'msSFU30PosixMember', + 'msSFU-30-Posix-Member-Of': 'msSFU30PosixMemberOf', + 'msSFU-30-Result-Attributes': 'msSFU30ResultAttributes', + 'msSFU-30-Search-Attributes': 'msSFU30SearchAttributes', + 'msSFU-30-Search-Container': 'msSFU30SearchContainer', + 'msSFU-30-Yp-Servers': 'msSFU30YpServers', + 'netboot-Allow-New-Clients': 'netbootAllowNewClients', + 'netboot-Answer-Only-Valid-Clients': 'netbootAnswerOnlyValidClients', + 'netboot-Answer-Requests': 'netbootAnswerRequests', + 'netboot-Current-Client-Count': 'netbootCurrentClientCount', + 'netboot-IntelliMirror-OSes': 'netbootIntelliMirrorOSes', + 'netboot-Limit-Clients': 'netbootLimitClients', + 'netboot-Locally-Installed-OSes': 'netbootLocallyInstalledOSes', + 'netboot-Max-Clients': 'netbootMaxClients', + 'netboot-New-Machine-Naming-Policy': 'netbootNewMachineNamingPolicy', + 'netboot-New-Machine-OU': 'netbootNewMachineOU', + 'netboot-SCP-BL': 'netbootSCPBL', + 'netboot-Server': 'netbootServer', + 'netboot-Tools': 'netbootTools', + 'nisMapEntry': 'nisMapEntry', + 'nisMapName': 'nisMapName', + 'nisNetgroupTriple': 'nisNetgroupTriple', + 'oncRpcNumber': 'oncRpcNumber', + 'organizationalStatus': 'organizationalStatus', + 'photo': 'photo', + 'preferredLanguage': 'preferredLanguage', + 'roomNumber': 'roomNumber', + 'rpc-Ns-Annotation': 'rpcNsAnnotation', + 'rpc-Ns-Bindings': 'rpcNsBindings', + 'rpc-Ns-Codeset': 'rpcNsCodeset', + 'rpc-Ns-Entry-Flags': 'rpcNsEntryFlags', + 'rpc-Ns-Group': 'rpcNsGroup', + 'rpc-Ns-Interface-ID': 'rpcNsInterfaceID', + 'rpc-Ns-Object-ID': 'rpcNsObjectID', + 'rpc-Ns-Priority': 'rpcNsPriority', + 'rpc-Ns-Profile-Entry': 'rpcNsProfileEntry', + 'rpc-Ns-Transfer-Syntax': 'rpcNsTransferSyntax', + 'secretary': 'secretary', + 'shadowExpire': 'shadowExpire', + 'shadowFlag': 'shadowFlag', + 'shadowInactive': 'shadowInactive', + 'shadowLastChange': 'shadowLastChange', + 'shadowMax': 'shadowMax', + 'shadowMin': 'shadowMin', + 'shadowWarning': 'shadowWarning', + 'uid': 'uid', + 'uidNumber': 'uidNumber', + 'uniqueIdentifier': 'uniqueIdentifier', + 'uniqueMember': 'uniqueMember', + 'unixHomeDirectory': 'unixHomeDirectory', + 'unixUserPassword': 'unixUserPassword', + 'unstructuredAddress': 'unstructuredAddress', + 'unstructuredName': 'unstructuredName', + 'userClass': 'userClass', + 'userPKCS12': 'userPKCS12', + 'x500uniqueIdentifier': 'x500uniqueIdentifier' + }, + + /** + * Knowledge for the Active Directory Schema - Classes + * + * See http://msdn.microsoft.com/en-us/library/windows/desktop/ms680938%28v=vs.85%29.aspx + * + * Each class has a set of direct attributes and a set of auxiliary classes. Thus the + * class will look like this: + * + * 'User': { + * 'ldapname': 'user', + * 'attributes': [ 'Common-Name', 'Given-Name', 'Surname' ], + * 'classes' [ 'Security-Principal', 'Mail-Recipient' ] + * }, + * + * We will add auxiliary classes to the list of object classes to display, then display the + * attributes (which are in CN form, not LDAP form). + * + * The content is generated by get-ad-classes.pl from the MSDN website + */ + adSchemaClasses: { + 'ms-DS-Claim-Type-Property-Base': { + 'classes': [], + 'ldapname': 'msDS-ClaimTypePropertyBase', + 'attributes': [ + 'Enabled', + 'ms-DS-Claim-Possible-Values', + 'ms-DS-Claim-Shares-Possible-Values-With' + ] + }, + 'ms-DS-Claims-Transformation-Policies': { + 'classes': [], + 'ldapname': 'msDS-ClaimsTransformationPolicies', + 'attributes': [] + }, + 'MSMQ-Configuration': { + 'classes': [], + 'ldapname': 'mSMQConfiguration', + 'attributes': [ + 'MSMQ-Computer-Type', + 'MSMQ-Computer-Type-Ex', + 'MSMQ-Dependent-Client-Services', + 'MSMQ-Ds-Services', + 'MSMQ-Encrypt-Key', + 'MSMQ-Foreign', + 'MSMQ-In-Routing-Servers', + 'MSMQ-Journal-Quota', + 'MSMQ-OS-Type', + 'MSMQ-Out-Routing-Servers', + 'MSMQ-Owner-ID', + 'MSMQ-Quota', + 'MSMQ-Routing-Services', + 'MSMQ-Service-Type', + 'MSMQ-Sign-Key', + 'MSMQ-Sites' + ] + }, + 'Com-Connection-Point': { + 'classes': [], + 'ldapname': 'comConnectionPoint', + 'attributes': [ + 'Common-Name', + 'Marshalled-Interface', + 'Moniker', + 'Moniker-Display-Name' + ] + }, + 'ms-DFSR-Content': { + 'classes': [], + 'ldapname': 'msDFSR-Content', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'rpc-Server': { + 'classes': [], + 'ldapname': 'rpcServer', + 'attributes': [ + 'rpc-Ns-Codeset', + 'rpc-Ns-Entry-Flags', + 'rpc-Ns-Object-ID' + ] + }, + 'ms-TPM-Information-Object': { + 'classes': [], + 'ldapname': 'msTPM-InformationObject', + 'attributes': [ + 'ms-TPM-Owner-Information-Temp', + 'ms-TPM-OwnerInformation', + 'ms-TPM-Srk-Pub-Thumbprint' + ] + }, + 'MS-SQL-SQLRepository': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLRepository', + 'attributes': [ + 'MS-SQL-Build', + 'MS-SQL-Contact', + 'MS-SQL-Description', + 'MS-SQL-InformationDirectory', + 'MS-SQL-Name', + 'MS-SQL-Status', + 'MS-SQL-Version' + ] + }, + 'ms-DNS-Server-Settings': { + 'classes': [], + 'ldapname': 'msDNS-ServerSettings', + 'attributes': [ + 'ms-DNS-Keymaster-Zones' + ] + }, + 'MSMQ-Site-Link': { + 'classes': [], + 'ldapname': 'mSMQSiteLink', + 'attributes': [ + 'MSMQ-Cost', + 'MSMQ-Site-1', + 'MSMQ-Site-2', + 'MSMQ-Site-Gates', + 'MSMQ-Site-Gates-Mig' + ] + }, + 'Locality': { + 'classes': [], + 'ldapname': 'locality', + 'attributes': [ + 'Locality-Name', + 'Organization', + 'Search-Guide', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address' + ] + }, + 'NTFRS-Replica-Set': { + 'classes': [], + 'ldapname': 'nTFRSReplicaSet', + 'attributes': [ + 'FRS-DS-Poll', + 'FRS-Directory-Filter', + 'FRS-Extensions', + 'FRS-File-Filter', + 'FRS-Flags', + 'FRS-Level-Limit', + 'FRS-Partner-Auth-Level', + 'FRS-Primary-Member', + 'FRS-Replica-Set-GUID', + 'FRS-Replica-Set-Type', + 'FRS-Root-Security', + 'FRS-Service-Command', + 'FRS-Version-GUID', + 'Managed-By', + 'Schedule', + 'ms-FRS-Hub-Member', + 'ms-FRS-Topology-Pref' + ] + }, + 'ms-WMI-UnknownRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-UnknownRangeParam', + 'attributes': [ + 'ms-WMI-NormalizedClass', + 'ms-WMI-TargetObject' + ] + }, + 'PKI-Enrollment-Service': { + 'classes': [], + 'ldapname': 'pKIEnrollmentService', + 'attributes': [ + 'CA-Certificate', + 'CA-Certificate-DN', + 'Certificate-Templates', + 'DNS-Host-Name', + 'Enrollment-Providers', + 'Signature-Algorithms', + 'ms-PKI-Enrollment-Servers', + 'ms-PKI-Site-Name' + ] + }, + 'rpc-Entry': { + 'classes': [], + 'ldapname': 'rpcEntry', + 'attributes': [] + }, + 'Top': { + 'classes': [], + 'ldapname': 'top', + 'attributes': [ + '', + 'Admin-Description', + 'Admin-Display-Name', + 'Allowed-Attributes', + 'Allowed-Attributes-Effective', + 'Allowed-Child-Classes', + 'Allowed-Child-Classes-Effective', + 'Bridgehead-Server-List-BL', + 'Canonical-Name', + 'Common-Name', + 'Create-Time-Stamp', + 'DS-Core-Propagation-Data', + 'DSA-Signature', + 'Description', + 'Display-Name', + 'Display-Name-Printable', + 'Extension-Name', + 'FRS-Member-Reference-BL', + 'FSMO-Role-Owner', + 'Flags', + 'From-Entry', + 'Frs-Computer-Reference-BL', + 'Instance-Type', + 'Is-Critical-System-Object', + 'Is-Deleted', + 'Is-Member-Of-DL', + 'Is-Privilege-Holder', + 'Is-Recycled', + 'Last-Known-Parent', + 'MS-DS-Consistency-Child-Count', + 'MS-DS-Consistency-Guid', + 'Managed-Objects', + 'Mastered-By', + 'Modify-Time-Stamp', + 'NT-Security-Descriptor', + 'Non-Security-Member-BL', + 'Obj-Dist-Name', + 'Object-Category', + 'Object-Class', + 'Object-Guid', + 'Object-Version', + 'Other-Well-Known-Objects', + 'Partial-Attribute-Deletion-List', + 'Partial-Attribute-Set', + 'Possible-Inferiors', + 'Proxied-Object-Name', + 'Proxy-Addresses', + 'Query-Policy-BL', + 'RDN', + 'Repl-Property-Meta-Data', + 'Repl-UpToDate-Vector', + 'Reports', + 'Reps-From', + 'Reps-To', + 'Revision', + 'SD-Rights-Effective', + 'Server-Reference-BL', + 'Show-In-Advanced-View-Only', + 'Site-Object-BL', + 'Structural-Object-Class', + 'Sub-Refs', + 'SubSchemaSubEntry', + 'System-Flags', + 'USN-Changed', + 'USN-Created', + 'USN-DSA-Last-Obj-Removed', + 'USN-Intersite', + 'USN-Last-Obj-Rem', + 'USN-Source', + 'WWW-Home-Page', + 'WWW-Page-Other', + 'Wbem-Path', + 'Well-Known-Objects', + 'When-Changed', + 'When-Created', + 'ms-COM-PartitionSetLink', + 'ms-COM-UserLink', + 'ms-DFSR-ComputerReferenceBL', + 'ms-DFSR-MemberReferenceBL', + 'ms-DS-Approx-Immed-Subordinates', + 'ms-DS-AuthenticatedTo-Accountlist', + 'ms-DS-Claim-Shares-Possible-Values-With-BL', + 'ms-DS-Disable-For-Instances-BL', + 'ms-DS-Enabled-Feature-BL', + 'ms-DS-Host-Service-Account-BL', + 'ms-DS-Is-Domain-For', + 'ms-DS-Is-Full-Replica-For', + 'ms-DS-Is-Partial-Replica-For', + 'ms-DS-Is-Primary-Computer-For', + 'ms-DS-KrbTgt-Link-BL', + 'ms-DS-Last-Known-RDN', + 'ms-DS-Mastered-By', + 'ms-DS-Members-For-Az-Role-BL', + 'ms-DS-Members-Of-Resource-Property-List-BL', + 'ms-DS-NC-RO-Replica-Locations-BL', + 'ms-DS-NC-Repl-Cursors', + 'ms-DS-NC-Repl-Inbound-Neighbors', + 'ms-DS-NC-Repl-Outbound-Neighbors', + 'ms-DS-NC-Type', + 'ms-DS-Non-Members-BL', + 'ms-DS-OIDToGroup-Link-BL', + 'ms-DS-Object-Reference-BL', + 'ms-DS-Operations-For-Az-Role-BL', + 'ms-DS-Operations-For-Az-Task-BL', + 'ms-DS-PSO-Applied', + 'ms-DS-Principal-Name', + 'ms-DS-Repl-Attribute-Meta-Data', + 'ms-DS-Repl-Value-Meta-Data', + 'ms-DS-Revealed-DSAs', + 'ms-DS-Revealed-List-BL', + 'ms-DS-Service-Account-BL', + 'ms-DS-TDO-Egress-BL', + 'ms-DS-TDO-Ingress-BL', + 'ms-DS-Tasks-For-Az-Role-BL', + 'ms-DS-Tasks-For-Az-Task-BL', + 'ms-DS-Value-Type-Reference-BL', + 'ms-DS-local-Effective-Deletion-Time', + 'ms-DS-local-Effective-Recycle-Time', + 'ms-Exch-Owner-BL', + 'msSFU-30-Posix-Member-Of', + 'netboot-SCP-BL' + ] + }, + 'ms-DS-Resource-Property': { + 'classes': [], + 'ldapname': 'msDS-ResourceProperty', + 'attributes': [ + 'ms-DS-Applies-To-Resource-Types', + 'ms-DS-Is-Used-As-Resource-Security-Attribute', + 'ms-DS-Value-Type-Reference' + ] + }, + 'ms-DFSR-Subscription': { + 'classes': [], + 'ldapname': 'msDFSR-Subscription', + 'attributes': [ + 'ms-DFSR-CachePolicy', + 'ms-DFSR-ConflictPath', + 'ms-DFSR-ConflictSizeInMb', + 'ms-DFSR-ContentSetGuid', + 'ms-DFSR-DeletedPath', + 'ms-DFSR-DeletedSizeInMb', + 'ms-DFSR-DfsLinkTarget', + 'ms-DFSR-Enabled', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-MaxAgeInCacheInMin', + 'ms-DFSR-MinDurationCacheInMin', + 'ms-DFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-ReadOnly', + 'ms-DFSR-ReplicationGroupGuid', + 'ms-DFSR-RootFence', + 'ms-DFSR-RootPath', + 'ms-DFSR-RootSizeInMb', + 'ms-DFSR-StagingCleanupTriggerInPercent', + 'ms-DFSR-StagingPath', + 'ms-DFSR-StagingSizeInMb' + ] + }, + 'ieee802Device': { + 'classes': [], + 'ldapname': 'ieee802Device', + 'attributes': [ + 'Common-Name', + 'macAddress' + ] + }, + 'ms-DFS-Namespace-v2': { + 'classes': [], + 'ldapname': 'msDFS-Namespacev2', + 'attributes': [ + 'ms-DFS-Comment-v2', + 'ms-DFS-Generation-GUID-v2', + 'ms-DFS-Last-Modified-v2', + 'ms-DFS-Namespace-Identity-GUID-v2', + 'ms-DFS-Properties-v2', + 'ms-DFS-Schema-Major-Version', + 'ms-DFS-Schema-Minor-Version', + 'ms-DFS-Target-List-v2', + 'ms-DFS-Ttl-v2' + ] + }, + 'MS-SQL-SQLServer': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLServer', + 'attributes': [ + 'MS-SQL-AppleTalk', + 'MS-SQL-Build', + 'MS-SQL-CharacterSet', + 'MS-SQL-Clustered', + 'MS-SQL-Contact', + 'MS-SQL-GPSHeight', + 'MS-SQL-GPSLatitude', + 'MS-SQL-GPSLongitude', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastUpdatedDate', + 'MS-SQL-Location', + 'MS-SQL-Memory', + 'MS-SQL-MultiProtocol', + 'MS-SQL-Name', + 'MS-SQL-NamedPipe', + 'MS-SQL-RegisteredOwner', + 'MS-SQL-SPX', + 'MS-SQL-ServiceAccount', + 'MS-SQL-SortOrder', + 'MS-SQL-Status', + 'MS-SQL-TCPIP', + 'MS-SQL-UnicodeSortOrder', + 'MS-SQL-Vines' + ] + }, + 'rpc-Group': { + 'classes': [], + 'ldapname': 'rpcGroup', + 'attributes': [ + 'rpc-Ns-Group', + 'rpc-Ns-Object-ID' + ] + }, + 'ms-TAPI-Rt-Conference': { + 'classes': [], + 'ldapname': 'msTAPI-RtConference', + 'attributes': [ + 'ms-TAPI-Conference-Blob', + 'ms-TAPI-Protocol-Id', + 'ms-TAPI-Unique-Identifier' + ] + }, + 'Intellimirror-Group': { + 'classes': [], + 'ldapname': 'intellimirrorGroup', + 'attributes': [] + }, + 'Link-Track-Object-Move-Table': { + 'classes': [], + 'ldapname': 'linkTrackObjectMoveTable', + 'attributes': [] + }, + 'ms-DS-Quota-Container': { + 'classes': [], + 'ldapname': 'msDS-QuotaContainer', + 'attributes': [ + 'Common-Name', + 'ms-DS-Default-Quota', + 'ms-DS-Quota-Effective', + 'ms-DS-Quota-Used', + 'ms-DS-Tombstone-Quota-Factor', + 'ms-DS-Top-Quota-Usage' + ] + }, + 'Print-Queue': { + 'classes': [], + 'ldapname': 'printQueue', + 'attributes': [ + 'Asset-Number', + 'Bytes-Per-Minute', + 'Default-Priority', + 'Driver-Name', + 'Driver-Version', + 'Location', + 'Operating-System', + 'Operating-System-Hotfix', + 'Operating-System-Service-Pack', + 'Operating-System-Version', + 'Physical-Location-Object', + 'Port-Name', + 'Print-Attributes', + 'Print-Bin-Names', + 'Print-Collate', + 'Print-Color', + 'Print-Duplex-Supported', + 'Print-End-Time', + 'Print-Form-Name', + 'Print-Keep-Printed-Jobs', + 'Print-Language', + 'Print-MAC-Address', + 'Print-Max-Copies', + 'Print-Max-Resolution-Supported', + 'Print-Max-X-Extent', + 'Print-Max-Y-Extent', + 'Print-Media-Ready', + 'Print-Media-Supported', + 'Print-Memory', + 'Print-Min-X-Extent', + 'Print-Min-Y-Extent', + 'Print-Network-Address', + 'Print-Notify', + 'Print-Number-Up', + 'Print-Orientations-Supported', + 'Print-Owner', + 'Print-Pages-Per-Minute', + 'Print-Rate', + 'Print-Rate-Unit', + 'Print-Separator-File', + 'Print-Share-Name', + 'Print-Spooling', + 'Print-Stapling-Supported', + 'Print-Start-Time', + 'Print-Status', + 'Printer-Name', + 'Priority', + 'Server-Name', + 'Short-Server-Name', + 'UNC-Name', + 'Version-Number' + ] + }, + 'ms-COM-Partition': { + 'classes': [], + 'ldapname': 'msCOM-Partition', + 'attributes': [ + 'ms-COM-ObjectId' + ] + }, + 'Mail-Recipient': { + 'classes': [], + 'ldapname': 'mailRecipient', + 'attributes': [ + 'Comment', + 'Common-Name', + 'Garbage-Coll-Period', + 'Legacy-Exchange-DN', + 'Show-In-Address-Book', + 'Telephone-Number', + 'Text-Encoded-OR-Address', + 'User-Cert', + 'User-SMIME-Certificate', + 'X509-Cert', + 'labeledURI', + 'ms-DS-GeoCoordinates-Altitude', + 'ms-DS-GeoCoordinates-Latitude', + 'ms-DS-GeoCoordinates-Longitude', + 'ms-DS-Phonetic-Display-Name', + 'ms-Exch-Assistant-Name', + 'ms-Exch-LabeledURI', + 'secretary' + ] + }, + 'Organizational-Role': { + 'classes': [], + 'ldapname': 'organizationalRole', + 'attributes': [ + 'Common-Name', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Locality-Name', + 'Organizational-Unit-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'Role-Occupant', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'X121-Address' + ] + }, + 'ms-DFSR-ContentSet': { + 'classes': [], + 'ldapname': 'msDFSR-ContentSet', + 'attributes': [ + 'Description', + 'ms-DFSR-ConflictSizeInMb', + 'ms-DFSR-DefaultCompressionExclusionFilter', + 'ms-DFSR-DeletedSizeInMb', + 'ms-DFSR-DfsPath', + 'ms-DFSR-DirectoryFilter', + 'ms-DFSR-Extension', + 'ms-DFSR-FileFilter', + 'ms-DFSR-Flags', + 'ms-DFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-Priority', + 'ms-DFSR-RootSizeInMb', + 'ms-DFSR-StagingSizeInMb' + ] + }, + 'ms-FVE-RecoveryInformation': { + 'classes': [], + 'ldapname': 'msFVE-RecoveryInformation', + 'attributes': [ + 'ms-FVE-KeyPackage', + 'ms-FVE-RecoveryGuid', + 'ms-FVE-RecoveryPassword', + 'ms-FVE-VolumeGuid' + ] + }, + 'Dynamic-Object': { + 'classes': [], + 'ldapname': 'dynamicObject', + 'attributes': [ + 'Entry-TTL', + 'ms-DS-Entry-Time-To-Die' + ] + }, + 'Sam-Server': { + 'classes': [], + 'ldapname': 'samServer', + 'attributes': [ + 'SAM-Domain-Updates' + ] + }, + 'ms-net-ieee-80211-GroupPolicy': { + 'classes': [], + 'ldapname': 'ms-net-ieee-80211-GroupPolicy', + 'attributes': [ + 'ms-net-ieee-80211-GP-PolicyData', + 'ms-net-ieee-80211-GP-PolicyGUID', + 'ms-net-ieee-80211-GP-PolicyReserved' + ] + }, + 'NTFRS-Settings': { + 'classes': [], + 'ldapname': 'nTFRSSettings', + 'attributes': [ + 'FRS-Extensions', + 'Managed-By', + 'Organization' + ] + }, + 'FT-Dfs': { + 'classes': [], + 'ldapname': 'fTDfs', + 'attributes': [ + 'Keywords', + 'Managed-By', + 'PKT', + 'PKT-Guid', + 'Remote-Server-Name', + 'UNC-Name' + ] + }, + 'Type-Library': { + 'classes': [], + 'ldapname': 'typeLibrary', + 'attributes': [ + 'COM-ClassID', + 'COM-InterfaceID', + 'COM-Unique-LIBID' + ] + }, + 'CRL-Distribution-Point': { + 'classes': [], + 'ldapname': 'cRLDistributionPoint', + 'attributes': [ + 'Authority-Revocation-List', + 'CRL-Partitioned-Revocation-List', + 'Certificate-Authority-Object', + 'Certificate-Revocation-List', + 'Common-Name', + 'Delta-Revocation-List' + ] + }, + 'Inter-Site-Transport': { + 'classes': [], + 'ldapname': 'interSiteTransport', + 'attributes': [ + 'Options', + 'Repl-Interval', + 'Transport-Address-Attribute', + 'Transport-DLL-Name' + ] + }, + 'Storage': { + 'classes': [], + 'ldapname': 'storage', + 'attributes': [ + 'Icon-Path', + 'Moniker', + 'Moniker-Display-Name' + ] + }, + 'NTDS-Connection': { + 'classes': [], + 'ldapname': 'nTDSConnection', + 'attributes': [ + 'Enabled-Connection', + 'From-Server', + 'Generated-Connection', + 'MS-DS-Replicates-NC-Reason', + 'Options', + 'Schedule', + 'Transport-Type' + ] + }, + 'Cross-Ref-Container': { + 'classes': [], + 'ldapname': 'crossRefContainer', + 'attributes': [ + 'UPN-Suffixes', + 'ms-DS-Behavior-Version', + 'ms-DS-Enabled-Feature', + 'ms-DS-ExecuteScriptPassword', + 'ms-DS-SPN-Suffixes', + 'ms-DS-UpdateScript' + ] + }, + 'ms-Authz-Central-Access-Policies': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessPolicies', + 'attributes': [] + }, + 'Security-Principal': { + 'classes': [], + 'ldapname': 'securityPrincipal', + 'attributes': [ + 'Account-Name-History', + 'Alt-Security-Identities', + 'NT-Security-Descriptor', + 'Object-Sid', + 'Rid', + 'SAM-Account-Name', + 'SAM-Account-Type', + 'SID-History', + 'Security-Identifier', + 'Supplemental-Credentials', + 'Token-Groups', + 'Token-Groups-Global-And-Universal', + 'Token-Groups-No-GC-Acceptable', + 'ms-DS-KeyVersionNumber' + ] + }, + 'ms-DFSR-Topology': { + 'classes': [], + 'ldapname': 'msDFSR-Topology', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'NTDS-Site-Settings': { + 'classes': [], + 'ldapname': 'nTDSSiteSettings', + 'attributes': [ + 'Inter-Site-Topology-Failover', + 'Inter-Site-Topology-Generator', + 'Inter-Site-Topology-Renew', + 'Managed-By', + 'Options', + 'Query-Policy-Object', + 'Schedule', + 'ms-DS-Preferred-GC-Site' + ] + }, + 'Residential-Person': { + 'classes': [], + 'ldapname': 'residentialPerson', + 'attributes': [ + 'Business-Category', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Locality-Name', + 'Organizational-Unit-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'State-Or-Province-Name', + 'Street-Address', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'Title', + 'X121-Address' + ] + }, + 'Attribute-Schema': { + 'classes': [], + 'ldapname': 'attributeSchema', + 'attributes': [ + 'Attribute-ID', + 'Attribute-Security-GUID', + 'Attribute-Syntax', + 'Class-Display-Name', + 'Common-Name', + 'Extended-Chars-Allowed', + 'Is-Defunct', + 'Is-Ephemeral', + 'Is-Member-Of-Partial-Attribute-Set', + 'Is-Single-Valued', + 'LDAP-Display-Name', + 'Link-ID', + 'MAPI-ID', + 'OM-Object-Class', + 'OM-Syntax', + 'Range-Lower', + 'Range-Upper', + 'Schema-Flags-Ex', + 'Schema-ID-GUID', + 'Search-Flags', + 'System-Only', + 'ms-DS-IntId', + 'ms-ds-Schema-Extensions' + ] + }, + 'Ipsec-Filter': { + 'classes': [], + 'ldapname': 'ipsecFilter', + 'attributes': [] + }, + 'Control-Access-Right': { + 'classes': [], + 'ldapname': 'controlAccessRight', + 'attributes': [ + 'Applies-To', + 'Localization-Display-Id', + 'Rights-Guid', + 'Valid-Accesses' + ] + }, + 'Organizational-Unit': { + 'classes': [], + 'ldapname': 'organizationalUnit', + 'attributes': [ + 'Business-Category', + 'Country-Code', + 'Country-Name', + 'Default-Group', + 'Desktop-Profile', + 'Destination-Indicator', + 'Domain-DNS', + 'Facsimile-Telephone-Number', + 'GP-Link', + 'GP-Options', + 'International-ISDN-Number', + 'Locality-Name', + 'Logo', + 'Managed-By', + 'Organizational-Unit-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'Search-Guide', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'Text-Country', + 'UPN-Suffixes', + 'User-Password', + 'X121-Address', + 'ms-COM-UserPartitionSetLink' + ] + }, + 'msSFU-30-Domain-Info': { + 'classes': [], + 'ldapname': 'msSFU30DomainInfo', + 'attributes': [ + 'msSFU-30-Crypt-Method', + 'msSFU-30-Domains', + 'msSFU-30-Is-Valid-Container', + 'msSFU-30-Master-Server-Name', + 'msSFU-30-Max-Gid-Number', + 'msSFU-30-Max-Uid-Number', + 'msSFU-30-Order-Number', + 'msSFU-30-Search-Container', + 'msSFU-30-Yp-Servers' + ] + }, + 'ACS-Resource-Limits': { + 'classes': [], + 'ldapname': 'aCSResourceLimits', + 'attributes': [ + 'ACS-Allocable-RSVP-Bandwidth', + 'ACS-Max-Peak-Bandwidth', + 'ACS-Max-Peak-Bandwidth-Per-Flow', + 'ACS-Max-Token-Rate-Per-Flow', + 'ACS-Service-Type' + ] + }, + 'Group': { + 'classes': [ + 'Security-Principal', + 'Mail-Recipient' + ], + 'ldapname': 'group', + 'attributes': [ + 'Admin-Count', + 'Control-Access-Rights', + 'Desktop-Profile', + 'E-mail-Addresses', + 'Group-Attributes', + 'Group-Membership-SAM', + 'Group-Type', + 'Managed-By', + 'Member', + 'NT-Group-Members', + 'Non-Security-Member', + 'Operator-Count', + 'Primary-Group-Token', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Biz-Rule', + 'ms-DS-Az-Biz-Rule-Language', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-LDAP-Query', + 'ms-DS-Az-Last-Imported-Biz-Rule-Path', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Non-Members', + 'ms-DS-Primary-Computer', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'msSFU-30-Posix-Member' + ] + }, + 'Contact': { + 'classes': [ + 'Mail-Recipient' + ], + 'ldapname': 'contact', + 'attributes': [ + 'Additional-Information', + 'Common-Name', + 'ms-DS-Source-Object-DN' + ] + }, + 'ms-DS-Service-Connection-Point-Publication-Service': { + 'classes': [], + 'ldapname': 'msDS-ServiceConnectionPointPublicationService', + 'attributes': [ + 'Enabled', + 'Keywords', + 'ms-DS-Disable-For-Instances', + 'ms-DS-SCP-Container' + ] + }, + 'Device': { + 'classes': [], + 'ldapname': 'device', + 'attributes': [ + 'Common-Name', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Owner', + 'See-Also', + 'Serial-Number', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Computer': { + 'classes': [], + 'ldapname': 'computer', + 'attributes': [ + 'Catalogs', + 'Common-Name', + 'DNS-Host-Name', + 'Default-Local-Policy-Object', + 'Local-Policy-Flags', + 'Location', + 'MS-TS-Property01', + 'MS-TS-Property02', + 'Machine-Role', + 'Managed-By', + 'Netboot-GUID', + 'Netboot-Initialization', + 'Netboot-Machine-File-Path', + 'Netboot-Mirror-Data-File', + 'Netboot-SIF-File', + 'Network-Address', + 'Operating-System', + 'Operating-System-Hotfix', + 'Operating-System-Service-Pack', + 'Operating-System-Version', + 'Physical-Location-Object', + 'Policy-Replication-Flags', + 'RID-Set-References', + 'Site-GUID', + 'Volume-Count', + 'ms-DS-Additional-Dns-Host-Name', + 'ms-DS-Additional-Sam-Account-Name', + 'ms-DS-AuthenticatedAt-DC', + 'ms-DS-ExecuteScriptPassword', + 'ms-DS-Generation-Id', + 'ms-DS-Host-Service-Account', + 'ms-DS-Is-User-Cachable-At-Rodc', + 'ms-DS-KrbTgt-Link', + 'ms-DS-Never-Reveal-Group', + 'ms-DS-Promotion-Settings', + 'ms-DS-Reveal-OnDemand-Group', + 'ms-DS-Revealed-List', + 'ms-DS-Revealed-Users', + 'ms-DS-SiteName', + 'ms-DS-isGC', + 'ms-DS-isRODC', + 'ms-Imaging-Hash-Algorithm', + 'ms-Imaging-Thumbprint-Hash', + 'ms-TPM-OwnerInformation', + 'ms-TPM-Tpm-Information-For-Computer', + 'ms-TS-Endpoint-Data', + 'ms-TS-Endpoint-Plugin', + 'ms-TS-Endpoint-Type', + 'ms-TS-Primary-Desktop-BL', + 'ms-TS-Secondary-Desktop-BL', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Display-Specifier': { + 'classes': [], + 'ldapname': 'displaySpecifier', + 'attributes': [ + 'Admin-Context-Menu', + 'Admin-Multiselect-Property-Pages', + 'Admin-Property-Pages', + 'Attribute-Display-Names', + 'Class-Display-Name', + 'Context-Menu', + 'Create-Dialog', + 'Create-Wizard-Ext', + 'Creation-Wizard', + 'Extra-Columns', + 'Icon-Path', + 'Query-Filter', + 'Scope-Flags', + 'Shell-Context-Menu', + 'Shell-Property-Pages', + 'Treat-As-Leaf' + ] + }, + 'DS-UI-Settings': { + 'classes': [], + 'ldapname': 'dSUISettings', + 'attributes': [ + 'DS-UI-Admin-Maximum', + 'DS-UI-Admin-Notification', + 'DS-UI-Shell-Maximum', + 'ms-DS-Filter-Containers', + 'ms-DS-Non-Security-Group-Extra-Classes', + 'ms-DS-Security-Group-Extra-Classes' + ] + }, + 'ms-DS-Resource-Properties': { + 'classes': [], + 'ldapname': 'msDS-ResourceProperties', + 'attributes': [] + }, + 'ms-DFSR-Subscriber': { + 'classes': [], + 'ldapname': 'msDFSR-Subscriber', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-MemberReference', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-ReplicationGroupGuid' + ] + }, + 'Server': { + 'classes': [], + 'ldapname': 'server', + 'attributes': [ + 'Bridgehead-Transport-List', + 'DNS-Host-Name', + 'Managed-By', + 'NETBIOS-Name', + 'SMTP-Mail-Address', + 'Serial-Number', + 'Server-Reference', + 'ms-DS-Is-User-Cachable-At-Rodc', + 'ms-DS-SiteName', + 'ms-DS-isGC', + 'ms-DS-isRODC' + ] + }, + 'Index-Server-Catalog': { + 'classes': [], + 'ldapname': 'indexServerCatalog', + 'attributes': [ + 'Creator', + 'Friendly-Names', + 'IndexedScopes', + 'QueryPoint', + 'UNC-Name' + ] + }, + 'Security-Object': { + 'classes': [], + 'ldapname': 'securityObject', + 'attributes': [ + 'Common-Name' + ] + }, + 'Secret': { + 'classes': [], + 'ldapname': 'secret', + 'attributes': [ + 'Current-Value', + 'Last-Set-Time', + 'Prior-Set-Time', + 'Prior-Value' + ] + }, + 'ms-WMI-ShadowObject': { + 'classes': [], + 'ldapname': 'msWMI-ShadowObject', + 'attributes': [ + 'ms-WMI-TargetObject' + ] + }, + 'ms-Imaging-PSPs': { + 'classes': [], + 'ldapname': 'msImaging-PSPs', + 'attributes': [] + }, + 'ms-WMI-PolicyType': { + 'classes': [], + 'ldapname': 'msWMI-PolicyType', + 'attributes': [ + 'ms-WMI-Author', + 'ms-WMI-ChangeDate', + 'ms-WMI-CreationDate', + 'ms-WMI-ID', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-SourceOrganization', + 'ms-WMI-TargetObject', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'documentSeries': { + 'classes': [], + 'ldapname': 'documentSeries', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'See-Also', + 'Telephone-Number' + ] + }, + 'Display-Template': { + 'classes': [], + 'ldapname': 'displayTemplate', + 'attributes': [ + 'Address-Entry-Display-Table', + 'Address-Entry-Display-Table-MSDOS', + 'Common-Name', + 'Help-Data16', + 'Help-Data32', + 'Help-File-Name', + 'Original-Display-Table', + 'Original-Display-Table-MSDOS' + ] + }, + 'ms-WMI-WMIGPO': { + 'classes': [], + 'ldapname': 'msWMI-WMIGPO', + 'attributes': [ + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-TargetClass', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'ms-WMI-RangeParam': { + 'classes': [], + 'ldapname': 'msWMI-RangeParam', + 'attributes': [ + 'ms-WMI-PropertyName', + 'ms-WMI-TargetClass', + 'ms-WMI-TargetType' + ] + }, + 'MS-SQL-OLAPServer': { + 'classes': [], + 'ldapname': 'mS-SQL-OLAPServer', + 'attributes': [ + 'MS-SQL-Build', + 'MS-SQL-Contact', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-Language', + 'MS-SQL-Name', + 'MS-SQL-PublicationURL', + 'MS-SQL-RegisteredOwner', + 'MS-SQL-ServiceAccount', + 'MS-SQL-Status', + 'MS-SQL-Version' + ] + }, + 'MSMQ-Settings': { + 'classes': [], + 'ldapname': 'mSMQSettings', + 'attributes': [ + 'MSMQ-Dependent-Client-Service', + 'MSMQ-Ds-Service', + 'MSMQ-Migrated', + 'MSMQ-Nt4-Flags', + 'MSMQ-Owner-ID', + 'MSMQ-QM-ID', + 'MSMQ-Routing-Service', + 'MSMQ-Services', + 'MSMQ-Site-Name', + 'MSMQ-Site-Name-Ex' + ] + }, + 'RRAS-Administration-Connection-Point': { + 'classes': [], + 'ldapname': 'rRASAdministrationConnectionPoint', + 'attributes': [ + 'ms-RRAS-Attribute' + ] + }, + 'rpc-Server-Element': { + 'classes': [], + 'ldapname': 'rpcServerElement', + 'attributes': [ + 'rpc-Ns-Bindings', + 'rpc-Ns-Interface-ID', + 'rpc-Ns-Transfer-Syntax' + ] + }, + 'ms-Print-ConnectionPolicy': { + 'classes': [], + 'ldapname': 'msPrint-ConnectionPolicy', + 'attributes': [ + 'Common-Name', + 'Print-Attributes', + 'Printer-Name', + 'Server-Name', + 'UNC-Name' + ] + }, + 'NTFRS-Subscriber': { + 'classes': [], + 'ldapname': 'nTFRSSubscriber', + 'attributes': [ + 'FRS-Extensions', + 'FRS-Fault-Condition', + 'FRS-Flags', + 'FRS-Member-Reference', + 'FRS-Root-Path', + 'FRS-Service-Command', + 'FRS-Service-Command-Status', + 'FRS-Staging-Path', + 'FRS-Time-Last-Command', + 'FRS-Time-Last-Config-Change', + 'FRS-Update-Timeout', + 'Schedule' + ] + }, + 'nisObject': { + 'classes': [], + 'ldapname': 'nisObject', + 'attributes': [ + 'Common-Name', + 'Description', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapEntry', + 'nisMapName' + ] + }, + 'ms-DS-Az-Role': { + 'classes': [], + 'ldapname': 'msDS-AzRole', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Members-For-Az-Role', + 'ms-DS-Operations-For-Az-Role', + 'ms-DS-Tasks-For-Az-Role' + ] + }, + 'ms-DFSR-ReplicationGroup': { + 'classes': [], + 'ldapname': 'msDFSR-ReplicationGroup', + 'attributes': [ + 'Description', + 'ms-DFSR-ConflictSizeInMb', + 'ms-DFSR-DefaultCompressionExclusionFilter', + 'ms-DFSR-DeletedSizeInMb', + 'ms-DFSR-DirectoryFilter', + 'ms-DFSR-Extension', + 'ms-DFSR-FileFilter', + 'ms-DFSR-Flags', + 'ms-DFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-ReplicationGroupType', + 'ms-DFSR-RootSizeInMb', + 'ms-DFSR-Schedule', + 'ms-DFSR-StagingSizeInMb', + 'ms-DFSR-TombstoneExpiryInMin', + 'ms-DFSR-Version' + ] + }, + 'ms-COM-PartitionSet': { + 'classes': [], + 'ldapname': 'msCOM-PartitionSet', + 'attributes': [ + 'ms-COM-DefaultPartitionLink', + 'ms-COM-ObjectId', + 'ms-COM-PartitionLink' + ] + }, + 'ms-DS-Az-Scope': { + 'classes': [], + 'ldapname': 'msDS-AzScope', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Scope-Name' + ] + }, + 'bootableDevice': { + 'classes': [], + 'ldapname': 'bootableDevice', + 'attributes': [ + 'Common-Name', + 'bootFile', + 'bootParameter' + ] + }, + 'posixGroup': { + 'classes': [], + 'ldapname': 'posixGroup', + 'attributes': [ + 'Common-Name', + 'Description', + 'User-Password', + 'gidNumber', + 'memberUid', + 'unixUserPassword' + ] + }, + 'MS-SQL-OLAPCube': { + 'classes': [], + 'ldapname': 'mS-SQL-OLAPCube', + 'attributes': [ + 'MS-SQL-Contact', + 'MS-SQL-Description', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastUpdatedDate', + 'MS-SQL-Name', + 'MS-SQL-PublicationURL', + 'MS-SQL-Size', + 'MS-SQL-Status' + ] + }, + 'friendlyCountry': { + 'classes': [], + 'ldapname': 'friendlyCountry', + 'attributes': [ + 'Text-Country' + ] + }, + 'rpc-Profile-Element': { + 'classes': [], + 'ldapname': 'rpcProfileElement', + 'attributes': [ + 'rpc-Ns-Annotation', + 'rpc-Ns-Interface-ID', + 'rpc-Ns-Priority', + 'rpc-Ns-Profile-Entry' + ] + }, + 'ms-DS-Group-Managed-Service-Account': { + 'classes': [], + 'ldapname': 'msDS-GroupManagedServiceAccount', + 'attributes': [ + 'ms-DS-GroupMSAMembership', + 'ms-DS-ManagedPassword', + 'ms-DS-ManagedPasswordId', + 'ms-DS-ManagedPasswordInterval', + 'ms-DS-ManagedPasswordPreviousId' + ] + }, + 'DSA': { + 'classes': [], + 'ldapname': 'dSA', + 'attributes': [ + 'Knowledge-Information' + ] + }, + 'Subnet-Container': { + 'classes': [], + 'ldapname': 'subnetContainer', + 'attributes': [] + }, + 'ms-DS-Managed-Service-Account': { + 'classes': [], + 'ldapname': 'msDS-ManagedServiceAccount', + 'attributes': [] + }, + 'ms-DFSR-Connection': { + 'classes': [], + 'ldapname': 'msDFSR-Connection', + 'attributes': [ + 'From-Server', + 'ms-DFSR-DisablePacketPrivacy', + 'ms-DFSR-Enabled', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Keywords', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-Priority', + 'ms-DFSR-RdcEnabled', + 'ms-DFSR-RdcMinFileSizeInKb', + 'ms-DFSR-Schedule' + ] + }, + 'ms-DS-Bind-Proxy': { + 'classes': [], + 'ldapname': 'msDS-BindProxy', + 'attributes': [ + 'Object-Sid', + 'ms-DS-Principal-Name' + ] + }, + 'MSMQ-Migrated-User': { + 'classes': [], + 'ldapname': 'mSMQMigratedUser', + 'attributes': [ + 'MSMQ-Digests', + 'MSMQ-Digests-Mig', + 'MSMQ-Sign-Certificates', + 'MSMQ-Sign-Certificates-Mig', + 'MSMQ-User-Sid', + 'Object-Sid' + ] + }, + 'ms-DFS-Deleted-Link-v2': { + 'classes': [], + 'ldapname': 'msDFS-DeletedLinkv2', + 'attributes': [ + 'ms-DFS-Comment-v2', + 'ms-DFS-Last-Modified-v2', + 'ms-DFS-Link-Identity-GUID-v2', + 'ms-DFS-Link-Path-v2', + 'ms-DFS-Namespace-Identity-GUID-v2', + 'ms-DFS-Short-Name-Link-Path-v2' + ] + }, + 'ms-WMI-UintRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-UintRangeParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intMax', + 'ms-WMI-intMin' + ] + }, + 'ms-WMI-IntRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-IntRangeParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intMax', + 'ms-WMI-intMin' + ] + }, + 'inetOrgPerson': { + 'classes': [], + 'ldapname': 'inetOrgPerson', + 'attributes': [ + 'Address-Home', + 'Business-Category', + 'Display-Name', + 'E-mail-Addresses', + 'Employee-Number', + 'Employee-Type', + 'Given-Name', + 'Initials', + 'Manager', + 'Organization-Name', + 'Phone-Home-Primary', + 'Phone-Mobile-Primary', + 'Phone-Pager-Primary', + 'User-SMIME-Certificate', + 'X509-Cert', + 'audio', + 'carLicense', + 'departmentNumber', + 'jpegPhoto', + 'labeledURI', + 'photo', + 'preferredLanguage', + 'roomNumber', + 'secretary', + 'uid', + 'userPKCS12', + 'x500uniqueIdentifier' + ] + }, + 'Physical-Location': { + 'classes': [], + 'ldapname': 'physicalLocation', + 'attributes': [ + 'Configuration', + 'Managed-By' + ] + }, + 'simpleSecurityObject': { + 'classes': [], + 'ldapname': 'simpleSecurityObject', + 'attributes': [ + 'User-Password' + ] + }, + 'RID-Set': { + 'classes': [], + 'ldapname': 'rIDSet', + 'attributes': [ + 'RID-Allocation-Pool', + 'RID-Next-RID', + 'RID-Previous-Allocation-Pool', + 'RID-Used-Pool' + ] + }, + 'Person': { + 'classes': [], + 'ldapname': 'person', + 'attributes': [ + 'Common-Name', + 'See-Also', + 'Serial-Number', + 'Surname', + 'Telephone-Number', + 'User-Password', + 'attributeCertificateAttribute' + ] + }, + 'Application-Version': { + 'classes': [], + 'ldapname': 'applicationVersion', + 'attributes': [ + 'App-Schema-Version', + 'Keywords', + 'Managed-By', + 'Owner', + 'Vendor', + 'Version-Number', + 'Version-Number-Hi', + 'Version-Number-Lo' + ] + }, + 'Foreign-Security-Principal': { + 'classes': [], + 'ldapname': 'foreignSecurityPrincipal', + 'attributes': [ + 'Foreign-Identifier', + 'Object-Sid' + ] + }, + 'ms-WMI-IntSetParam': { + 'classes': [], + 'ldapname': 'msWMI-IntSetParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intValidValues' + ] + }, + 'Connection-Point': { + 'classes': [], + 'ldapname': 'connectionPoint', + 'attributes': [ + 'Common-Name', + 'Keywords', + 'Managed-By', + 'ms-DS-Settings' + ] + }, + 'ms-WMI-Som': { + 'classes': [], + 'ldapname': 'msWMI-Som', + 'attributes': [ + 'ms-WMI-Author', + 'ms-WMI-ChangeDate', + 'ms-WMI-CreationDate', + 'ms-WMI-ID', + 'ms-WMI-Name', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-SourceOrganization', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'ms-WMI-PolicyTemplate': { + 'classes': [], + 'ldapname': 'msWMI-PolicyTemplate', + 'attributes': [ + 'ms-WMI-Author', + 'ms-WMI-ChangeDate', + 'ms-WMI-CreationDate', + 'ms-WMI-ID', + 'ms-WMI-Name', + 'ms-WMI-NormalizedClass', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-SourceOrganization', + 'ms-WMI-TargetClass', + 'ms-WMI-TargetNameSpace', + 'ms-WMI-TargetPath', + 'ms-WMI-TargetType', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'Service-Administration-Point': { + 'classes': [], + 'ldapname': 'serviceAdministrationPoint', + 'attributes': [] + }, + 'Volume': { + 'classes': [], + 'ldapname': 'volume', + 'attributes': [ + 'Content-Indexing-Allowed', + 'Last-Content-Indexed', + 'UNC-Name' + ] + }, + 'document': { + 'classes': [], + 'ldapname': 'document', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'See-Also', + 'documentAuthor', + 'documentIdentifier', + 'documentLocation', + 'documentPublisher', + 'documentTitle', + 'documentVersion' + ] + }, + 'Application-Site-Settings': { + 'classes': [], + 'ldapname': 'applicationSiteSettings', + 'attributes': [ + 'Application-Name', + 'Notification-List' + ] + }, + 'Application-Settings': { + 'classes': [], + 'ldapname': 'applicationSettings', + 'attributes': [ + 'Application-Name', + 'Notification-List', + 'ms-DS-Settings' + ] + }, + 'Servers-Container': { + 'classes': [], + 'ldapname': 'serversContainer', + 'attributes': [] + }, + 'Domain': { + 'classes': [], + 'ldapname': 'domain', + 'attributes': [ + 'Domain-Component', + 'Organization' + ] + }, + 'Group-Of-Names': { + 'classes': [], + 'ldapname': 'groupOfNames', + 'attributes': [ + 'Business-Category', + 'Common-Name', + 'Member', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Owner', + 'See-Also' + ] + }, + 'ms-DS-Az-Application': { + 'classes': [], + 'ldapname': 'msDS-AzApplication', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Application-Name', + 'ms-DS-Az-Application-Version', + 'ms-DS-Az-Class-ID', + 'ms-DS-Az-Generate-Audits', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid' + ] + }, + 'ipHost': { + 'classes': [], + 'ldapname': 'ipHost', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Manager', + 'ipHostNumber', + 'uid' + ] + }, + 'ms-WMI-MergeablePolicyTemplate': { + 'classes': [], + 'ldapname': 'msWMI-MergeablePolicyTemplate', + 'attributes': [] + }, + 'Ipsec-ISAKMP-Policy': { + 'classes': [], + 'ldapname': 'ipsecISAKMPPolicy', + 'attributes': [] + }, + 'ms-WMI-UintSetParam': { + 'classes': [], + 'ldapname': 'msWMI-UintSetParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intValidValues' + ] + }, + 'Ipsec-Negotiation-Policy': { + 'classes': [], + 'ldapname': 'ipsecNegotiationPolicy', + 'attributes': [ + 'IPSEC-Negotiation-Policy-Action', + 'IPSEC-Negotiation-Policy-Type' + ] + }, + 'Ipsec-NFA': { + 'classes': [], + 'ldapname': 'ipsecNFA', + 'attributes': [ + 'Ipsec-Filter-Reference', + 'Ipsec-Negotiation-Policy-Reference' + ] + }, + 'ms-net-ieee-8023-GroupPolicy': { + 'classes': [], + 'ldapname': 'ms-net-ieee-8023-GroupPolicy', + 'attributes': [ + 'ms-net-ieee-8023-GP-PolicyData', + 'ms-net-ieee-8023-GP-PolicyGUID', + 'ms-net-ieee-8023-GP-PolicyReserved' + ] + }, + 'Country': { + 'classes': [], + 'ldapname': 'country', + 'attributes': [ + 'Country-Name', + 'Search-Guide', + 'Text-Country' + ] + }, + 'ipNetwork': { + 'classes': [], + 'ldapname': 'ipNetwork', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Manager', + 'ipNetmaskNumber', + 'ipNetworkNumber', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName', + 'uid' + ] + }, + 'Leaf': { + 'classes': [], + 'ldapname': 'leaf', + 'attributes': [] + }, + 'MSMQ-Enterprise-Settings': { + 'classes': [], + 'ldapname': 'mSMQEnterpriseSettings', + 'attributes': [ + 'MSMQ-CSP-Name', + 'MSMQ-Interval1', + 'MSMQ-Interval2', + 'MSMQ-Long-Lived', + 'MSMQ-Name-Style', + 'MSMQ-Version' + ] + }, + 'Application-Entity': { + 'classes': [], + 'ldapname': 'applicationEntity', + 'attributes': [ + 'Common-Name', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Presentation-Address', + 'See-Also', + 'Supported-Application-Context' + ] + }, + 'Organizational-Person': { + 'classes': [], + 'ldapname': 'organizationalPerson', + 'attributes': [ + 'Address', + 'Address-Home', + 'Assistant', + 'Company', + 'Country-Code', + 'Country-Name', + 'Department', + 'Destination-Indicator', + 'Division', + 'E-mail-Addresses', + 'Employee-ID', + 'Facsimile-Telephone-Number', + 'Generation-Qualifier', + 'Given-Name', + 'Initials', + 'International-ISDN-Number', + 'Locality-Name', + 'Logo', + 'MHS-OR-Address', + 'Manager', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Other-Mailbox', + 'Other-Name', + 'Personal-Title', + 'Phone-Fax-Other', + 'Phone-Home-Other', + 'Phone-Home-Primary', + 'Phone-ISDN-Primary', + 'Phone-Ip-Other', + 'Phone-Ip-Primary', + 'Phone-Mobile-Other', + 'Phone-Mobile-Primary', + 'Phone-Office-Other', + 'Phone-Pager-Other', + 'Phone-Pager-Primary', + 'Physical-Delivery-Office-Name', + 'Picture', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'State-Or-Province-Name', + 'Street-Address', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'Telex-Primary', + 'Text-Country', + 'Title', + 'User-Comment', + 'X121-Address', + 'houseIdentifier', + 'ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity', + 'ms-DS-Allowed-To-Delegate-To', + 'ms-DS-HAB-Seniority-Index', + 'ms-DS-Phonetic-Company-Name', + 'ms-DS-Phonetic-Department', + 'ms-DS-Phonetic-Display-Name', + 'ms-DS-Phonetic-First-Name', + 'ms-DS-Phonetic-Last-Name', + 'ms-Exch-House-Identifier' + ] + }, + 'Domain-DNS': { + 'classes': [ + 'Sam-Domain' + ], + 'ldapname': 'domainDNS', + 'attributes': [ + '', + 'Managed-By', + 'ms-DS-Allowed-DNS-Suffixes', + 'ms-DS-Behavior-Version', + 'ms-DS-Enabled-Feature', + 'ms-DS-USN-Last-Sync-Success' + ] + }, + 'Infrastructure-Update': { + 'classes': [], + 'ldapname': 'infrastructureUpdate', + 'attributes': [ + 'DN-Reference-Update', + 'Domain' + ] + }, + 'File-Link-Tracking-Entry': { + 'classes': [], + 'ldapname': 'fileLinkTrackingEntry', + 'attributes': [] + }, + 'MS-SQL-SQLDatabase': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLDatabase', + 'attributes': [ + 'MS-SQL-Alias', + 'MS-SQL-Applications', + 'MS-SQL-Contact', + 'MS-SQL-CreationDate', + 'MS-SQL-Description', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastBackupDate', + 'MS-SQL-LastDiagnosticDate', + 'MS-SQL-Name', + 'MS-SQL-Size', + 'MS-SQL-Status' + ] + }, + 'MS-SQL-SQLPublication': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLPublication', + 'attributes': [ + 'MS-SQL-AllowAnonymousSubscription', + 'MS-SQL-AllowImmediateUpdatingSubscription', + 'MS-SQL-AllowKnownPullSubscription', + 'MS-SQL-AllowQueuedUpdatingSubscription', + 'MS-SQL-AllowSnapshotFilesFTPDownloading', + 'MS-SQL-Database', + 'MS-SQL-Description', + 'MS-SQL-Name', + 'MS-SQL-Publisher', + 'MS-SQL-Status', + 'MS-SQL-ThirdParty', + 'MS-SQL-Type' + ] + }, + 'PKI-Certificate-Template': { + 'classes': [], + 'ldapname': 'pKICertificateTemplate', + 'attributes': [ + 'Display-Name', + 'Flags', + 'PKI-Critical-Extensions', + 'PKI-Default-CSPs', + 'PKI-Default-Key-Spec', + 'PKI-Enrollment-Access', + 'PKI-Expiration-Period', + 'PKI-Extended-Key-Usage', + 'PKI-Key-Usage', + 'PKI-Max-Issuing-Depth', + 'PKI-Overlap-Period', + 'ms-PKI-Cert-Template-OID', + 'ms-PKI-Certificate-Application-Policy', + 'ms-PKI-Certificate-Name-Flag', + 'ms-PKI-Certificate-Policy', + 'ms-PKI-Enrollment-Flag', + 'ms-PKI-Minimal-Key-Size', + 'ms-PKI-Private-Key-Flag', + 'ms-PKI-RA-Application-Policies', + 'ms-PKI-RA-Policies', + 'ms-PKI-RA-Signature', + 'ms-PKI-Supersede-Templates', + 'ms-PKI-Template-Minor-Revision', + 'ms-PKI-Template-Schema-Version' + ] + }, + 'ipProtocol': { + 'classes': [], + 'ldapname': 'ipProtocol', + 'attributes': [ + 'Common-Name', + 'Description', + 'ipProtocolNumber', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'msSFU-30-Mail-Aliases': { + 'classes': [], + 'ldapname': 'msSFU30MailAliases', + 'attributes': [ + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'ms-WMI-Rule': { + 'classes': [], + 'ldapname': 'msWMI-Rule', + 'attributes': [ + 'ms-WMI-Query', + 'ms-WMI-QueryLanguage', + 'ms-WMI-TargetNameSpace' + ] + }, + 'Package-Registration': { + 'classes': [], + 'ldapname': 'packageRegistration', + 'attributes': [ + 'COM-ClassID', + 'COM-InterfaceID', + 'COM-ProgID', + 'COM-Typelib-Id', + 'Can-Upgrade-Script', + 'Categories', + 'File-Ext-Priority', + 'Icon-Path', + 'Install-Ui-Level', + 'Last-Update-Sequence', + 'Locale-ID', + 'Machine-Architecture', + 'Managed-By', + 'Msi-File-List', + 'Msi-Script', + 'Msi-Script-Name', + 'Msi-Script-Path', + 'Msi-Script-Size', + 'Package-Flags', + 'Package-Name', + 'Package-Type', + 'Product-Code', + 'Setup-Command', + 'Upgrade-Product-Code', + 'Vendor', + 'Version-Number-Hi', + 'Version-Number-Lo' + ] + }, + 'MSMQ-Custom-Recipient': { + 'classes': [], + 'ldapname': 'msMQ-Custom-Recipient', + 'attributes': [ + 'MSMQ-Recipient-FormatName' + ] + }, + 'Application-Process': { + 'classes': [], + 'ldapname': 'applicationProcess', + 'attributes': [ + 'Common-Name', + 'Locality-Name', + 'Organizational-Unit-Name', + 'See-Also' + ] + }, + 'ms-DS-Value-Type': { + 'classes': [], + 'ldapname': 'msDS-ValueType', + 'attributes': [ + 'ms-DS-Claim-Is-Single-Valued', + 'ms-DS-Claim-Is-Value-Space-Restricted', + 'ms-DS-Claim-Value-Type', + 'ms-DS-Is-Possible-Values-Present' + ] + }, + 'ms-DS-App-Data': { + 'classes': [], + 'ldapname': 'msDS-AppData', + 'attributes': [ + 'Keywords', + 'Managed-By', + 'Owner', + 'ms-DS-Byte-Array', + 'ms-DS-Date-Time', + 'ms-DS-Integer', + 'ms-DS-Object-Reference' + ] + }, + 'Service-Connection-Point': { + 'classes': [], + 'ldapname': 'serviceConnectionPoint', + 'attributes': [ + 'App-Schema-Version', + 'Service-Binding-Information', + 'Service-Class-Name', + 'Service-DNS-Name', + 'Service-DNS-Name-Type', + 'Vendor', + 'Version-Number', + 'Version-Number-Hi', + 'Version-Number-Lo' + ] + }, + 'ms-DS-Az-Operation': { + 'classes': [], + 'ldapname': 'msDS-AzOperation', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Operation-ID' + ] + }, + 'ms-Kds-Prov-RootKey': { + 'classes': [], + 'ldapname': 'msKds-ProvRootKey', + 'attributes': [ + 'Common-Name', + 'ms-Kds-CreateTime', + 'ms-Kds-DomainID', + 'ms-Kds-KDF-AlgorithmID', + 'ms-Kds-KDF-Param', + 'ms-Kds-PrivateKey-Length', + 'ms-Kds-PublicKey-Length', + 'ms-Kds-RootKeyData', + 'ms-Kds-SecretAgreement-AlgorithmID', + 'ms-Kds-SecretAgreement-Param', + 'ms-Kds-UseStartTime', + 'ms-Kds-Version' + ] + }, + 'Site-Link': { + 'classes': [], + 'ldapname': 'siteLink', + 'attributes': [ + 'Cost', + 'Options', + 'Repl-Interval', + 'Schedule', + 'Site-List' + ] + }, + 'ms-SPP-Activation-Object': { + 'classes': [], + 'ldapname': 'msSPP-ActivationObject', + 'attributes': [ + 'ms-SPP-CSVLK-Partial-Product-Key', + 'ms-SPP-CSVLK-Pid', + 'ms-SPP-CSVLK-Sku-Id', + 'ms-SPP-Config-License', + 'ms-SPP-Confirmation-Id', + 'ms-SPP-Installation-Id', + 'ms-SPP-Issuance-License', + 'ms-SPP-KMS-Ids', + 'ms-SPP-Online-License', + 'ms-SPP-Phone-License' + ] + }, + 'Domain-Policy': { + 'classes': [], + 'ldapname': 'domainPolicy', + 'attributes': [ + 'Authentication-Options', + 'Default-Local-Policy-Object', + 'Domain-Certificate-Authorities', + 'Domain-Policy-Reference', + 'Domain-Wide-Policy', + 'EFSPolicy', + 'Force-Logoff', + 'Ipsec-Policy-Reference', + 'Lock-Out-Observation-Window', + 'Lockout-Duration', + 'Lockout-Threshold', + 'Managed-By', + 'Max-Pwd-Age', + 'Max-Renew-Age', + 'Max-Ticket-Age', + 'Min-Pwd-Age', + 'Min-Pwd-Length', + 'Min-Ticket-Age', + 'Proxy-Lifetime', + 'Public-Key-Policy', + 'Pwd-History-Length', + 'Pwd-Properties', + 'Quality-Of-Service' + ] + }, + 'ms-WMI-SimplePolicyTemplate': { + 'classes': [], + 'ldapname': 'msWMI-SimplePolicyTemplate', + 'attributes': [ + 'ms-WMI-TargetObject' + ] + }, + 'ms-TAPI-Rt-Person': { + 'classes': [], + 'ldapname': 'msTAPI-RtPerson', + 'attributes': [ + 'ms-TAPI-Ip-Address', + 'ms-TAPI-Unique-Identifier' + ] + }, + 'Class-Schema': { + 'classes': [], + 'ldapname': 'classSchema', + 'attributes': [ + 'Auxiliary-Class', + 'Class-Display-Name', + 'Common-Name', + 'Default-Hiding-Value', + 'Default-Object-Category', + 'Default-Security-Descriptor', + 'Governs-ID', + 'Is-Defunct', + 'LDAP-Display-Name', + 'May-Contain', + 'Must-Contain', + 'Object-Class-Category', + 'Poss-Superiors', + 'RDN-Att-ID', + 'Schema-Flags-Ex', + 'Schema-ID-GUID', + 'Sub-Class-Of', + 'System-Auxiliary-Class', + 'System-May-Contain', + 'System-Must-Contain', + 'System-Only', + 'System-Poss-Superiors', + 'ms-DS-IntId', + 'ms-ds-Schema-Extensions' + ] + }, + 'Intellimirror-SCP': { + 'classes': [], + 'ldapname': 'intellimirrorSCP', + 'attributes': [ + 'Netboot-Machine-File-Path', + 'netboot-Allow-New-Clients', + 'netboot-Answer-Only-Valid-Clients', + 'netboot-Answer-Requests', + 'netboot-Current-Client-Count', + 'netboot-IntelliMirror-OSes', + 'netboot-Limit-Clients', + 'netboot-Locally-Installed-OSes', + 'netboot-Max-Clients', + 'netboot-New-Machine-Naming-Policy', + 'netboot-New-Machine-OU', + 'netboot-Server', + 'netboot-Tools' + ] + }, + 'DHCP-Class': { + 'classes': [], + 'ldapname': 'dHCPClass', + 'attributes': [ + 'Mscope-Id', + 'Network-Address', + 'Option-Description', + 'Options-Location', + 'Super-Scope-Description', + 'Super-Scopes', + 'dhcp-Classes', + 'dhcp-Flags', + 'dhcp-Identification', + 'dhcp-Mask', + 'dhcp-MaxKey', + 'dhcp-Obj-Description', + 'dhcp-Obj-Name', + 'dhcp-Options', + 'dhcp-Properties', + 'dhcp-Ranges', + 'dhcp-Reservations', + 'dhcp-Servers', + 'dhcp-Sites', + 'dhcp-State', + 'dhcp-Subnets', + 'dhcp-Type', + 'dhcp-Unique-Key', + 'dhcp-Update-Time' + ] + }, + 'groupOfUniqueNames': { + 'classes': [], + 'ldapname': 'groupOfUniqueNames', + 'attributes': [ + 'Business-Category', + 'Common-Name', + 'Description', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Owner', + 'See-Also', + 'uniqueMember' + ] + }, + 'msSFU-30-Network-User': { + 'classes': [], + 'ldapname': 'msSFU30NetworkUser', + 'attributes': [ + 'msSFU-30-Key-Values', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Link-Track-OMT-Entry': { + 'classes': [], + 'ldapname': 'linkTrackOMTEntry', + 'attributes': [ + 'Birth-Location', + 'Current-Location', + 'OMT-Guid', + 'OMT-Indx-Guid', + 'Time-Refresh' + ] + }, + 'Site-Link-Bridge': { + 'classes': [], + 'ldapname': 'siteLinkBridge', + 'attributes': [ + 'Site-Link-List' + ] + }, + 'Certification-Authority': { + 'classes': [], + 'ldapname': 'certificationAuthority', + 'attributes': [ + 'Authority-Revocation-List', + 'CA-Certificate', + 'CA-Certificate-DN', + 'CA-Connect', + 'CA-Usages', + 'CA-WEB-URL', + 'CRL-Object', + 'Certificate-Revocation-List', + 'Certificate-Templates', + 'Common-Name', + 'Cross-Certificate-Pair', + 'Current-Parent-CA', + 'DNS-Host-Name', + 'Delta-Revocation-List', + 'Domain-ID', + 'Domain-Policy-Object', + 'Enrollment-Providers', + 'Parent-CA', + 'Parent-CA-Certificate-Chain', + 'Pending-CA-Certificates', + 'Pending-Parent-CA', + 'Previous-CA-Certificates', + 'Previous-Parent-CA', + 'Search-Guide', + 'Signature-Algorithms', + 'Supported-Application-Context', + 'Teletex-Terminal-Identifier' + ] + }, + 'Dfs-Configuration': { + 'classes': [], + 'ldapname': 'dfsConfiguration', + 'attributes': [] + }, + 'Link-Track-Vol-Entry': { + 'classes': [], + 'ldapname': 'linkTrackVolEntry', + 'attributes': [ + 'Curr-Machine-Id', + 'Link-Track-Secret', + 'Object-Count', + 'Seq-Notification', + 'Time-Refresh', + 'Time-Vol-Change', + 'Vol-Table-GUID', + 'Vol-Table-Idx-GUID' + ] + }, + 'NTDS-DSA': { + 'classes': [], + 'ldapname': 'nTDSDSA', + 'attributes': [ + 'DMD-Location', + 'FRS-Root-Path', + 'Has-Master-NCs', + 'Has-Partial-Replica-NCs', + 'Invocation-Id', + 'Last-Backup-Restoration-Time', + 'Managed-By', + 'Network-Address', + 'Options', + 'Query-Policy-Object', + 'Retired-Repl-DSA-Signatures', + 'Server-Reference', + 'ms-DS-Behavior-Version', + 'ms-DS-Enabled-Feature', + 'ms-DS-Has-Domain-NCs', + 'ms-DS-Has-Full-Replica-NCs', + 'ms-DS-Has-Instantiated-NCs', + 'ms-DS-Has-Master-NCs', + 'ms-DS-Is-User-Cachable-At-Rodc', + 'ms-DS-Never-Reveal-Group', + 'ms-DS-Port-LDAP', + 'ms-DS-Port-SSL', + 'ms-DS-ReplicationEpoch', + 'ms-DS-Retired-Repl-NC-Signatures', + 'ms-DS-Reveal-OnDemand-Group', + 'ms-DS-Revealed-Users', + 'ms-DS-Service-Account', + 'ms-DS-Service-Account-DNS-Domain', + 'ms-DS-SiteName', + 'ms-DS-isGC', + 'ms-DS-isRODC' + ] + }, + 'ms-Authz-Central-Access-Policy': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessPolicy', + 'attributes': [ + 'ms-Authz-Central-Access-Policy-ID', + 'ms-Authz-Member-Rules-In-Central-Access-Policy' + ] + }, + 'oncRpc': { + 'classes': [], + 'ldapname': 'oncRpc', + 'attributes': [ + 'Common-Name', + 'Description', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName', + 'oncRpcNumber' + ] + }, + 'ms-DS-Quota-Control': { + 'classes': [], + 'ldapname': 'msDS-QuotaControl', + 'attributes': [ + 'Common-Name', + 'ms-DS-Quota-Amount', + 'ms-DS-Quota-Trustee' + ] + }, + 'Rpc-Container': { + 'classes': [], + 'ldapname': 'rpcContainer', + 'attributes': [ + 'Name-Service-Flags' + ] + }, + 'ms-DS-App-Configuration': { + 'classes': [], + 'ldapname': 'msDS-App-Configuration', + 'attributes': [ + 'Keywords', + 'Managed-By', + 'Owner', + 'ms-DS-Byte-Array', + 'ms-DS-Date-Time', + 'ms-DS-Integer', + 'ms-DS-Object-Reference' + ] + }, + 'DMD': { + 'classes': [], + 'ldapname': 'dMD', + 'attributes': [ + 'Common-Name', + 'DMD-Name', + 'Prefix-Map', + 'Schema-Info', + 'Schema-Update', + 'ms-DS-IntId', + 'ms-DS-USN-Last-Sync-Success', + 'ms-ds-Schema-Extensions' + ] + }, + 'ms-DS-Claims-Transformation-Policy-Type': { + 'classes': [], + 'ldapname': 'msDS-ClaimsTransformationPolicyType', + 'attributes': [ + 'ms-DS-Transformation-Rules', + 'ms-DS-Transformation-Rules-Compiled' + ] + }, + 'ms-Kds-Prov-ServerConfiguration': { + 'classes': [], + 'ldapname': 'msKds-ProvServerConfiguration', + 'attributes': [ + 'ms-Kds-KDF-AlgorithmID', + 'ms-Kds-KDF-Param', + 'ms-Kds-PrivateKey-Length', + 'ms-Kds-PublicKey-Length', + 'ms-Kds-SecretAgreement-AlgorithmID', + 'ms-Kds-SecretAgreement-Param', + 'ms-Kds-Version' + ] + }, + 'Subnet': { + 'classes': [], + 'ldapname': 'subnet', + 'attributes': [ + 'Location', + 'Physical-Location-Object', + 'Site-Object' + ] + }, + 'Group-Policy-Container': { + 'classes': [], + 'ldapname': 'groupPolicyContainer', + 'attributes': [ + 'Flags', + 'GPC-File-Sys-Path', + 'GPC-Functionality-Version', + 'GPC-Machine-Extension-Names', + 'GPC-User-Extension-Names', + 'GPC-WQL-Filter', + 'Version-Number' + ] + }, + 'Container': { + 'classes': [], + 'ldapname': 'container', + 'attributes': [ + 'Common-Name', + 'Default-Class-Store', + 'Organizational-Unit', + 'Schema-Version', + 'ms-DS-Object-Reference' + ] + }, + 'ms-PKI-Enterprise-Oid': { + 'classes': [], + 'ldapname': 'msPKI-Enterprise-Oid', + 'attributes': [ + 'Container', + 'ms-DS-OIDToGroup-Link', + 'ms-PKI-Cert-Template-OID', + 'ms-PKI-OID-Attribute', + 'ms-PKI-OID-CPS', + 'ms-PKI-OID-LocalizedName', + 'ms-PKI-OID-User-Notice' + ] + }, + 'msSFU-30-NIS-Map-Config': { + 'classes': [], + 'ldapname': 'msSFU30NISMapConfig', + 'attributes': [ + 'msSFU-30-Field-Separator', + 'msSFU-30-Intra-Field-Separator', + 'msSFU-30-Key-Attributes', + 'msSFU-30-Map-Filter', + 'msSFU-30-NSMAP-Field-Position', + 'msSFU-30-Result-Attributes', + 'msSFU-30-Search-Attributes' + ] + }, + 'Class-Store': { + 'classes': [], + 'ldapname': 'classStore', + 'attributes': [ + 'App-Schema-Version', + 'Container', + 'Last-Update-Sequence', + 'Next-Level-Store', + 'Version-Number' + ] + }, + 'MS-SQL-OLAPDatabase': { + 'classes': [], + 'ldapname': 'mS-SQL-OLAPDatabase', + 'attributes': [ + 'MS-SQL-Applications', + 'MS-SQL-ConnectionURL', + 'MS-SQL-Contact', + 'MS-SQL-Description', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastBackupDate', + 'MS-SQL-LastUpdatedDate', + 'MS-SQL-Name', + 'MS-SQL-PublicationURL', + 'MS-SQL-Size', + 'MS-SQL-Status', + 'MS-SQL-Type' + ] + }, + 'Lost-And-Found': { + 'classes': [], + 'ldapname': 'lostAndFound', + 'attributes': [ + 'Move-Tree-State' + ] + }, + 'Remote-Mail-Recipient': { + 'classes': [ + 'Mail-Recipient' + ], + 'ldapname': 'remoteMailRecipient', + 'attributes': [ + 'Managed-By', + 'Remote-Source', + 'Remote-Source-Type' + ] + }, + 'Builtin-Domain': { + 'classes': [ + 'Sam-Domain-Base' + ], + 'ldapname': 'builtinDomain', + 'attributes': [] + }, + 'ms-DS-Resource-Property-List': { + 'classes': [], + 'ldapname': 'msDS-ResourcePropertyList', + 'attributes': [ + 'ms-DS-Members-Of-Resource-Property-List' + ] + }, + 'ipService': { + 'classes': [], + 'ldapname': 'ipService', + 'attributes': [ + 'Common-Name', + 'Description', + 'ipServicePort', + 'ipServiceProtocol', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'room': { + 'classes': [], + 'ldapname': 'room', + 'attributes': [ + 'Common-Name', + 'Description', + 'Location', + 'See-Also', + 'Telephone-Number', + 'roomNumber' + ] + }, + 'shadowAccount': { + 'classes': [], + 'ldapname': 'shadowAccount', + 'attributes': [ + 'Description', + 'User-Password', + 'shadowExpire', + 'shadowFlag', + 'shadowInactive', + 'shadowLastChange', + 'shadowMax', + 'shadowMin', + 'shadowWarning', + 'uid' + ] + }, + 'Service-Class': { + 'classes': [], + 'ldapname': 'serviceClass', + 'attributes': [ + 'Display-Name', + 'Service-Class-ID', + 'Service-Class-Info' + ] + }, + 'NTDS-DSA-RO': { + 'classes': [], + 'ldapname': 'nTDSDSARO', + 'attributes': [] + }, + 'NTFRS-Member': { + 'classes': [], + 'ldapname': 'nTFRSMember', + 'attributes': [ + 'FRS-Control-Data-Creation', + 'FRS-Control-Inbound-Backlog', + 'FRS-Control-Outbound-Backlog', + 'FRS-Extensions', + 'FRS-Flags', + 'FRS-Partner-Auth-Level', + 'FRS-Root-Security', + 'FRS-Service-Command', + 'FRS-Update-Timeout', + 'Frs-Computer-Reference', + 'Server-Reference' + ] + }, + 'Site': { + 'classes': [], + 'ldapname': 'site', + 'attributes': [ + 'GP-Link', + 'GP-Options', + 'Location', + 'MSMQ-Interval1', + 'MSMQ-Interval2', + 'MSMQ-Nt4-Stub', + 'MSMQ-Site-Foreign', + 'MSMQ-Site-ID', + 'Managed-By', + 'Notification-List', + 'ms-DS-BridgeHead-Servers-Used' + ] + }, + 'Cross-Ref': { + 'classes': [], + 'ldapname': 'crossRef', + 'attributes': [ + 'Common-Name', + 'Dns-Root', + 'Enabled', + 'NC-Name', + 'NETBIOS-Name', + 'NT-Mixed-Domain', + 'Root-Trust', + 'Superior-DNS-Root', + 'Trust-Parent', + 'ms-DS-Behavior-Version', + 'ms-DS-DnsRootAlias', + 'ms-DS-NC-RO-Replica-Locations', + 'ms-DS-NC-Replica-Locations', + 'ms-DS-Replication-Notify-First-DSA-Delay', + 'ms-DS-Replication-Notify-Subsequent-DSA-Delay', + 'ms-DS-SD-Reference-Domain' + ] + }, + 'ms-DFS-Link-v2': { + 'classes': [], + 'ldapname': 'msDFS-Linkv2', + 'attributes': [ + 'ms-DFS-Comment-v2', + 'ms-DFS-Generation-GUID-v2', + 'ms-DFS-Last-Modified-v2', + 'ms-DFS-Link-Identity-GUID-v2', + 'ms-DFS-Link-Path-v2', + 'ms-DFS-Link-Security-Descriptor-v2', + 'ms-DFS-Namespace-Identity-GUID-v2', + 'ms-DFS-Properties-v2', + 'ms-DFS-Short-Name-Link-Path-v2', + 'ms-DFS-Target-List-v2', + 'ms-DFS-Ttl-v2' + ] + }, + 'ms-DS-Bindable-Object': { + 'classes': [], + 'ldapname': 'msDS-BindableObject', + 'attributes': [ + 'Account-Expires', + 'Bad-Password-Time', + 'Bad-Pwd-Count', + 'Last-Logon-Timestamp', + 'Lockout-Time', + 'Nt-Pwd-History', + 'Pwd-Last-Set', + 'Unicode-Pwd', + 'ms-DS-User-Account-Auto-Locked', + 'ms-DS-User-Account-Control-Computed', + 'ms-DS-User-Account-Disabled', + 'ms-DS-User-Dont-Expire-Password', + 'ms-DS-User-Encrypted-Text-Password-Allowed', + 'ms-DS-User-Password-Expired', + 'ms-DS-User-Password-Not-Required' + ] + }, + 'File-Link-Tracking': { + 'classes': [], + 'ldapname': 'fileLinkTracking', + 'attributes': [] + }, + 'Class-Registration': { + 'classes': [], + 'ldapname': 'classRegistration', + 'attributes': [ + 'COM-CLSID', + 'COM-InterfaceID', + 'COM-Other-Prog-Id', + 'COM-ProgID', + 'COM-Treat-As-Class-Id', + 'Implemented-Categories', + 'Managed-By', + 'Required-Categories' + ] + }, + 'Configuration': { + 'classes': [], + 'ldapname': 'configuration', + 'attributes': [ + 'Common-Name', + 'GP-Link', + 'GP-Options', + 'ms-DS-Repl-Authentication-Mode', + 'ms-DS-USN-Last-Sync-Success' + ] + }, + 'ms-SPP-Activation-Objects-Container': { + 'classes': [], + 'ldapname': 'msSPP-ActivationObjectsContainer', + 'attributes': [] + }, + 'Organization': { + 'classes': [], + 'ldapname': 'organization', + 'attributes': [ + 'Business-Category', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Locality-Name', + 'Organization-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'Search-Guide', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'User-Password', + 'X121-Address' + ] + }, + 'Trusted-Domain': { + 'classes': [], + 'ldapname': 'trustedDomain', + 'attributes': [ + 'Additional-Trusted-Service-Names', + 'Domain-Cross-Ref', + 'Domain-Identifier', + 'Flat-Name', + 'Initial-Auth-Incoming', + 'Initial-Auth-Outgoing', + 'MS-DS-Creator-SID', + 'Security-Identifier', + 'Trust-Attributes', + 'Trust-Auth-Incoming', + 'Trust-Auth-Outgoing', + 'Trust-Direction', + 'Trust-Partner', + 'Trust-Posix-Offset', + 'Trust-Type', + 'ms-DS-Egress-Claims-Transformation-Policy', + 'ms-DS-Ingress-Claims-Transformation-Policy', + 'ms-DS-Supported-Encryption-Types', + 'ms-DS-Trust-Forest-Trust-Info' + ] + }, + 'ms-Imaging-PostScanProcess': { + 'classes': [], + 'ldapname': 'msImaging-PostScanProcess', + 'attributes': [ + 'Display-Name', + 'Server-Name', + 'ms-Imaging-PSP-Identifier', + 'ms-Imaging-PSP-String' + ] + }, + 'MSMQ-Queue': { + 'classes': [], + 'ldapname': 'mSMQQueue', + 'attributes': [ + 'MSMQ-Authenticate', + 'MSMQ-Base-Priority', + 'MSMQ-Journal', + 'MSMQ-Label', + 'MSMQ-Label-Ex', + 'MSMQ-Multicast-Address', + 'MSMQ-Owner-ID', + 'MSMQ-Privacy-Level', + 'MSMQ-Queue-Journal-Quota', + 'MSMQ-Queue-Name-Ext', + 'MSMQ-Queue-Quota', + 'MSMQ-Queue-Type', + 'MSMQ-Secured-Source', + 'MSMQ-Transactional' + ] + }, + 'Dns-Node': { + 'classes': [], + 'ldapname': 'dnsNode', + 'attributes': [ + 'DNS-Property', + 'DNS-Tombstoned', + 'Dns-Record', + 'Domain-Component' + ] + }, + 'ms-DS-Claim-Type': { + 'classes': [], + 'ldapname': 'msDS-ClaimType', + 'attributes': [ + 'ms-DS-Claim-Attribute-Source', + 'ms-DS-Claim-Is-Single-Valued', + 'ms-DS-Claim-Is-Value-Space-Restricted', + 'ms-DS-Claim-Source', + 'ms-DS-Claim-Source-Type', + 'ms-DS-Claim-Type-Applies-To-Class', + 'ms-DS-Claim-Value-Type' + ] + }, + 'ms-DFSR-LocalSettings': { + 'classes': [], + 'ldapname': 'msDFSR-LocalSettings', + 'attributes': [ + 'ms-DFSR-CommonStagingPath', + 'ms-DFSR-CommonStagingSizeInMb', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-StagingCleanupTriggerInPercent', + 'ms-DFSR-Version' + ] + }, + 'ms-Authz-Central-Access-Rules': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessRules', + 'attributes': [] + }, + 'MSMQ-Group': { + 'classes': [], + 'ldapname': 'msMQ-Group', + 'attributes': [ + 'Member' + ] + }, + 'ms-DS-Password-Settings': { + 'classes': [], + 'ldapname': 'msDS-PasswordSettings', + 'attributes': [ + 'ms-DS-Lockout-Duration', + 'ms-DS-Lockout-Observation-Window', + 'ms-DS-Lockout-Threshold', + 'ms-DS-Maximum-Password-Age', + 'ms-DS-Minimum-Password-Age', + 'ms-DS-Minimum-Password-Length', + 'ms-DS-PSO-Applies-To', + 'ms-DS-Password-Complexity-Enabled', + 'ms-DS-Password-History-Length', + 'ms-DS-Password-Reversible-Encryption-Enabled', + 'ms-DS-Password-Settings-Precedence' + ] + }, + 'ms-DFSR-Member': { + 'classes': [], + 'ldapname': 'msDFSR-Member', + 'attributes': [ + 'Server-Reference', + 'ms-DFSR-ComputerReference', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Keywords', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'rpc-Profile': { + 'classes': [], + 'ldapname': 'rpcProfile', + 'attributes': [] + }, + 'ms-Authz-Central-Access-Rule': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessRule', + 'attributes': [ + 'Enabled', + 'ms-Authz-Effective-Security-Policy', + 'ms-Authz-Last-Effective-Security-Policy', + 'ms-Authz-Proposed-Security-Policy', + 'ms-Authz-Resource-Condition' + ] + }, + 'Link-Track-Volume-Table': { + 'classes': [], + 'ldapname': 'linkTrackVolumeTable', + 'attributes': [] + }, + 'ms-DS-Optional-Feature': { + 'classes': [], + 'ldapname': 'msDS-OptionalFeature', + 'attributes': [ + 'ms-DS-Optional-Feature-Flags', + 'ms-DS-Optional-Feature-GUID', + 'ms-DS-Required-Domain-Behavior-Version', + 'ms-DS-Required-Forest-Behavior-Version' + ] + }, + 'User': { + 'classes': [ + 'Mail-Recipient', + 'Security-Principal' + ], + 'ldapname': 'user', + 'attributes': [ + 'ACS-Policy-Name', + 'Account-Expires', + 'Address-Home', + 'Admin-Count', + 'Bad-Password-Time', + 'Bad-Pwd-Count', + 'Business-Category', + 'Code-Page', + 'Control-Access-Rights', + 'DBCS-Pwd', + 'Default-Class-Store', + 'Desktop-Profile', + 'Display-Name', + 'Dynamic-LDAP-Server', + 'E-mail-Addresses', + 'Employee-Number', + 'Employee-Type', + 'Given-Name', + 'Group-Membership-SAM', + 'Group-Priority', + 'Groups-to-Ignore', + 'Home-Directory', + 'Home-Drive', + 'Initials', + 'Last-Logoff', + 'Last-Logon', + 'Last-Logon-Timestamp', + 'Lm-Pwd-History', + 'Locale-ID', + 'Lockout-Time', + 'Logon-Count', + 'Logon-Hours', + 'Logon-Workstation', + 'MS-DRM-Identity-Certificate', + 'MS-DS-Creator-SID', + 'MS-TS-ExpireDate', + 'MS-TS-ExpireDate2', + 'MS-TS-ExpireDate3', + 'MS-TS-ExpireDate4', + 'MS-TS-LicenseVersion', + 'MS-TS-LicenseVersion2', + 'MS-TS-LicenseVersion3', + 'MS-TS-LicenseVersion4', + 'MS-TS-ManagingLS', + 'MS-TS-ManagingLS2', + 'MS-TS-ManagingLS3', + 'MS-TS-ManagingLS4', + 'MS-TS-Property01', + 'MS-TS-Property02', + 'MS-TSLS-Property01', + 'MS-TSLS-Property02', + 'MSMQ-Digests', + 'MSMQ-Digests-Mig', + 'MSMQ-Sign-Certificates', + 'MSMQ-Sign-Certificates-Mig', + 'Manager', + 'Max-Storage', + 'Network-Address', + 'Nt-Pwd-History', + 'Operator-Count', + 'Organization-Name', + 'Other-Login-Workstations', + 'Phone-Home-Primary', + 'Phone-Mobile-Primary', + 'Phone-Pager-Primary', + 'Preferred-OU', + 'Primary-Group-ID', + 'Profile-Path', + 'Pwd-Last-Set', + 'Script-Path', + 'Service-Principal-Name', + 'Terminal-Server', + 'Unicode-Pwd', + 'User-Account-Control', + 'User-Parameters', + 'User-Principal-Name', + 'User-SMIME-Certificate', + 'User-Shared-Folder', + 'User-Shared-Folder-Other', + 'User-Workstations', + 'X509-Cert', + 'audio', + 'carLicense', + 'departmentNumber', + 'jpegPhoto', + 'labeledURI', + 'ms-COM-UserPartitionSetLink', + 'ms-DS-AuthenticatedAt-DC', + 'ms-DS-Cached-Membership', + 'ms-DS-Cached-Membership-Time-Stamp', + 'ms-DS-Failed-Interactive-Logon-Count', + 'ms-DS-Failed-Interactive-Logon-Count-At-Last-Successful-Logon', + 'ms-DS-Last-Failed-Interactive-Logon-Time', + 'ms-DS-Last-Successful-Interactive-Logon-Time', + 'ms-DS-Primary-Computer', + 'ms-DS-Resultant-PSO', + 'ms-DS-Secondary-KrbTgt-Number', + 'ms-DS-Site-Affinity', + 'ms-DS-Source-Object-DN', + 'ms-DS-Supported-Encryption-Types', + 'ms-DS-User-Account-Control-Computed', + 'ms-DS-User-Password-Expiry-Time-Computed', + 'ms-IIS-FTP-Dir', + 'ms-IIS-FTP-Root', + 'ms-PKI-AccountCredentials', + 'ms-PKI-Credential-Roaming-Tokens', + 'ms-PKI-DPAPIMasterKeys', + 'ms-PKI-RoamingTimeStamp', + 'ms-RADIUS-FramedInterfaceId', + 'ms-RADIUS-FramedIpv6Prefix', + 'ms-RADIUS-FramedIpv6Route', + 'ms-RADIUS-SavedFramedInterfaceId', + 'ms-RADIUS-SavedFramedIpv6Prefix', + 'ms-RADIUS-SavedFramedIpv6Route', + 'ms-TS-Allow-Logon', + 'ms-TS-Broken-Connection-Action', + 'ms-TS-Connect-Client-Drives', + 'ms-TS-Connect-Printer-Drives', + 'ms-TS-Default-To-Main-Printer', + 'ms-TS-Home-Directory', + 'ms-TS-Home-Drive', + 'ms-TS-Initial-Program', + 'ms-TS-Max-Connection-Time', + 'ms-TS-Max-Disconnection-Time', + 'ms-TS-Max-Idle-Time', + 'ms-TS-Primary-Desktop', + 'ms-TS-Profile-Path', + 'ms-TS-Reconnection-Action', + 'ms-TS-Remote-Control', + 'ms-TS-Secondary-Desktops', + 'ms-TS-Work-Directory', + 'msNPAllowDialin', + 'msNPCallingStationID', + 'msNPSavedCallingStationID', + 'msRADIUSCallbackNumber', + 'msRADIUSFramedIPAddress', + 'msRADIUSFramedRoute', + 'msRADIUSServiceType', + 'msRASSavedCallbackNumber', + 'msRASSavedFramedIPAddress', + 'msRASSavedFramedRoute', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'photo', + 'preferredLanguage', + 'roomNumber', + 'secretary', + 'uid', + 'userPKCS12', + 'x500uniqueIdentifier' + ] + }, + 'ms-PKI-Private-Key-Recovery-Agent': { + 'classes': [], + 'ldapname': 'msPKI-PrivateKeyRecoveryAgent', + 'attributes': [ + 'X509-Cert' + ] + }, + 'Sites-Container': { + 'classes': [], + 'ldapname': 'sitesContainer', + 'attributes': [] + }, + 'posixAccount': { + 'classes': [], + 'ldapname': 'posixAccount', + 'attributes': [ + 'Common-Name', + 'Description', + 'Home-Directory', + 'User-Password', + 'gecos', + 'gidNumber', + 'loginShell', + 'uid', + 'uidNumber', + 'unixHomeDirectory', + 'unixUserPassword' + ] + }, + 'SubSchema': { + 'classes': [], + 'ldapname': 'subSchema', + 'attributes': [ + 'Attribute-Types', + 'DIT-Content-Rules', + 'Extended-Attribute-Info', + 'Extended-Class-Info', + 'Modify-Time-Stamp', + 'Object-Classes' + ] + }, + 'Sam-Domain-Base': { + 'classes': [], + 'ldapname': 'samDomainBase', + 'attributes': [ + 'Creation-Time', + 'Domain-Replica', + 'Force-Logoff', + 'Lock-Out-Observation-Window', + 'Lockout-Duration', + 'Lockout-Threshold', + 'Max-Pwd-Age', + 'Min-Pwd-Age', + 'Min-Pwd-Length', + 'Modified-Count', + 'Modified-Count-At-Last-Prom', + 'NT-Security-Descriptor', + 'Next-Rid', + 'OEM-Information', + 'Object-Sid', + 'Pwd-History-Length', + 'Pwd-Properties', + 'Revision', + 'Server-Role', + 'Server-State', + 'UAS-Compat' + ] + }, + 'Ipsec-Base': { + 'classes': [], + 'ldapname': 'ipsecBase', + 'attributes': [ + 'Ipsec-Data', + 'Ipsec-Data-Type', + 'Ipsec-ID', + 'Ipsec-Name', + 'Ipsec-Owners-Reference' + ] + }, + 'ms-TPM-Information-Objects-Container': { + 'classes': [], + 'ldapname': 'msTPM-InformationObjectsContainer', + 'attributes': [ + 'Common-Name' + ] + }, + 'ms-WMI-StringSetParam': { + 'classes': [], + 'ldapname': 'msWMI-StringSetParam', + 'attributes': [ + 'ms-WMI-stringDefault', + 'ms-WMI-stringValidValues' + ] + }, + 'ms-PKI-Key-Recovery-Agent': { + 'classes': [], + 'ldapname': 'msPKI-Key-Recovery-Agent', + 'attributes': [] + }, + 'ms-DS-Az-Task': { + 'classes': [], + 'ldapname': 'msDS-AzTask', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Biz-Rule', + 'ms-DS-Az-Biz-Rule-Language', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Last-Imported-Biz-Rule-Path', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Task-Is-Role-Definition', + 'ms-DS-Operations-For-Az-Task', + 'ms-DS-Tasks-For-Az-Task' + ] + }, + 'ms-DFSR-GlobalSettings': { + 'classes': [], + 'ldapname': 'msDFSR-GlobalSettings', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'NTDS-Service': { + 'classes': [], + 'ldapname': 'nTDSService', + 'attributes': [ + 'DS-Heuristics', + 'Garbage-Coll-Period', + 'Repl-Topology-Stay-Of-Execution', + 'SPN-Mappings', + 'Tombstone-Lifetime', + 'ms-DS-Deleted-Object-Lifetime', + 'ms-DS-Other-Settings' + ] + }, + 'Address-Template': { + 'classes': [], + 'ldapname': 'addressTemplate', + 'attributes': [ + 'Address-Syntax', + 'Address-Type', + 'Display-Name', + 'Per-Msg-Dialog-Display-Table', + 'Per-Recip-Dialog-Display-Table', + 'Proxy-Generation-Enabled' + ] + }, + 'ms-Exch-Configuration-Container': { + 'classes': [], + 'ldapname': 'msExchConfigurationContainer', + 'attributes': [ + 'Address-Book-Roots', + 'Address-Book-Roots2', + 'Global-Address-List', + 'Global-Address-List2', + 'Template-Roots', + 'Template-Roots2' + ] + }, + 'nisNetgroup': { + 'classes': [], + 'ldapname': 'nisNetgroup', + 'attributes': [ + 'Common-Name', + 'Description', + 'memberNisNetgroup', + 'msSFU-30-Name', + 'msSFU-30-Netgroup-Host-At-Domain', + 'msSFU-30-Netgroup-User-At-Domain', + 'msSFU-30-Nis-Domain', + 'nisMapName', + 'nisNetgroupTriple' + ] + }, + 'ms-DS-Password-Settings-Container': { + 'classes': [], + 'ldapname': 'msDS-PasswordSettingsContainer', + 'attributes': [] + }, + 'rFC822LocalPart': { + 'classes': [], + 'ldapname': 'rFC822LocalPart', + 'attributes': [ + 'Common-Name', + 'Description', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'See-Also', + 'Street-Address', + 'Surname', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'X121-Address' + ] + }, + 'ms-DS-Claim-Types': { + 'classes': [], + 'ldapname': 'msDS-ClaimTypes', + 'attributes': [] + }, + 'Remote-Storage-Service-Point': { + 'classes': [], + 'ldapname': 'remoteStorageServicePoint', + 'attributes': [ + 'Remote-Storage-GUID' + ] + }, + 'Sam-Domain': { + 'classes': [ + 'Sam-Domain-Base' + ], + 'ldapname': 'samDomain', + 'attributes': [ + 'Auditing-Policy', + 'Builtin-Creation-Time', + 'Builtin-Modified-Count', + 'CA-Certificate', + 'Control-Access-Rights', + 'Creation-Time', + 'Default-Local-Policy-Object', + 'Description', + 'Desktop-Profile', + 'Domain-Policy-Object', + 'EFSPolicy', + 'GP-Link', + 'GP-Options', + 'LSA-Creation-Time', + 'LSA-Modified-Count', + 'Lock-Out-Observation-Window', + 'Lockout-Duration', + 'Lockout-Threshold', + 'MS-DS-All-Users-Trust-Quota', + 'MS-DS-Machine-Account-Quota', + 'MS-DS-Per-User-Trust-Quota', + 'MS-DS-Per-User-Trust-Tombstones-Quota', + 'Max-Pwd-Age', + 'Min-Pwd-Age', + 'Min-Pwd-Length', + 'Modified-Count-At-Last-Prom', + 'NETBIOS-Name', + 'NT-Mixed-Domain', + 'Next-Rid', + 'Pek-Key-Change-Interval', + 'Pek-List', + 'Private-Key', + 'Pwd-History-Length', + 'Pwd-Properties', + 'RID-Manager-Reference', + 'Replica-Source', + 'Tree-Name', + 'ms-DS-Logon-Time-Sync-Interval' + ] + }, + 'Licensing-Site-Settings': { + 'classes': [], + 'ldapname': 'licensingSiteSettings', + 'attributes': [ + 'Site-Server' + ] + }, + 'NTFRS-Subscriptions': { + 'classes': [], + 'ldapname': 'nTFRSSubscriptions', + 'attributes': [ + 'Computer', + 'FRS-Extensions', + 'FRS-Version', + 'FRS-Working-Path' + ] + }, + 'ms-DS-Az-Admin-Manager': { + 'classes': [], + 'ldapname': 'msDS-AzAdminManager', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Domain-Timeout', + 'ms-DS-Az-Generate-Audits', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Major-Version', + 'ms-DS-Az-Minor-Version', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Script-Engine-Cache-Max', + 'ms-DS-Az-Script-Timeout' + ] + }, + 'ACS-Policy': { + 'classes': [], + 'ldapname': 'aCSPolicy', + 'attributes': [ + 'ACS-Aggregate-Token-Rate-Per-User', + 'ACS-Direction', + 'ACS-Identity-Name', + 'ACS-Max-Aggregate-Peak-Rate-Per-User', + 'ACS-Max-Duration-Per-Flow', + 'ACS-Max-Peak-Bandwidth-Per-Flow', + 'ACS-Max-Token-Bucket-Per-Flow', + 'ACS-Max-Token-Rate-Per-Flow', + 'ACS-Maximum-SDU-Size', + 'ACS-Minimum-Delay-Variation', + 'ACS-Minimum-Latency', + 'ACS-Minimum-Policed-Size', + 'ACS-Permission-Bits', + 'ACS-Priority', + 'ACS-Service-Type', + 'ACS-Time-Of-Day', + 'ACS-Total-No-Of-Flows' + ] + }, + 'Category-Registration': { + 'classes': [], + 'ldapname': 'categoryRegistration', + 'attributes': [ + 'Category-Id', + 'Locale-ID', + 'Localized-Description', + 'Managed-By' + ] + }, + 'Query-Policy': { + 'classes': [], + 'ldapname': 'queryPolicy', + 'attributes': [ + 'LDAP-Admin-Limits', + 'LDAP-IPDeny-List' + ] + }, + 'domainRelatedObject': { + 'classes': [], + 'ldapname': 'domainRelatedObject', + 'attributes': [ + 'associatedDomain' + ] + }, + 'RRAS-Administration-Dictionary': { + 'classes': [], + 'ldapname': 'rRASAdministrationDictionary', + 'attributes': [ + 'ms-RRAS-Vendor-Attribute-Entry' + ] + }, + 'ms-DFS-Namespace-Anchor': { + 'classes': [], + 'ldapname': 'msDFS-NamespaceAnchor', + 'attributes': [ + 'ms-DFS-Schema-Major-Version' + ] + }, + 'ms-WMI-RealRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-RealRangeParam', + 'attributes': [ + 'ms-WMI-int8Default', + 'ms-WMI-int8Max', + 'ms-WMI-int8Min' + ] + }, + 'Address-Book-Container': { + 'classes': [], + 'ldapname': 'addressBookContainer', + 'attributes': [ + 'Configuration', + 'Display-Name', + 'Purported-Search' + ] + }, + 'ms-ieee-80211-Policy': { + 'classes': [], + 'ldapname': 'msieee80211-Policy', + 'attributes': [ + 'ms-ieee-80211-Data', + 'ms-ieee-80211-Data-Type', + 'ms-ieee-80211-ID' + ] + }, + 'Dns-Zone': { + 'classes': [], + 'ldapname': 'dnsZone', + 'attributes': [ + 'DNS-Property', + 'Dns-Allow-Dynamic', + 'Dns-Allow-XFR', + 'Dns-Notify-Secondaries', + 'Dns-Secure-Secondaries', + 'Domain-Component', + 'Managed-By', + 'ms-DNS-DNSKEY-Record-Set-TTL', + 'ms-DNS-DNSKEY-Records', + 'ms-DNS-DS-Record-Algorithms', + 'ms-DNS-DS-Record-Set-TTL', + 'ms-DNS-Is-Signed', + 'ms-DNS-Maintain-Trust-Anchor', + 'ms-DNS-NSEC3-Current-Salt', + 'ms-DNS-NSEC3-Hash-Algorithm', + 'ms-DNS-NSEC3-Iterations', + 'ms-DNS-NSEC3-OptOut', + 'ms-DNS-NSEC3-Random-Salt-Length', + 'ms-DNS-NSEC3-User-Salt', + 'ms-DNS-Parent-Has-Secure-Delegation', + 'ms-DNS-Propagation-Time', + 'ms-DNS-RFC5011-Key-Rollovers', + 'ms-DNS-Secure-Delegation-Polling-Period', + 'ms-DNS-Sign-With-NSEC3', + 'ms-DNS-Signature-Inception-Offset', + 'ms-DNS-Signing-Key-Descriptors', + 'ms-DNS-Signing-Keys' + ] + }, + 'RID-Manager': { + 'classes': [], + 'ldapname': 'rIDManager', + 'attributes': [ + 'RID-Available-Pool' + ] + }, + 'ms-WMI-ObjectEncoding': { + 'classes': [], + 'ldapname': 'msWMI-ObjectEncoding', + 'attributes': [ + 'ms-WMI-Class', + 'ms-WMI-Genus', + 'ms-WMI-ID', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-ScopeGuid', + 'ms-WMI-TargetObject', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'account': { + 'classes': [], + 'ldapname': 'account', + 'attributes': [ + 'Description', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'See-Also', + 'host', + 'uid' + ] + }, + 'ACS-Subnet': { + 'classes': [], + 'ldapname': 'aCSSubnet', + 'attributes': [ + 'ACS-Allocable-RSVP-Bandwidth', + 'ACS-Cache-Timeout', + 'ACS-DSBM-DeadTime', + 'ACS-DSBM-Priority', + 'ACS-DSBM-Refresh', + 'ACS-Enable-ACS-Service', + 'ACS-Enable-RSVP-Accounting', + 'ACS-Enable-RSVP-Message-Logging', + 'ACS-Event-Log-Level', + 'ACS-Max-Duration-Per-Flow', + 'ACS-Max-No-Of-Account-Files', + 'ACS-Max-No-Of-Log-Files', + 'ACS-Max-Peak-Bandwidth', + 'ACS-Max-Peak-Bandwidth-Per-Flow', + 'ACS-Max-Size-Of-RSVP-Account-File', + 'ACS-Max-Size-Of-RSVP-Log-File', + 'ACS-Max-Token-Rate-Per-Flow', + 'ACS-Non-Reserved-Max-SDU-Size', + 'ACS-Non-Reserved-Min-Policed-Size', + 'ACS-Non-Reserved-Peak-Rate', + 'ACS-Non-Reserved-Token-Size', + 'ACS-Non-Reserved-Tx-Limit', + 'ACS-Non-Reserved-Tx-Size', + 'ACS-RSVP-Account-Files-Location', + 'ACS-RSVP-Log-Files-Location', + 'ACS-Server-List' + ] + }, + 'Service-Instance': { + 'classes': [], + 'ldapname': 'serviceInstance', + 'attributes': [ + 'Display-Name', + 'Service-Class-ID', + 'Service-Instance-Version', + 'Winsock-Addresses' + ] + }, + 'msSFU-30-Net-Id': { + 'classes': [], + 'ldapname': 'msSFU30NetId', + 'attributes': [ + 'msSFU-30-Key-Values', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Inter-Site-Transport-Container': { + 'classes': [], + 'ldapname': 'interSiteTransportContainer', + 'attributes': [] + }, + 'Ipsec-Policy': { + 'classes': [], + 'ldapname': 'ipsecPolicy', + 'attributes': [ + 'Ipsec-ISAKMP-Reference', + 'Ipsec-NFA-Reference' + ] + }, + 'Meeting': { + 'classes': [], + 'ldapname': 'meeting', + 'attributes': [ + 'meetingAdvertiseScope', + 'meetingApplication', + 'meetingBandwidth', + 'meetingBlob', + 'meetingContactInfo', + 'meetingDescription', + 'meetingEndTime', + 'meetingID', + 'meetingIP', + 'meetingIsEncrypted', + 'meetingKeyword', + 'meetingLanguage', + 'meetingLocation', + 'meetingMaxParticipants', + 'meetingName', + 'meetingOriginator', + 'meetingOwner', + 'meetingProtocol', + 'meetingRating', + 'meetingRecurrence', + 'meetingScope', + 'meetingStartTime', + 'meetingType', + 'meetingURL' + ] + }, + 'nisMap': { + 'classes': [], + 'ldapname': 'nisMap', + 'attributes': [ + 'Common-Name', + 'Description', + 'nisMapName' + ] + } + }, + + + /** + * Knowledge for the Active Directory Schema - LDAP Mapping + * + * See http://msdn.microsoft.com/en-us/library/windows/desktop/ms680938%28v=vs.85%29.aspx + * + * Each class in LDAP has two names - an LDAP-Class-Name and a CN. This mapping converts + * from the LDAP-Class-Name to the CN. The adSchemaClasses mapping converts the other + * way. + * + * The content is generated by get-ad-classes.pl from the MSDN website + */ + adLDAPClasses: { + 'aCSPolicy': 'ACS-Policy', + 'aCSResourceLimits': 'ACS-Resource-Limits', + 'aCSSubnet': 'ACS-Subnet', + 'account': 'account', + 'addressBookContainer': 'Address-Book-Container', + 'addressTemplate': 'Address-Template', + 'applicationEntity': 'Application-Entity', + 'applicationProcess': 'Application-Process', + 'applicationSettings': 'Application-Settings', + 'applicationSiteSettings': 'Application-Site-Settings', + 'applicationVersion': 'Application-Version', + 'attributeSchema': 'Attribute-Schema', + 'bootableDevice': 'bootableDevice', + 'builtinDomain': 'Builtin-Domain', + 'cRLDistributionPoint': 'CRL-Distribution-Point', + 'categoryRegistration': 'Category-Registration', + 'certificationAuthority': 'Certification-Authority', + 'classRegistration': 'Class-Registration', + 'classSchema': 'Class-Schema', + 'classStore': 'Class-Store', + 'comConnectionPoint': 'Com-Connection-Point', + 'computer': 'Computer', + 'configuration': 'Configuration', + 'connectionPoint': 'Connection-Point', + 'contact': 'Contact', + 'container': 'Container', + 'controlAccessRight': 'Control-Access-Right', + 'country': 'Country', + 'crossRef': 'Cross-Ref', + 'crossRefContainer': 'Cross-Ref-Container', + 'dHCPClass': 'DHCP-Class', + 'dMD': 'DMD', + 'dSA': 'DSA', + 'dSUISettings': 'DS-UI-Settings', + 'device': 'Device', + 'dfsConfiguration': 'Dfs-Configuration', + 'displaySpecifier': 'Display-Specifier', + 'displayTemplate': 'Display-Template', + 'dnsNode': 'Dns-Node', + 'dnsZone': 'Dns-Zone', + 'document': 'document', + 'documentSeries': 'documentSeries', + 'domain': 'Domain', + 'domainDNS': 'Domain-DNS', + 'domainPolicy': 'Domain-Policy', + 'domainRelatedObject': 'domainRelatedObject', + 'dynamicObject': 'Dynamic-Object', + 'fTDfs': 'FT-Dfs', + 'fileLinkTracking': 'File-Link-Tracking', + 'fileLinkTrackingEntry': 'File-Link-Tracking-Entry', + 'foreignSecurityPrincipal': 'Foreign-Security-Principal', + 'friendlyCountry': 'friendlyCountry', + 'group': 'Group', + 'groupOfNames': 'Group-Of-Names', + 'groupOfUniqueNames': 'groupOfUniqueNames', + 'groupPolicyContainer': 'Group-Policy-Container', + 'ieee802Device': 'ieee802Device', + 'indexServerCatalog': 'Index-Server-Catalog', + 'inetOrgPerson': 'inetOrgPerson', + 'infrastructureUpdate': 'Infrastructure-Update', + 'intellimirrorGroup': 'Intellimirror-Group', + 'intellimirrorSCP': 'Intellimirror-SCP', + 'interSiteTransport': 'Inter-Site-Transport', + 'interSiteTransportContainer': 'Inter-Site-Transport-Container', + 'ipHost': 'ipHost', + 'ipNetwork': 'ipNetwork', + 'ipProtocol': 'ipProtocol', + 'ipService': 'ipService', + 'ipsecBase': 'Ipsec-Base', + 'ipsecFilter': 'Ipsec-Filter', + 'ipsecISAKMPPolicy': 'Ipsec-ISAKMP-Policy', + 'ipsecNFA': 'Ipsec-NFA', + 'ipsecNegotiationPolicy': 'Ipsec-Negotiation-Policy', + 'ipsecPolicy': 'Ipsec-Policy', + 'leaf': 'Leaf', + 'licensingSiteSettings': 'Licensing-Site-Settings', + 'linkTrackOMTEntry': 'Link-Track-OMT-Entry', + 'linkTrackObjectMoveTable': 'Link-Track-Object-Move-Table', + 'linkTrackVolEntry': 'Link-Track-Vol-Entry', + 'linkTrackVolumeTable': 'Link-Track-Volume-Table', + 'locality': 'Locality', + 'lostAndFound': 'Lost-And-Found', + 'mS-SQL-OLAPCube': 'MS-SQL-OLAPCube', + 'mS-SQL-OLAPDatabase': 'MS-SQL-OLAPDatabase', + 'mS-SQL-OLAPServer': 'MS-SQL-OLAPServer', + 'mS-SQL-SQLDatabase': 'MS-SQL-SQLDatabase', + 'mS-SQL-SQLPublication': 'MS-SQL-SQLPublication', + 'mS-SQL-SQLRepository': 'MS-SQL-SQLRepository', + 'mS-SQL-SQLServer': 'MS-SQL-SQLServer', + 'mSMQConfiguration': 'MSMQ-Configuration', + 'mSMQEnterpriseSettings': 'MSMQ-Enterprise-Settings', + 'mSMQMigratedUser': 'MSMQ-Migrated-User', + 'mSMQQueue': 'MSMQ-Queue', + 'mSMQSettings': 'MSMQ-Settings', + 'mSMQSiteLink': 'MSMQ-Site-Link', + 'mailRecipient': 'Mail-Recipient', + 'meeting': 'Meeting', + 'ms-net-ieee-80211-GroupPolicy': 'ms-net-ieee-80211-GroupPolicy', + 'ms-net-ieee-8023-GroupPolicy': 'ms-net-ieee-8023-GroupPolicy', + 'msAuthz-CentralAccessPolicies': 'ms-Authz-Central-Access-Policies', + 'msAuthz-CentralAccessPolicy': 'ms-Authz-Central-Access-Policy', + 'msAuthz-CentralAccessRule': 'ms-Authz-Central-Access-Rule', + 'msAuthz-CentralAccessRules': 'ms-Authz-Central-Access-Rules', + 'msCOM-Partition': 'ms-COM-Partition', + 'msCOM-PartitionSet': 'ms-COM-PartitionSet', + 'msDFS-DeletedLinkv2': 'ms-DFS-Deleted-Link-v2', + 'msDFS-Linkv2': 'ms-DFS-Link-v2', + 'msDFS-NamespaceAnchor': 'ms-DFS-Namespace-Anchor', + 'msDFS-Namespacev2': 'ms-DFS-Namespace-v2', + 'msDFSR-Connection': 'ms-DFSR-Connection', + 'msDFSR-Content': 'ms-DFSR-Content', + 'msDFSR-ContentSet': 'ms-DFSR-ContentSet', + 'msDFSR-GlobalSettings': 'ms-DFSR-GlobalSettings', + 'msDFSR-LocalSettings': 'ms-DFSR-LocalSettings', + 'msDFSR-Member': 'ms-DFSR-Member', + 'msDFSR-ReplicationGroup': 'ms-DFSR-ReplicationGroup', + 'msDFSR-Subscriber': 'ms-DFSR-Subscriber', + 'msDFSR-Subscription': 'ms-DFSR-Subscription', + 'msDFSR-Topology': 'ms-DFSR-Topology', + 'msDNS-ServerSettings': 'ms-DNS-Server-Settings', + 'msDS-App-Configuration': 'ms-DS-App-Configuration', + 'msDS-AppData': 'ms-DS-App-Data', + 'msDS-AzAdminManager': 'ms-DS-Az-Admin-Manager', + 'msDS-AzApplication': 'ms-DS-Az-Application', + 'msDS-AzOperation': 'ms-DS-Az-Operation', + 'msDS-AzRole': 'ms-DS-Az-Role', + 'msDS-AzScope': 'ms-DS-Az-Scope', + 'msDS-AzTask': 'ms-DS-Az-Task', + 'msDS-BindProxy': 'ms-DS-Bind-Proxy', + 'msDS-BindableObject': 'ms-DS-Bindable-Object', + 'msDS-ClaimType': 'ms-DS-Claim-Type', + 'msDS-ClaimTypePropertyBase': 'ms-DS-Claim-Type-Property-Base', + 'msDS-ClaimTypes': 'ms-DS-Claim-Types', + 'msDS-ClaimsTransformationPolicies': 'ms-DS-Claims-Transformation-Policies', + 'msDS-ClaimsTransformationPolicyType': 'ms-DS-Claims-Transformation-Policy-Type', + 'msDS-GroupManagedServiceAccount': 'ms-DS-Group-Managed-Service-Account', + 'msDS-ManagedServiceAccount': 'ms-DS-Managed-Service-Account', + 'msDS-OptionalFeature': 'ms-DS-Optional-Feature', + 'msDS-PasswordSettings': 'ms-DS-Password-Settings', + 'msDS-PasswordSettingsContainer': 'ms-DS-Password-Settings-Container', + 'msDS-QuotaContainer': 'ms-DS-Quota-Container', + 'msDS-QuotaControl': 'ms-DS-Quota-Control', + 'msDS-ResourceProperties': 'ms-DS-Resource-Properties', + 'msDS-ResourceProperty': 'ms-DS-Resource-Property', + 'msDS-ResourcePropertyList': 'ms-DS-Resource-Property-List', + 'msDS-ServiceConnectionPointPublicationService': 'ms-DS-Service-Connection-Point-Publication-Service', + 'msDS-ValueType': 'ms-DS-Value-Type', + 'msExchConfigurationContainer': 'ms-Exch-Configuration-Container', + 'msFVE-RecoveryInformation': 'ms-FVE-RecoveryInformation', + 'msImaging-PSPs': 'ms-Imaging-PSPs', + 'msImaging-PostScanProcess': 'ms-Imaging-PostScanProcess', + 'msKds-ProvRootKey': 'ms-Kds-Prov-RootKey', + 'msKds-ProvServerConfiguration': 'ms-Kds-Prov-ServerConfiguration', + 'msMQ-Custom-Recipient': 'MSMQ-Custom-Recipient', + 'msMQ-Group': 'MSMQ-Group', + 'msPKI-Enterprise-Oid': 'ms-PKI-Enterprise-Oid', + 'msPKI-Key-Recovery-Agent': 'ms-PKI-Key-Recovery-Agent', + 'msPKI-PrivateKeyRecoveryAgent': 'ms-PKI-Private-Key-Recovery-Agent', + 'msPrint-ConnectionPolicy': 'ms-Print-ConnectionPolicy', + 'msSFU30DomainInfo': 'msSFU-30-Domain-Info', + 'msSFU30MailAliases': 'msSFU-30-Mail-Aliases', + 'msSFU30NISMapConfig': 'msSFU-30-NIS-Map-Config', + 'msSFU30NetId': 'msSFU-30-Net-Id', + 'msSFU30NetworkUser': 'msSFU-30-Network-User', + 'msSPP-ActivationObject': 'ms-SPP-Activation-Object', + 'msSPP-ActivationObjectsContainer': 'ms-SPP-Activation-Objects-Container', + 'msTAPI-RtConference': 'ms-TAPI-Rt-Conference', + 'msTAPI-RtPerson': 'ms-TAPI-Rt-Person', + 'msTPM-InformationObject': 'ms-TPM-Information-Object', + 'msTPM-InformationObjectsContainer': 'ms-TPM-Information-Objects-Container', + 'msWMI-IntRangeParam': 'ms-WMI-IntRangeParam', + 'msWMI-IntSetParam': 'ms-WMI-IntSetParam', + 'msWMI-MergeablePolicyTemplate': 'ms-WMI-MergeablePolicyTemplate', + 'msWMI-ObjectEncoding': 'ms-WMI-ObjectEncoding', + 'msWMI-PolicyTemplate': 'ms-WMI-PolicyTemplate', + 'msWMI-PolicyType': 'ms-WMI-PolicyType', + 'msWMI-RangeParam': 'ms-WMI-RangeParam', + 'msWMI-RealRangeParam': 'ms-WMI-RealRangeParam', + 'msWMI-Rule': 'ms-WMI-Rule', + 'msWMI-ShadowObject': 'ms-WMI-ShadowObject', + 'msWMI-SimplePolicyTemplate': 'ms-WMI-SimplePolicyTemplate', + 'msWMI-Som': 'ms-WMI-Som', + 'msWMI-StringSetParam': 'ms-WMI-StringSetParam', + 'msWMI-UintRangeParam': 'ms-WMI-UintRangeParam', + 'msWMI-UintSetParam': 'ms-WMI-UintSetParam', + 'msWMI-UnknownRangeParam': 'ms-WMI-UnknownRangeParam', + 'msWMI-WMIGPO': 'ms-WMI-WMIGPO', + 'msieee80211-Policy': 'ms-ieee-80211-Policy', + 'nTDSConnection': 'NTDS-Connection', + 'nTDSDSA': 'NTDS-DSA', + 'nTDSDSARO': 'NTDS-DSA-RO', + 'nTDSService': 'NTDS-Service', + 'nTDSSiteSettings': 'NTDS-Site-Settings', + 'nTFRSMember': 'NTFRS-Member', + 'nTFRSReplicaSet': 'NTFRS-Replica-Set', + 'nTFRSSettings': 'NTFRS-Settings', + 'nTFRSSubscriber': 'NTFRS-Subscriber', + 'nTFRSSubscriptions': 'NTFRS-Subscriptions', + 'nisMap': 'nisMap', + 'nisNetgroup': 'nisNetgroup', + 'nisObject': 'nisObject', + 'oncRpc': 'oncRpc', + 'organization': 'Organization', + 'organizationalPerson': 'Organizational-Person', + 'organizationalRole': 'Organizational-Role', + 'organizationalUnit': 'Organizational-Unit', + 'pKICertificateTemplate': 'PKI-Certificate-Template', + 'pKIEnrollmentService': 'PKI-Enrollment-Service', + 'packageRegistration': 'Package-Registration', + 'person': 'Person', + 'physicalLocation': 'Physical-Location', + 'posixAccount': 'posixAccount', + 'posixGroup': 'posixGroup', + 'printQueue': 'Print-Queue', + 'queryPolicy': 'Query-Policy', + 'rFC822LocalPart': 'rFC822LocalPart', + 'rIDManager': 'RID-Manager', + 'rIDSet': 'RID-Set', + 'rRASAdministrationConnectionPoint': 'RRAS-Administration-Connection-Point', + 'rRASAdministrationDictionary': 'RRAS-Administration-Dictionary', + 'remoteMailRecipient': 'Remote-Mail-Recipient', + 'remoteStorageServicePoint': 'Remote-Storage-Service-Point', + 'residentialPerson': 'Residential-Person', + 'room': 'room', + 'rpcContainer': 'Rpc-Container', + 'rpcEntry': 'rpc-Entry', + 'rpcGroup': 'rpc-Group', + 'rpcProfile': 'rpc-Profile', + 'rpcProfileElement': 'rpc-Profile-Element', + 'rpcServer': 'rpc-Server', + 'rpcServerElement': 'rpc-Server-Element', + 'samDomain': 'Sam-Domain', + 'samDomainBase': 'Sam-Domain-Base', + 'samServer': 'Sam-Server', + 'secret': 'Secret', + 'securityObject': 'Security-Object', + 'securityPrincipal': 'Security-Principal', + 'server': 'Server', + 'serversContainer': 'Servers-Container', + 'serviceAdministrationPoint': 'Service-Administration-Point', + 'serviceClass': 'Service-Class', + 'serviceConnectionPoint': 'Service-Connection-Point', + 'serviceInstance': 'Service-Instance', + 'shadowAccount': 'shadowAccount', + 'simpleSecurityObject': 'simpleSecurityObject', + 'site': 'Site', + 'siteLink': 'Site-Link', + 'siteLinkBridge': 'Site-Link-Bridge', + 'sitesContainer': 'Sites-Container', + 'storage': 'Storage', + 'subSchema': 'SubSchema', + 'subnet': 'Subnet', + 'subnetContainer': 'Subnet-Container', + 'top': 'Top', + 'trustedDomain': 'Trusted-Domain', + 'typeLibrary': 'Type-Library', + 'user': 'User', + 'volume': 'Volume' + } + + + }); + return LDAPRecordView; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview.css b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview.css new file mode 100644 index 00000000..701e3450 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview.css @@ -0,0 +1,31 @@ +.splunk-app-microsoft-ldaprecordview { + width: 100%; + overflow-x: scroll; +} + +.splunk-app-microsoft-ldaprecordview div.oc { + width: 100%; +} + +.splunk-app-microsoft-ldaprecordview div.oc h3.title { + padding: 6px; + background: #C7DBB9; + font: italic bold 8pt/14pt Helvetica,sans-serif; +} + +.splunk-app-microsoft-ldaprecordview div.oc div.content { + padding-left: 10px; + padding-right: 10px; + font: black 10pt Arial,Helvetica,sans-serif; +} + +.splunk-app-microsoft-ldaprecordview div.oc div.content div.attr div.attrname { + float: left; + width: 30%; +} + +.splunk-app-microsoft-ldaprecordview div.oc div.content div.attr div.attrval { + width: 70%; + white-space: nowrap; + display: inline-block; +} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview.js new file mode 100644 index 00000000..3debc19b --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview.js @@ -0,0 +1,5589 @@ +define(function(require, exports, module) { + + var _ = require('underscore'); + var SimpleSplunkView = require("splunkjs/mvc/simplesplunkview"); + require("css!./ms_ad_obj_ldaprecordview.css"); + + var LDAPRecordView = SimpleSplunkView.extend({ + + className: "splunk-app-microsoft-ldaprecordview", + + output_mode: "json", + + createView: function() { + return true; + }, + + formatData: function(data){ + return data; + }, + + updateView: function(viz, data) { + if (data.length === 0) { + return; + } + // The LDAP Record is a single record, but the JSON response is always an array + // so just take the first one. + var ldapRecord = data[0]; + if (!('objectClass' in ldapRecord)) { + return; + } + + // We have a proper record, so let's reset the UI and get on to display + this.$el.empty(); + + var ocMap = {}; + // For each object class, convert the name to the AD name, and add on + // any auxiliary classes + var ocList; + if (ldapRecord.objectClass instanceof Array) { + ocList = ldapRecord.objectClass; + } else { + ocList = [ ldapRecord.objectClass ]; + } + for (var i = 0 ; i < ocList.length ; i++) { + if (ocList[i] in this.adLDAPClasses) { + var oc = this.adLDAPClasses[ocList[i]]; + // Our AD Class is one + ocMap[oc] = 1; + // Add on any auxiliary classes + if ('classes' in this.adSchemaClasses[oc]) { + for (var j = 0 ; j < this.adSchemaClasses[oc].classes.length ; j++) { + ocMap[this.adSchemaClasses[oc].classes[j]] = 1; + } + } + } + } + // Convert back to an array + var ocArray = []; + for (var p in ocMap) { + ocArray.push(p); + } + var objectClasses = ocArray.sort(this.caseInsensitive); + + // Each objectclass has it's own display mechanics as a panel. The panel is + // constructed as a pair of DIVs, one on top of the other, with a switcher on + // the side. We do "top" first, which is every single LDAP record + this.buildOC("Top", ldapRecord); + for (var ocidx = 0 ; ocidx < objectClasses.length ; ocidx++) { + if (objectClasses[ocidx] != "Top") + this.buildOC(objectClasses[ocidx], ldapRecord); + } + }, + + getData: function(){ + return this.resultsModel.data().results; + }, + + + // Builds the Object Class + buildOC: function(oc, ldapRecord) { + // MAIN BLOCK + var block = $('

'+oc+'

').appendTo(this.$el); + var title = $('div#'+oc+' > h3.title'); + var content = $('div#'+oc+' > div.content'); + + // Now populate the content. There are three possibilities here: + // 1) We have a distinct method of rendering the object class + // 2) We know about the objectclass and it's attributes + // 3) We don't know about the objectclass + // + // 1) We have a distinct method of rendering the object class + // None of these yet + + // 2) We know about the objectClass + if (oc in this.adSchemaClasses) { + this.buildKnownSchemaClass(oc, ldapRecord, content); + return; + } + + // 3) We don't know about the objectClass + $('

Unknown Object Class - Add Knowledge to LDAPRecord

').appendTo(content); + return; + }, + + buildKnownSchemaClass: function(oc, ldapRecord, container) { + var attrs = this.adSchemaClasses[oc].attributes; + + for (var i = 0 ; i < attrs.length ; i++) { + if (attrs[i] in this.adSchemaAttributes) { + var ldapAttr = this.adSchemaAttributes[attrs[i]]; + if (ldapAttr in ldapRecord) { + var v = ldapRecord[ldapAttr]; + if (ldapRecord[ldapAttr] instanceof Array) { + v = ldapRecord[ldapAttr].join('
'); + } + $('
' + attrs[i] + '
' + v + '
') + .appendTo(container); + } + } + } + }, + + /** + * Sort Method for Array.sort() to do a case insensitive sort + */ + caseInsensitive: function(x,y) { + var a = String(x).toLowerCase(); + var b = String(y).toLowerCase(); + + if (a > b) return 1; + if (a < b) return -1; + return 0; + }, + + /** + * Knowledge for the Active Directory Schema - Attributes + * + * Each Attribute has an LDAP name and a Active Directory name. + * + * See: http://msdn.microsoft.com/en-us/library/windows/desktop/ms675090%28v=vs.85%29.aspx + * + * This content is generated by get-ad-attributes.pl and converts between + * a CN and an LDAP-Attribute-Name. + */ + adSchemaAttributes: { + 'ACS-Aggregate-Token-Rate-Per-User': 'aCSAggregateTokenRatePerUser', + 'ACS-Allocable-RSVP-Bandwidth': 'aCSAllocableRSVPBandwidth', + 'ACS-Cache-Timeout': 'aCSCacheTimeout', + 'ACS-DSBM-DeadTime': 'aCSDSBMDeadTime', + 'ACS-DSBM-Priority': 'aCSDSBMPriority', + 'ACS-DSBM-Refresh': 'aCSDSBMRefresh', + 'ACS-Direction': 'aCSDirection', + 'ACS-Enable-ACS-Service': 'aCSEnableACSService', + 'ACS-Enable-RSVP-Accounting': 'aCSEnableRSVPAccounting', + 'ACS-Enable-RSVP-Message-Logging': 'aCSEnableRSVPMessageLogging', + 'ACS-Event-Log-Level': 'aCSEventLogLevel', + 'ACS-Identity-Name': 'aCSIdentityName', + 'ACS-Max-Aggregate-Peak-Rate-Per-User': 'aCSMaxAggregatePeakRatePerUser', + 'ACS-Max-Duration-Per-Flow': 'aCSMaxDurationPerFlow', + 'ACS-Max-No-Of-Account-Files': 'aCSMaxNoOfAccountFiles', + 'ACS-Max-No-Of-Log-Files': 'aCSMaxNoOfLogFiles', + 'ACS-Max-Peak-Bandwidth': 'aCSMaxPeakBandwidth', + 'ACS-Max-Peak-Bandwidth-Per-Flow': 'aCSMaxPeakBandwidthPerFlow', + 'ACS-Max-Size-Of-RSVP-Account-File': 'aCSMaxSizeOfRSVPAccountFile', + 'ACS-Max-Size-Of-RSVP-Log-File': 'aCSMaxSizeOfRSVPLogFile', + 'ACS-Max-Token-Bucket-Per-Flow': 'aCSMaxTokenBucketPerFlow', + 'ACS-Max-Token-Rate-Per-Flow': 'aCSMaxTokenRatePerFlow', + 'ACS-Maximum-SDU-Size': 'aCSMaximumSDUSize', + 'ACS-Minimum-Delay-Variation': 'aCSMinimumDelayVariation', + 'ACS-Minimum-Latency': 'aCSMinimumLatency', + 'ACS-Minimum-Policed-Size': 'aCSMinimumPolicedSize', + 'ACS-Non-Reserved-Max-SDU-Size': 'aCSNonReservedMaxSDUSize', + 'ACS-Non-Reserved-Min-Policed-Size': 'aCSNonReservedMinPolicedSize', + 'ACS-Non-Reserved-Peak-Rate': 'aCSNonReservedPeakRate', + 'ACS-Non-Reserved-Token-Size': 'aCSNonReservedTokenSize', + 'ACS-Non-Reserved-Tx-Limit': 'aCSNonReservedTxLimit', + 'ACS-Non-Reserved-Tx-Size': 'aCSNonReservedTxSize', + 'ACS-Permission-Bits': 'aCSPermissionBits', + 'ACS-Policy-Name': 'aCSPolicyName', + 'ACS-Priority': 'aCSPriority', + 'ACS-RSVP-Account-Files-Location': 'aCSRSVPAccountFilesLocation', + 'ACS-RSVP-Log-Files-Location': 'aCSRSVPLogFilesLocation', + 'ACS-Server-List': 'aCSServerList', + 'ACS-Service-Type': 'aCSServiceType', + 'ACS-Time-Of-Day': 'aCSTimeOfDay', + 'ACS-Total-No-Of-Flows': 'aCSTotalNoOfFlows', + 'ANR': 'aNR', + 'Account-Expires': 'accountExpires', + 'Account-Name-History': 'accountNameHistory', + 'Additional-Information': 'notes', + 'Additional-Trusted-Service-Names': 'additionalTrustedServiceNames', + 'Address': 'streetAddress', + 'Address-Book-Roots': 'addressBookRoots', + 'Address-Book-Roots2': 'addressBookRoots2', + 'Address-Entry-Display-Table': 'addressEntryDisplayTable', + 'Address-Entry-Display-Table-MSDOS': 'addressEntryDisplayTableMSDOS', + 'Address-Home': 'homePostalAddress', + 'Address-Syntax': 'addressSyntax', + 'Address-Type': 'addressType', + 'Admin-Context-Menu': 'adminContextMenu', + 'Admin-Count': 'adminCount', + 'Admin-Description': 'adminDescription', + 'Admin-Display-Name': 'adminDisplayName', + 'Admin-Multiselect-Property-Pages': 'adminMultiselectPropertyPages', + 'Admin-Property-Pages': 'adminPropertyPages', + 'Allowed-Attributes': 'allowedAttributes', + 'Allowed-Attributes-Effective': 'allowedAttributesEffective', + 'Allowed-Child-Classes': 'allowedChildClasses', + 'Allowed-Child-Classes-Effective': 'allowedChildClassesEffective', + 'Alt-Security-Identities': 'altSecurityIdentities', + 'App-Schema-Version': 'appSchemaVersion', + 'Application-Name': 'applicationName', + 'Applies-To': 'appliesTo', + 'Asset-Number': 'assetNumber', + 'Assistant': 'assistant', + 'Assoc-NT-Account': 'assocNTAccount', + 'Attribute-Display-Names': 'attributeDisplayNames', + 'Attribute-ID': 'attributeID', + 'Attribute-Security-GUID': 'attributeSecurityGUID', + 'Attribute-Syntax': 'attributeSyntax', + 'Attribute-Types': 'attributeTypes', + 'Auditing-Policy': 'auditingPolicy', + 'Authentication-Options': 'authenticationOptions', + 'Authority-Revocation-List': 'authorityRevocationList', + 'Auxiliary-Class': 'auxiliaryClass', + 'Bad-Password-Time': 'badPasswordTime', + 'Bad-Pwd-Count': 'badPwdCount', + 'Birth-Location': 'birthLocation', + 'Bridgehead-Server-List-BL': 'bridgeheadServerListBL', + 'Bridgehead-Transport-List': 'bridgeheadTransportList', + 'Builtin-Creation-Time': 'builtinCreationTime', + 'Builtin-Modified-Count': 'builtinModifiedCount', + 'Business-Category': 'businessCategory', + 'Bytes-Per-Minute': 'bytesPerMinute', + 'CA-Certificate': 'cACertificate', + 'CA-Certificate-DN': 'cACertificateDN', + 'CA-Connect': 'cAConnect', + 'CA-Usages': 'cAUsages', + 'CA-WEB-URL': 'cAWEBURL', + 'COM-CLSID': 'cOMCLSID', + 'COM-ClassID': 'cOMClassID', + 'COM-InterfaceID': 'cOMInterfaceID', + 'COM-Other-Prog-Id': 'cOMOtherProgId', + 'COM-ProgID': 'cOMProgID', + 'COM-Treat-As-Class-Id': 'cOMTreatAsClassId', + 'COM-Typelib-Id': 'cOMTypelibId', + 'COM-Unique-LIBID': 'cOMUniqueLIBID', + 'CRL-Object': 'cRLObject', + 'CRL-Partitioned-Revocation-List': 'cRLPartitionedRevocationList', + 'Can-Upgrade-Script': 'canUpgradeScript', + 'Canonical-Name': 'canonicalName', + 'Catalogs': 'catalogs', + 'Categories': 'categories', + 'Category-Id': 'categoryId', + 'Certificate-Authority-Object': 'certificateAuthorityObject', + 'Certificate-Revocation-List': 'certificateRevocationList', + 'Certificate-Templates': 'certificateTemplates', + 'Class-Display-Name': 'classDisplayName', + 'Code-Page': 'codePage', + 'Comment': 'info', + 'Common-Name': 'cn', + 'Company': 'company', + 'Content-Indexing-Allowed': 'contentIndexingAllowed', + 'Context-Menu': 'contextMenu', + 'Control-Access-Rights': 'controlAccessRights', + 'Cost': 'cost', + 'Country-Code': 'countryCode', + 'Country-Name': 'c', + 'Create-Dialog': 'createDialog', + 'Create-Time-Stamp': 'createTimeStamp', + 'Create-Wizard-Ext': 'createWizardExt', + 'Creation-Time': 'creationTime', + 'Creation-Wizard': 'creationWizard', + 'Creator': 'creator', + 'Cross-Certificate-Pair': 'crossCertificatePair', + 'Curr-Machine-Id': 'currMachineId', + 'Current-Location': 'currentLocation', + 'Current-Parent-CA': 'currentParentCA', + 'Current-Value': 'currentValue', + 'DBCS-Pwd': 'dBCSPwd', + 'DIT-Content-Rules': 'dITContentRules', + 'DMD-Location': 'dMDLocation', + 'DMD-Name': 'dmdName', + 'DN-Reference-Update': 'dNReferenceUpdate', + 'DNS-Host-Name': 'dNSHostName', + 'DNS-Property': 'dNSProperty', + 'DNS-Tombstoned': 'dNSTombstoned', + 'DS-Core-Propagation-Data': 'dSCorePropagationData', + 'DS-Heuristics': 'dSHeuristics', + 'DS-UI-Admin-Maximum': 'dSUIAdminMaximum', + 'DS-UI-Admin-Notification': 'dSUIAdminNotification', + 'DS-UI-Shell-Maximum': 'dSUIShellMaximum', + 'DSA-Signature': 'dSASignature', + 'Default-Class-Store': 'defaultClassStore', + 'Default-Group': 'defaultGroup', + 'Default-Hiding-Value': 'defaultHidingValue', + 'Default-Local-Policy-Object': 'defaultLocalPolicyObject', + 'Default-Object-Category': 'defaultObjectCategory', + 'Default-Priority': 'defaultPriority', + 'Default-Security-Descriptor': 'defaultSecurityDescriptor', + 'Delta-Revocation-List': 'deltaRevocationList', + 'Department': 'department', + 'Description': 'description', + 'Desktop-Profile': 'desktopProfile', + 'Destination-Indicator': 'destinationIndicator', + 'Display-Name': 'displayName', + 'Display-Name-Printable': 'displayNamePrintable', + 'Division': 'division', + 'Dns-Allow-Dynamic': 'dnsAllowDynamic', + 'Dns-Allow-XFR': 'dnsAllowXFR', + 'Dns-Notify-Secondaries': 'dnsNotifySecondaries', + 'Dns-Record': 'dnsRecord', + 'Dns-Root': 'dnsRoot', + 'Dns-Secure-Secondaries': 'dnsSecureSecondaries', + 'Domain-Certificate-Authorities': 'domainCAs', + 'Domain-Component': 'dc', + 'Domain-Cross-Ref': 'domainCrossRef', + 'Domain-ID': 'domainID', + 'Domain-Identifier': 'domainIdentifier', + 'Domain-Policy-Object': 'domainPolicyObject', + 'Domain-Policy-Reference': 'domainPolicyReference', + 'Domain-Replica': 'domainReplica', + 'Domain-Wide-Policy': 'domainWidePolicy', + 'Driver-Name': 'driverName', + 'Driver-Version': 'driverVersion', + 'Dynamic-LDAP-Server': 'dynamicLDAPServer', + 'E-mail-Addresses': 'mail', + 'EFSPolicy': 'eFSPolicy', + 'Employee-ID': 'employeeID', + 'Employee-Number': 'employeeNumber', + 'Employee-Type': 'employeeType', + 'Enabled': 'Enabled', + 'Enabled-Connection': 'enabledConnection', + 'Enrollment-Providers': 'enrollmentProviders', + 'Entry-TTL': 'entryTTL', + 'Extended-Attribute-Info': 'extendedAttributeInfo', + 'Extended-Chars-Allowed': 'extendedCharsAllowed', + 'Extended-Class-Info': 'extendedClassInfo', + 'Extension-Name': 'extensionName', + 'Extra-Columns': 'extraColumns', + 'FRS-Control-Data-Creation': 'fRSControlDataCreation', + 'FRS-Control-Inbound-Backlog': 'fRSControlInboundBacklog', + 'FRS-Control-Outbound-Backlog': 'fRSControlOutboundBacklog', + 'FRS-DS-Poll': 'fRSDSPoll', + 'FRS-Directory-Filter': 'fRSDirectoryFilter', + 'FRS-Extensions': 'fRSExtensions', + 'FRS-Fault-Condition': 'fRSFaultCondition', + 'FRS-File-Filter': 'fRSFileFilter', + 'FRS-Flags': 'fRSFlags', + 'FRS-Level-Limit': 'fRSLevelLimit', + 'FRS-Member-Reference': 'fRSMemberReference', + 'FRS-Member-Reference-BL': 'fRSMemberReferenceBL', + 'FRS-Partner-Auth-Level': 'fRSPartnerAuthLevel', + 'FRS-Primary-Member': 'fRSPrimaryMember', + 'FRS-Replica-Set-GUID': 'fRSReplicaSetGUID', + 'FRS-Replica-Set-Type': 'fRSReplicaSetType', + 'FRS-Root-Path': 'fRSRootPath', + 'FRS-Root-Security': 'fRSRootSecurity', + 'FRS-Service-Command': 'fRSServiceCommand', + 'FRS-Service-Command-Status': 'fRSServiceCommandStatus', + 'FRS-Staging-Path': 'fRSStagingPath', + 'FRS-Time-Last-Command': 'fRSTimeLastCommand', + 'FRS-Time-Last-Config-Change': 'fRSTimeLastConfigChange', + 'FRS-Update-Timeout': 'fRSUpdateTimeout', + 'FRS-Version': 'fRSVersion', + 'FRS-Version-GUID': 'fRSVersionGUID', + 'FRS-Working-Path': 'fRSWorkingPath', + 'FSMO-Role-Owner': 'fSMORoleOwner', + 'Facsimile-Telephone-Number': 'facsimileTelephoneNumber', + 'File-Ext-Priority': 'fileExtPriority', + 'Flags': 'flags', + 'Flat-Name': 'flatName', + 'Force-Logoff': 'forceLogoff', + 'Foreign-Identifier': 'foreignIdentifier', + 'Friendly-Names': 'friendlyNames', + 'From-Entry': 'fromEntry', + 'From-Server': 'fromServer', + 'Frs-Computer-Reference': 'frsComputerReference', + 'Frs-Computer-Reference-BL': 'frsComputerReferenceBL', + 'GP-Link': 'gPLink', + 'GP-Options': 'gPOptions', + 'GPC-File-Sys-Path': 'gPCFileSysPath', + 'GPC-Functionality-Version': 'gPCFunctionalityVersion', + 'GPC-Machine-Extension-Names': 'gPCMachineExtensionNames', + 'GPC-User-Extension-Names': 'gPCUserExtensionNames', + 'GPC-WQL-Filter': 'gPCWQLFilter', + 'GPC-Linked-OU': 'lc', + 'Garbage-Coll-Period': 'garbageCollPeriod', + 'Generated-Connection': 'generatedConnection', + 'Generation-Qualifier': 'generationQualifier', + 'Given-Name': 'givenName', + 'Global-Address-List': 'globalAddressList', + 'Global-Address-List2': 'globalAddressList2', + 'Governs-ID': 'governsID', + 'Group-Attributes': 'groupAttributes', + 'Group-Membership-SAM': 'groupMembershipSAM', + 'Group-Priority': 'groupPriority', + 'Group-Type': 'groupType', + 'Groups-to-Ignore': 'groupsToIgnore', + 'Has-Master-NCs': 'hasMasterNCs', + 'Has-Partial-Replica-NCs': 'hasPartialReplicaNCs', + 'Help-Data16': 'helpData16', + 'Help-Data32': 'helpData32', + 'Help-File-Name': 'helpFileName', + 'Hide-From-AB': 'hideFromAB', + 'Home-Directory': 'homeDirectory', + 'Home-Drive': 'homeDrive', + 'IPSEC-Negotiation-Policy-Action': 'iPSECNegotiationPolicyAction', + 'IPSEC-Negotiation-Policy-Type': 'iPSECNegotiationPolicyType', + 'Icon-Path': 'iconPath', + 'Implemented-Categories': 'implementedCategories', + 'IndexedScopes': 'indexedScopes', + 'Initial-Auth-Incoming': 'initialAuthIncoming', + 'Initial-Auth-Outgoing': 'initialAuthOutgoing', + 'Initials': 'initials', + 'Install-Ui-Level': 'installUiLevel', + 'Instance-Type': 'instanceType', + 'Inter-Site-Topology-Failover': 'interSiteTopologyFailover', + 'Inter-Site-Topology-Generator': 'interSiteTopologyGenerator', + 'Inter-Site-Topology-Renew': 'interSiteTopologyRenew', + 'International-ISDN-Number': 'internationalISDNNumber', + 'Invocation-Id': 'invocationId', + 'Ipsec-Data': 'ipsecData', + 'Ipsec-Data-Type': 'ipsecDataType', + 'Ipsec-Filter-Reference': 'ipsecFilterReference', + 'Ipsec-ID': 'ipsecID', + 'Ipsec-ISAKMP-Reference': 'ipsecISAKMPReference', + 'Ipsec-NFA-Reference': 'ipsecNFAReference', + 'Ipsec-Name': 'ipsecName', + 'Ipsec-Negotiation-Policy-Reference': 'ipsecNegotiationPolicyReference', + 'Ipsec-Owners-Reference': 'ipsecOwnersReference', + 'Ipsec-Policy-Reference': 'ipsecPolicyReference', + 'Is-Critical-System-Object': 'isCriticalSystemObject', + 'Is-Defunct': 'isDefunct', + 'Is-Deleted': 'isDeleted', + 'Is-Ephemeral': 'isEphemeral', + 'Is-Member-Of-DL': 'memberOf', + 'Is-Member-Of-Partial-Attribute-Set': 'isMemberOfPartialAttributeSet', + 'Is-Privilege-Holder': 'isPrivilegeHolder', + 'Is-Recycled': 'isRecycled', + 'Is-Single-Valued': 'isSingleValued', + 'Keywords': 'keywords', + 'Knowledge-Information': 'knowledgeInformation', + 'LDAP-Admin-Limits': 'lDAPAdminLimits', + 'LDAP-Display-Name': 'lDAPDisplayName', + 'LDAP-IPDeny-List': 'lDAPIPDenyList', + 'LSA-Creation-Time': 'lSACreationTime', + 'LSA-Modified-Count': 'lSAModifiedCount', + 'Last-Backup-Restoration-Time': 'lastBackupRestorationTime', + 'Last-Content-Indexed': 'lastContentIndexed', + 'Last-Known-Parent': 'lastKnownParent', + 'Last-Logoff': 'lastLogoff', + 'Last-Logon': 'lastLogon', + 'Last-Logon-Timestamp': 'lastLogonTimestamp', + 'Last-Set-Time': 'lastSetTime', + 'Last-Update-Sequence': 'lastUpdateSequence', + 'Legacy-Exchange-DN': 'legacyExchangeDN', + 'Link-ID': 'linkID', + 'Link-Track-Secret': 'linkTrackSecret', + 'Lm-Pwd-History': 'lmPwdHistory', + 'Local-Policy-Flags': 'localPolicyFlags', + 'Local-Policy-Reference': 'localPolicyReference', + 'Locale-ID': 'localeID', + 'Locality-Name': 'l', + 'Localization-Display-Id': 'localizationDisplayId', + 'Localized-Description': 'localizedDescription', + 'Location': 'location', + 'Lock-Out-Observation-Window': 'lockOutObservationWindow', + 'Lockout-Duration': 'lockoutDuration', + 'Lockout-Threshold': 'lockoutThreshold', + 'Lockout-Time': 'lockoutTime', + 'Logo': 'thumbnailLogo', + 'Logon-Count': 'logonCount', + 'Logon-Hours': 'logonHours', + 'Logon-Workstation': 'logonWorkstation', + 'MAPI-ID': 'mAPIID', + 'MHS-OR-Address': 'mhsORAddress', + 'MS-DRM-Identity-Certificate': 'msDRM-IdentityCertificate', + 'MS-DS-All-Users-Trust-Quota': 'msDS-AllUsersTrustQuota', + 'MS-DS-Consistency-Child-Count': 'mS-DS-ConsistencyChildCount', + 'MS-DS-Consistency-Guid': 'mS-DS-ConsistencyGuid', + 'MS-DS-Creator-SID': 'mS-DS-CreatorSID', + 'MS-DS-Machine-Account-Quota': 'ms-DS-MachineAccountQuota', + 'MS-DS-Per-User-Trust-Quota': 'msDS-PerUserTrustQuota', + 'MS-DS-Per-User-Trust-Tombstones-Quota': 'msDS-PerUserTrustTombstonesQuota', + 'MS-DS-Replicates-NC-Reason': 'mS-DS-ReplicatesNCReason', + 'MS-SQL-Alias': 'mS-SQL-Alias', + 'MS-SQL-AllowAnonymousSubscription': 'mS-SQL-AllowAnonymousSubscription', + 'MS-SQL-AllowImmediateUpdatingSubscription': 'mS-SQL-AllowImmediateUpdatingSubscription', + 'MS-SQL-AllowKnownPullSubscription': 'mS-SQL-AllowKnownPullSubscription', + 'MS-SQL-AllowQueuedUpdatingSubscription': 'mS-SQL-AllowQueuedUpdatingSubscription', + 'MS-SQL-AllowSnapshotFilesFTPDownloading': 'mS-SQL-AllowSnapshotFilesFTPDownloading', + 'MS-SQL-AppleTalk': 'mS-SQL-AppleTalk', + 'MS-SQL-Applications': 'mS-SQL-Applications', + 'MS-SQL-Build': 'mS-SQL-Build', + 'MS-SQL-CharacterSet': 'mS-SQL-CharacterSet', + 'MS-SQL-Clustered': 'mS-SQL-Clustered', + 'MS-SQL-ConnectionURL': 'mS-SQL-ConnectionURL', + 'MS-SQL-Contact': 'mS-SQL-Contact', + 'MS-SQL-CreationDate': 'mS-SQL-CreationDate', + 'MS-SQL-Database': 'mS-SQL-Database', + 'MS-SQL-Description': 'mS-SQL-Description', + 'MS-SQL-GPSHeight': 'mS-SQL-GPSHeight', + 'MS-SQL-GPSLatitude': 'mS-SQL-GPSLatitude', + 'MS-SQL-GPSLongitude': 'mS-SQL-GPSLongitude', + 'MS-SQL-InformationDirectory': 'mS-SQL-InformationDirectory', + 'MS-SQL-InformationURL': 'mS-SQL-InformationURL', + 'MS-SQL-Keywords': 'mS-SQL-Keywords', + 'MS-SQL-Language': 'mS-SQL-Language', + 'MS-SQL-LastBackupDate': 'mS-SQL-LastBackupDate', + 'MS-SQL-LastDiagnosticDate': 'mS-SQL-LastDiagnosticDate', + 'MS-SQL-LastUpdatedDate': 'mS-SQL-LastUpdatedDate', + 'MS-SQL-Location': 'mS-SQL-Location', + 'MS-SQL-Memory': 'mS-SQL-Memory', + 'MS-SQL-MultiProtocol': 'mS-SQL-MultiProtocol', + 'MS-SQL-Name': 'mS-SQL-Name', + 'MS-SQL-NamedPipe': 'mS-SQL-NamedPipe', + 'MS-SQL-PublicationURL': 'mS-SQL-PublicationURL', + 'MS-SQL-Publisher': 'mS-SQL-Publisher', + 'MS-SQL-RegisteredOwner': 'mS-SQL-RegisteredOwner', + 'MS-SQL-SPX': 'mS-SQL-SPX', + 'MS-SQL-ServiceAccount': 'mS-SQL-ServiceAccount', + 'MS-SQL-Size': 'mS-SQL-Size', + 'MS-SQL-SortOrder': 'mS-SQL-SortOrder', + 'MS-SQL-Status': 'mS-SQL-Status', + 'MS-SQL-TCPIP': 'mS-SQL-TCPIP', + 'MS-SQL-ThirdParty': 'mS-SQL-ThirdParty', + 'MS-SQL-Type': 'mS-SQL-Type', + 'MS-SQL-UnicodeSortOrder': 'mS-SQL-UnicodeSortOrder', + 'MS-SQL-Version': 'mS-SQL-Version', + 'MS-SQL-Vines': 'mS-SQL-Vines', + 'MS-TS-ExpireDate': 'msTSExpireDate', + 'MS-TS-ExpireDate2': 'msTSExpireDate2', + 'MS-TS-ExpireDate3': 'msTSExpireDate3', + 'MS-TS-ExpireDate4': 'msTSExpireDate4', + 'MS-TS-LicenseVersion': 'msTSLicenseVersion', + 'MS-TS-LicenseVersion2': 'msTSLicenseVersion2', + 'MS-TS-LicenseVersion3': 'msTSLicenseVersion3', + 'MS-TS-LicenseVersion4': 'msTSLicenseVersion4', + 'MS-TS-ManagingLS': 'msTSManagingLS', + 'MS-TS-ManagingLS2': 'msTSManagingLS2', + 'MS-TS-ManagingLS3': 'msTSManagingLS3', + 'MS-TS-ManagingLS4': 'msTSManagingLS4', + 'MS-TS-Property01': 'msTSProperty01', + 'MS-TS-Property02': 'msTSProperty02', + 'MS-TSLS-Property01': 'msTSLSProperty01', + 'MS-TSLS-Property02': 'msTSLSProperty02', + 'MSMQ-Authenticate': 'mSMQAuthenticate', + 'MSMQ-Base-Priority': 'mSMQBasePriority', + 'MSMQ-CSP-Name': 'mSMQCSPName', + 'MSMQ-Computer-Type': 'mSMQComputerType', + 'MSMQ-Computer-Type-Ex': 'mSMQComputerTypeEx', + 'MSMQ-Cost': 'mSMQCost', + 'MSMQ-Dependent-Client-Service': 'mSMQDependentClientService', + 'MSMQ-Dependent-Client-Services': 'mSMQDependentClientServices', + 'MSMQ-Digests': 'mSMQDigests', + 'MSMQ-Digests-Mig': 'mSMQDigestsMig', + 'MSMQ-Ds-Service': 'mSMQDsService', + 'MSMQ-Ds-Services': 'mSMQDsServices', + 'MSMQ-Encrypt-Key': 'mSMQEncryptKey', + 'MSMQ-Foreign': 'mSMQForeign', + 'MSMQ-In-Routing-Servers': 'mSMQInRoutingServers', + 'MSMQ-Interval1': 'mSMQInterval1', + 'MSMQ-Interval2': 'mSMQInterval2', + 'MSMQ-Journal': 'mSMQJournal', + 'MSMQ-Journal-Quota': 'mSMQJournalQuota', + 'MSMQ-Label': 'mSMQLabel', + 'MSMQ-Label-Ex': 'mSMQLabelEx', + 'MSMQ-Long-Lived': 'mSMQLongLived', + 'MSMQ-Migrated': 'mSMQMigrated', + 'MSMQ-Multicast-Address': 'MSMQ-MulticastAddress', + 'MSMQ-Name-Style': 'mSMQNameStyle', + 'MSMQ-Nt4-Flags': 'mSMQNt4Flags', + 'MSMQ-Nt4-Stub': 'mSMQNt4Stub', + 'MSMQ-OS-Type': 'mSMQOSType', + 'MSMQ-Out-Routing-Servers': 'mSMQOutRoutingServers', + 'MSMQ-Owner-ID': 'mSMQOwnerID', + 'MSMQ-Prev-Site-Gates': 'mSMQPrevSiteGates', + 'MSMQ-Privacy-Level': 'mSMQPrivacyLevel', + 'MSMQ-QM-ID': 'mSMQQMID', + 'MSMQ-Queue-Journal-Quota': 'mSMQQueueJournalQuota', + 'MSMQ-Queue-Name-Ext': 'mSMQQueueNameExt', + 'MSMQ-Queue-Quota': 'mSMQQueueQuota', + 'MSMQ-Queue-Type': 'mSMQQueueType', + 'MSMQ-Quota': 'mSMQQuota', + 'MSMQ-Recipient-FormatName': 'msMQ-Recipient-FormatName', + 'MSMQ-Routing-Service': 'mSMQRoutingService', + 'MSMQ-Routing-Services': 'mSMQRoutingServices', + 'MSMQ-Secured-Source': 'MSMQ-SecuredSource', + 'MSMQ-Service-Type': 'mSMQServiceType', + 'MSMQ-Services': 'mSMQServices', + 'MSMQ-Sign-Certificates': 'mSMQSignCertificates', + 'MSMQ-Sign-Certificates-Mig': 'mSMQSignCertificatesMig', + 'MSMQ-Sign-Key': 'mSMQSignKey', + 'MSMQ-Site-1': 'mSMQSite1', + 'MSMQ-Site-2': 'mSMQSite2', + 'MSMQ-Site-Foreign': 'mSMQSiteForeign', + 'MSMQ-Site-Gates': 'mSMQSiteGates', + 'MSMQ-Site-Gates-Mig': 'mSMQSiteGatesMig', + 'MSMQ-Site-ID': 'mSMQSiteID', + 'MSMQ-Site-Name': 'mSMQSiteName', + 'MSMQ-Site-Name-Ex': 'mSMQSiteNameEx', + 'MSMQ-Sites': 'mSMQSites', + 'MSMQ-Transactional': 'mSMQTransactional', + 'MSMQ-User-Sid': 'mSMQUserSid', + 'MSMQ-Version': 'mSMQVersion', + 'Machine-Architecture': 'machineArchitecture', + 'Machine-Password-Change-Interval': 'machinePasswordChangeInterval', + 'Machine-Role': 'machineRole', + 'Machine-Wide-Policy': 'machineWidePolicy', + 'Managed-By': 'managedBy', + 'Managed-Objects': 'managedObjects', + 'Manager': 'manager', + 'Marshalled-Interface': 'marshalledInterface', + 'Mastered-By': 'masteredBy', + 'Max-Pwd-Age': 'maxPwdAge', + 'Max-Renew-Age': 'maxRenewAge', + 'Max-Storage': 'maxStorage', + 'Max-Ticket-Age': 'maxTicketAge', + 'May-Contain': 'mayContain', + 'Member': 'member', + 'Min-Pwd-Age': 'minPwdAge', + 'Min-Pwd-Length': 'minPwdLength', + 'Min-Ticket-Age': 'minTicketAge', + 'Modified-Count': 'modifiedCount', + 'Modified-Count-At-Last-Prom': 'modifiedCountAtLastProm', + 'Modify-Time-Stamp': 'modifyTimeStamp', + 'Moniker': 'moniker', + 'Moniker-Display-Name': 'monikerDisplayName', + 'Move-Tree-State': 'moveTreeState', + 'Mscope-Id': 'mscopeId', + 'Msi-File-List': 'msiFileList', + 'Msi-Script': 'msiScript', + 'Msi-Script-Name': 'msiScriptName', + 'Msi-Script-Path': 'msiScriptPath', + 'Msi-Script-Size': 'msiScriptSize', + 'Must-Contain': 'mustContain', + 'NC-Name': 'nCName', + 'NETBIOS-Name': 'nETBIOSName', + 'NT-Group-Members': 'nTGroupMembers', + 'NT-Mixed-Domain': 'nTMixedDomain', + 'NT-Security-Descriptor': 'nTSecurityDescriptor', + 'Name-Service-Flags': 'nameServiceFlags', + 'Netboot-GUID': 'netbootGUID', + 'Netboot-Initialization': 'netbootInitialization', + 'Netboot-Machine-File-Path': 'netbootMachineFilePath', + 'Netboot-Mirror-Data-File': 'netbootMirrorDataFile', + 'Netboot-SIF-File': 'netbootSIFFile', + 'Network-Address': 'networkAddress', + 'Next-Level-Store': 'nextLevelStore', + 'Next-Rid': 'nextRid', + 'Non-Security-Member': 'nonSecurityMember', + 'Non-Security-Member-BL': 'nonSecurityMemberBL', + 'Notification-List': 'notificationList', + 'Nt-Pwd-History': 'ntPwdHistory', + 'OEM-Information': 'oEMInformation', + 'OM-Object-Class': 'oMObjectClass', + 'OM-Syntax': 'oMSyntax', + 'OMT-Guid': 'oMTGuid', + 'OMT-Indx-Guid': 'oMTIndxGuid', + 'Obj-Dist-Name': 'distinguishedName', + 'Object-Category': 'objectCategory', + 'Object-Class': 'objectClass', + 'Object-Class-Category': 'objectClassCategory', + 'Object-Classes': 'objectClasses', + 'Object-Count': 'objectCount', + 'Object-Guid': 'objectGUID', + 'Object-Sid': 'objectSid', + 'Object-Version': 'objectVersion', + 'Operating-System': 'operatingSystem', + 'Operating-System-Hotfix': 'operatingSystemHotfix', + 'Operating-System-Service-Pack': 'operatingSystemServicePack', + 'Operating-System-Version': 'operatingSystemVersion', + 'Operator-Count': 'operatorCount', + 'Option-Description': 'optionDescription', + 'Options': 'options', + 'Options-Location': 'optionsLocation', + 'Organization-Name': 'o', + 'Organizational-Unit-Name': 'ou', + 'Original-Display-Table': 'originalDisplayTable', + 'Original-Display-Table-MSDOS': 'originalDisplayTableMSDOS', + 'Other-Login-Workstations': 'otherLoginWorkstations', + 'Other-Mailbox': 'otherMailbox', + 'Other-Name': 'middleName', + 'Other-Well-Known-Objects': 'otherWellKnownObjects', + 'Owner': 'owner', + 'PKI-Critical-Extensions': 'pKICriticalExtensions', + 'PKI-Default-CSPs': 'pKIDefaultCSPs', + 'PKI-Default-Key-Spec': 'pKIDefaultKeySpec', + 'PKI-Enrollment-Access': 'pKIEnrollmentAccess', + 'PKI-Expiration-Period': 'pKIExpirationPeriod', + 'PKI-Extended-Key-Usage': 'pKIExtendedKeyUsage', + 'PKI-Key-Usage': 'pKIKeyUsage', + 'PKI-Max-Issuing-Depth': 'pKIMaxIssuingDepth', + 'PKI-Overlap-Period': 'pKIOverlapPeriod', + 'PKT': 'pKT', + 'PKT-Guid': 'pKTGuid', + 'Package-Flags': 'packageFlags', + 'Package-Name': 'packageName', + 'Package-Type': 'packageType', + 'Parent-CA': 'parentCA', + 'Parent-CA-Certificate-Chain': 'parentCACertificateChain', + 'Parent-GUID': 'parentGUID', + 'Partial-Attribute-Deletion-List': 'partialAttributeDeletionList', + 'Partial-Attribute-Set': 'partialAttributeSet', + 'Pek-Key-Change-Interval': 'pekKeyChangeInterval', + 'Pek-List': 'pekList', + 'Pending-CA-Certificates': 'pendingCACertificates', + 'Pending-Parent-CA': 'pendingParentCA', + 'Per-Msg-Dialog-Display-Table': 'perMsgDialogDisplayTable', + 'Per-Recip-Dialog-Display-Table': 'perRecipDialogDisplayTable', + 'Personal-Title': 'personalTitle', + 'Phone-Fax-Other': 'otherFacsimileTelephoneNumber', + 'Phone-Home-Other': 'otherHomePhone', + 'Phone-Home-Primary': 'homePhone', + 'Phone-ISDN-Primary': 'primaryInternationalISDNNumber', + 'Phone-Ip-Other': 'otherIpPhone', + 'Phone-Ip-Primary': 'ipPhone', + 'Phone-Mobile-Other': 'otherMobile', + 'Phone-Mobile-Primary': 'mobile', + 'Phone-Office-Other': 'otherTelephone', + 'Phone-Pager-Other': 'otherPager', + 'Phone-Pager-Primary': 'pager', + 'Physical-Delivery-Office-Name': 'physicalDeliveryOfficeName', + 'Physical-Location-Object': 'physicalLocationObject', + 'Picture': 'thumbnailPhoto', + 'Policy-Replication-Flags': 'policyReplicationFlags', + 'Port-Name': 'portName', + 'Poss-Superiors': 'possSuperiors', + 'Possible-Inferiors': 'possibleInferiors', + 'Post-Office-Box': 'postOfficeBox', + 'Postal-Address': 'postalAddress', + 'Postal-Code': 'postalCode', + 'Preferred-Delivery-Method': 'preferredDeliveryMethod', + 'Preferred-OU': 'preferredOU', + 'Prefix-Map': 'prefixMap', + 'Presentation-Address': 'presentationAddress', + 'Previous-CA-Certificates': 'previousCACertificates', + 'Previous-Parent-CA': 'previousParentCA', + 'Primary-Group-ID': 'primaryGroupID', + 'Primary-Group-Token': 'primaryGroupToken', + 'Print-Attributes': 'printAttributes', + 'Print-Bin-Names': 'printBinNames', + 'Print-Collate': 'printCollate', + 'Print-Color': 'printColor', + 'Print-Duplex-Supported': 'printDuplexSupported', + 'Print-End-Time': 'printEndTime', + 'Print-Form-Name': 'printFormName', + 'Print-Keep-Printed-Jobs': 'printKeepPrintedJobs', + 'Print-Language': 'printLanguage', + 'Print-MAC-Address': 'printMACAddress', + 'Print-Max-Copies': 'printMaxCopies', + 'Print-Max-Resolution-Supported': 'printMaxResolutionSupported', + 'Print-Max-X-Extent': 'printMaxXExtent', + 'Print-Max-Y-Extent': 'printMaxYExtent', + 'Print-Media-Ready': 'printMediaReady', + 'Print-Media-Supported': 'printMediaSupported', + 'Print-Memory': 'printMemory', + 'Print-Min-X-Extent': 'printMinXExtent', + 'Print-Min-Y-Extent': 'printMinYExtent', + 'Print-Network-Address': 'printNetworkAddress', + 'Print-Notify': 'printNotify', + 'Print-Number-Up': 'printNumberUp', + 'Print-Orientations-Supported': 'printOrientationsSupported', + 'Print-Owner': 'printOwner', + 'Print-Pages-Per-Minute': 'printPagesPerMinute', + 'Print-Rate': 'printRate', + 'Print-Rate-Unit': 'printRateUnit', + 'Print-Separator-File': 'printSeparatorFile', + 'Print-Share-Name': 'printShareName', + 'Print-Spooling': 'printSpooling', + 'Print-Stapling-Supported': 'printStaplingSupported', + 'Print-Start-Time': 'printStartTime', + 'Print-Status': 'printStatus', + 'Printer-Name': 'printerName', + 'Prior-Set-Time': 'priorSetTime', + 'Prior-Value': 'priorValue', + 'Priority': 'priority', + 'Private-Key': 'privateKey', + 'Privilege-Attributes': 'privilegeAttributes', + 'Privilege-Display-Name': 'privilegeDisplayName', + 'Privilege-Holder': 'privilegeHolder', + 'Privilege-Value': 'privilegeValue', + 'Product-Code': 'productCode', + 'Profile-Path': 'profilePath', + 'Proxied-Object-Name': 'proxiedObjectName', + 'Proxy-Addresses': 'proxyAddresses', + 'Proxy-Generation-Enabled': 'proxyGenerationEnabled', + 'Proxy-Lifetime': 'proxyLifetime', + 'Public-Key-Policy': 'publicKeyPolicy', + 'Purported-Search': 'purportedSearch', + 'Pwd-History-Length': 'pwdHistoryLength', + 'Pwd-Last-Set': 'pwdLastSet', + 'Pwd-Properties': 'pwdProperties', + 'Quality-Of-Service': 'qualityOfService', + 'Query-Filter': 'queryFilter', + 'Query-Policy-BL': 'queryPolicyBL', + 'Query-Policy-Object': 'queryPolicyObject', + 'QueryPoint': 'queryPoint', + 'RDN': 'name', + 'RDN-Att-ID': 'rDNAttID', + 'RID-Allocation-Pool': 'rIDAllocationPool', + 'RID-Available-Pool': 'rIDAvailablePool', + 'RID-Manager-Reference': 'rIDManagerReference', + 'RID-Next-RID': 'rIDNextRID', + 'RID-Previous-Allocation-Pool': 'rIDPreviousAllocationPool', + 'RID-Set-References': 'rIDSetReferences', + 'RID-Used-Pool': 'rIDUsedPool', + 'Range-Lower': 'rangeLower', + 'Range-Upper': 'rangeUpper', + 'Registered-Address': 'registeredAddress', + 'Remote-Server-Name': 'remoteServerName', + 'Remote-Source': 'remoteSource', + 'Remote-Source-Type': 'remoteSourceType', + 'Remote-Storage-GUID': 'remoteStorageGUID', + 'Repl-Interval': 'replInterval', + 'Repl-Property-Meta-Data': 'replPropertyMetaData', + 'Repl-Topology-Stay-Of-Execution': 'replTopologyStayOfExecution', + 'Repl-UpToDate-Vector': 'replUpToDateVector', + 'Replica-Source': 'replicaSource', + 'Reports': 'directReports', + 'Reps-From': 'repsFrom', + 'Reps-To': 'repsTo', + 'Required-Categories': 'requiredCategories', + 'Retired-Repl-DSA-Signatures': 'retiredReplDSASignatures', + 'Revision': 'revision', + 'Rid': 'rid', + 'Rights-Guid': 'rightsGuid', + 'Role-Occupant': 'roleOccupant', + 'Root-Trust': 'rootTrust', + 'SAM-Account-Name': 'sAMAccountName', + 'SAM-Account-Type': 'sAMAccountType', + 'SAM-Domain-Updates': 'samDomainUpdates', + 'SD-Rights-Effective': 'sDRightsEffective', + 'SID-History': 'sIDHistory', + 'SMTP-Mail-Address': 'mailAddress', + 'SPN-Mappings': 'sPNMappings', + 'Schedule': 'schedule', + 'Schema-Flags-Ex': 'schemaFlagsEx', + 'Schema-ID-GUID': 'schemaIDGUID', + 'Schema-Info': 'schemaInfo', + 'Schema-Update': 'schemaUpdate', + 'Schema-Version': 'schemaVersion', + 'Scope-Flags': 'scopeFlags', + 'Script-Path': 'scriptPath', + 'Search-Flags': 'searchFlags', + 'Search-Guide': 'searchGuide', + 'Security-Identifier': 'securityIdentifier', + 'See-Also': 'seeAlso', + 'Seq-Notification': 'seqNotification', + 'Serial-Number': 'serialNumber', + 'Server-Name': 'serverName', + 'Server-Reference': 'serverReference', + 'Server-Reference-BL': 'serverReferenceBL', + 'Server-Role': 'serverRole', + 'Server-State': 'serverState', + 'Service-Binding-Information': 'serviceBindingInformation', + 'Service-Class-ID': 'serviceClassID', + 'Service-Class-Info': 'serviceClassInfo', + 'Service-Class-Name': 'serviceClassName', + 'Service-DNS-Name': 'serviceDNSName', + 'Service-DNS-Name-Type': 'serviceDNSNameType', + 'Service-Instance-Version': 'serviceInstanceVersion', + 'Service-Principal-Name': 'servicePrincipalName', + 'Setup-Command': 'setupCommand', + 'Shell-Context-Menu': 'shellContextMenu', + 'Shell-Property-Pages': 'shellPropertyPages', + 'Short-Server-Name': 'shortServerName', + 'Show-In-Address-Book': 'showInAddressBook', + 'Show-In-Advanced-View-Only': 'showInAdvancedViewOnly', + 'Signature-Algorithms': 'signatureAlgorithms', + 'Site-GUID': 'siteGUID', + 'Site-Link-List': 'siteLinkList', + 'Site-List': 'siteList', + 'Site-Object': 'siteObject', + 'Site-Object-BL': 'siteObjectBL', + 'Site-Server': 'siteServer', + 'State-Or-Province-Name': 'st', + 'Street-Address': 'street', + 'Structural-Object-Class': 'structuralObjectClass', + 'Sub-Class-Of': 'subClassOf', + 'Sub-Refs': 'subRefs', + 'SubSchemaSubEntry': 'subSchemaSubEntry', + 'Super-Scope-Description': 'superScopeDescription', + 'Super-Scopes': 'superScopes', + 'Superior-DNS-Root': 'superiorDNSRoot', + 'Supplemental-Credentials': 'supplementalCredentials', + 'Supported-Application-Context': 'supportedApplicationContext', + 'Surname': 'sn', + 'Sync-Attributes': 'syncAttributes', + 'Sync-Membership': 'syncMembership', + 'Sync-With-Object': 'syncWithObject', + 'Sync-With-SID': 'syncWithSID', + 'System-Auxiliary-Class': 'systemAuxiliaryClass', + 'System-Flags': 'systemFlags', + 'System-May-Contain': 'systemMayContain', + 'System-Must-Contain': 'systemMustContain', + 'System-Only': 'systemOnly', + 'System-Poss-Superiors': 'systemPossSuperiors', + 'Telephone-Number': 'telephoneNumber', + 'Teletex-Terminal-Identifier': 'teletexTerminalIdentifier', + 'Telex-Number': 'telexNumber', + 'Telex-Primary': 'primaryTelexNumber', + 'Template-Roots': 'templateRoots', + 'Template-Roots2': 'templateRoots2', + 'Terminal-Server': 'terminalServer', + 'Text-Country': 'co', + 'Text-Encoded-OR-Address': 'textEncodedORAddress', + 'Time-Refresh': 'timeRefresh', + 'Time-Vol-Change': 'timeVolChange', + 'Title': 'title', + 'Token-Groups': 'tokenGroups', + 'Token-Groups-Global-And-Universal': 'tokenGroupsGlobalAndUniversal', + 'Token-Groups-No-GC-Acceptable': 'tokenGroupsNoGCAcceptable', + 'Tombstone-Lifetime': 'tombstoneLifetime', + 'Transport-Address-Attribute': 'transportAddressAttribute', + 'Transport-DLL-Name': 'transportDLLName', + 'Transport-Type': 'transportType', + 'Treat-As-Leaf': 'treatAsLeaf', + 'Tree-Name': 'treeName', + 'Trust-Attributes': 'trustAttributes', + 'Trust-Auth-Incoming': 'trustAuthIncoming', + 'Trust-Auth-Outgoing': 'trustAuthOutgoing', + 'Trust-Direction': 'trustDirection', + 'Trust-Parent': 'trustParent', + 'Trust-Partner': 'trustPartner', + 'Trust-Posix-Offset': 'trustPosixOffset', + 'Trust-Type': 'trustType', + 'UAS-Compat': 'uASCompat', + 'UNC-Name': 'uNCName', + 'UPN-Suffixes': 'uPNSuffixes', + 'USN-Changed': 'uSNChanged', + 'USN-Created': 'uSNCreated', + 'USN-DSA-Last-Obj-Removed': 'uSNDSALastObjRemoved', + 'USN-Intersite': 'USNIntersite', + 'USN-Last-Obj-Rem': 'uSNLastObjRem', + 'USN-Source': 'uSNSource', + 'Unicode-Pwd': 'unicodePwd', + 'Upgrade-Product-Code': 'upgradeProductCode', + 'User-Account-Control': 'userAccountControl', + 'User-Cert': 'userCert', + 'User-Comment': 'comment', + 'User-Parameters': 'userParameters', + 'User-Password': 'userPassword', + 'User-Principal-Name': 'userPrincipalName', + 'User-SMIME-Certificate': 'userSMIMECertificate', + 'User-Shared-Folder': 'userSharedFolder', + 'User-Shared-Folder-Other': 'userSharedFolderOther', + 'User-Workstations': 'userWorkstations', + 'Valid-Accesses': 'validAccesses', + 'Vendor': 'vendor', + 'Version-Number': 'versionNumber', + 'Version-Number-Hi': 'versionNumberHi', + 'Version-Number-Lo': 'versionNumberLo', + 'Vol-Table-GUID': 'volTableGUID', + 'Vol-Table-Idx-GUID': 'volTableIdxGUID', + 'Volume-Count': 'volumeCount', + 'WWW-Home-Page': 'wWWHomePage', + 'WWW-Page-Other': 'url', + 'Wbem-Path': 'wbemPath', + 'Well-Known-Objects': 'wellKnownObjects', + 'When-Changed': 'whenChanged', + 'When-Created': 'whenCreated', + 'Winsock-Addresses': 'winsockAddresses', + 'X121-Address': 'x121Address', + 'X509-Cert': 'userCertificate', + 'associatedDomain': 'associatedDomain', + 'associatedName': 'associatedName', + 'attributeCertificateAttribute': 'attributeCertificateAttribute', + 'audio': 'audio', + 'bootFile': 'bootFile', + 'bootParameter': 'bootParameter', + 'buildingName': 'buildingName', + 'carLicense': 'carLicense', + 'departmentNumber': 'departmentNumber', + 'dhcp-Classes': 'dhcpClasses', + 'dhcp-Flags': 'dhcpFlags', + 'dhcp-Identification': 'dhcpIdentification', + 'dhcp-Mask': 'dhcpMask', + 'dhcp-MaxKey': 'dhcpMaxKey', + 'dhcp-Obj-Description': 'dhcpObjDescription', + 'dhcp-Obj-Name': 'dhcpObjName', + 'dhcp-Options': 'dhcpOptions', + 'dhcp-Properties': 'dhcpProperties', + 'dhcp-Ranges': 'dhcpRanges', + 'dhcp-Reservations': 'dhcpReservations', + 'dhcp-Servers': 'dhcpServers', + 'dhcp-Sites': 'dhcpSites', + 'dhcp-State': 'dhcpState', + 'dhcp-Subnets': 'dhcpSubnets', + 'dhcp-Type': 'dhcpType', + 'dhcp-Unique-Key': 'dhcpUniqueKey', + 'dhcp-Update-Time': 'dhcpUpdateTime', + 'documentAuthor': 'documentAuthor', + 'documentIdentifier': 'documentIdentifier', + 'documentLocation': 'documentLocation', + 'documentPublisher': 'documentPublisher', + 'documentTitle': 'documentTitle', + 'documentVersion': 'documentVersion', + 'drink': 'drink', + 'gecos': 'gecos', + 'gidNumber': 'gidNumber', + 'host': 'host', + 'houseIdentifier': 'houseIdentifier', + 'ipHostNumber': 'ipHostNumber', + 'ipNetmaskNumber': 'ipNetmaskNumber', + 'ipNetworkNumber': 'ipNetworkNumber', + 'ipProtocolNumber': 'ipProtocolNumber', + 'ipServicePort': 'ipServicePort', + 'ipServiceProtocol': 'ipServiceProtocol', + 'jpegPhoto': 'jpegPhoto', + 'labeledURI': 'labeledURI', + 'loginShell': 'loginShell', + 'macAddress': 'macAddress', + 'meetingAdvertiseScope': 'meetingAdvertiseScope', + 'meetingApplication': 'meetingApplication', + 'meetingBandwidth': 'meetingBandwidth', + 'meetingBlob': 'meetingBlob', + 'meetingContactInfo': 'meetingContactInfo', + 'meetingDescription': 'meetingDescription', + 'meetingEndTime': 'meetingEndTime', + 'meetingID': 'meetingID', + 'meetingIP': 'meetingIP', + 'meetingIsEncrypted': 'meetingIsEncrypted', + 'meetingKeyword': 'meetingKeyword', + 'meetingLanguage': 'meetingLanguage', + 'meetingLocation': 'meetingLocation', + 'meetingMaxParticipants': 'meetingMaxParticipants', + 'meetingName': 'meetingName', + 'meetingOriginator': 'meetingOriginator', + 'meetingOwner': 'meetingOwner', + 'meetingProtocol': 'meetingProtocol', + 'meetingRating': 'meetingRating', + 'meetingRecurrence': 'meetingRecurrence', + 'meetingScope': 'meetingScope', + 'meetingStartTime': 'meetingStartTime', + 'meetingType': 'meetingType', + 'meetingURL': 'meetingURL', + 'memberNisNetgroup': 'memberNisNetgroup', + 'memberUid': 'memberUid', + 'ms-Authz-Central-Access-Policy-ID': 'msAuthz-CentralAccessPolicyID', + 'ms-Authz-Effective-Security-Policy': 'msAuthz-EffectiveSecurityPolicy', + 'ms-Authz-Last-Effective-Security-Policy': 'msAuthz-LastEffectiveSecurityPolicy', + 'ms-Authz-Member-Rules-In-Central-Access-Policy': 'msAuthz-MemberRulesInCentralAccessPolicy', + 'ms-Authz-Member-Rules-In-Central-Access-Policy-BL': 'msAuthz-MemberRulesInCentralAccessPolicyBL', + 'ms-Authz-Proposed-Security-Policy': 'msAuthz-ProposedSecurityPolicy', + 'ms-Authz-Resource-Condition': 'msAuthz-ResourceCondition', + 'ms-COM-DefaultPartitionLink': 'msCOM-DefaultPartitionLink', + 'ms-COM-ObjectId': 'msCOM-ObjectId', + 'ms-COM-PartitionLink': 'msCOM-PartitionLink', + 'ms-COM-PartitionSetLink': 'msCOM-PartitionSetLink', + 'ms-COM-UserLink': 'msCOM-UserLink', + 'ms-COM-UserPartitionSetLink': 'msCOM-UserPartitionSetLink', + 'ms-DFS-Comment-v2': 'msDFS-Commentv2', + 'ms-DFS-Generation-GUID-v2': 'msDFS-GenerationGUIDv2', + 'ms-DFS-Last-Modified-v2': 'msDFS-LastModifiedv2', + 'ms-DFS-Link-Identity-GUID-v2': 'msDFS-LinkIdentityGUIDv2', + 'ms-DFS-Link-Path-v2': 'msDFS-LinkPathv2', + 'ms-DFS-Link-Security-Descriptor-v2': 'msDFS-LinkSecurityDescriptorv2', + 'ms-DFS-Namespace-Identity-GUID-v2': 'msDFS-NamespaceIdentityGUIDv2', + 'ms-DFS-Properties-v2': 'msDFS-Propertiesv2', + 'ms-DFS-Schema-Major-Version': 'msDFS-SchemaMajorVersion', + 'ms-DFS-Schema-Minor-Version': 'msDFS-SchemaMinorVersion', + 'ms-DFS-Short-Name-Link-Path-v2': 'msDFS-ShortNameLinkPathv2', + 'ms-DFS-Target-List-v2': 'msDFS-TargetListv2', + 'ms-DFS-Ttl-v2': 'msDFS-Ttlv2', + 'ms-DFSR-CachePolicy': 'msDFSR-CachePolicy', + 'ms-DFSR-CommonStagingPath': 'msDFSR-CommonStagingPath', + 'ms-DFSR-CommonStagingSizeInMb': 'msDFSR-CommonStagingSizeInMb', + 'ms-DFSR-ComputerReference': 'msDFSR-ComputerReference', + 'ms-DFSR-ComputerReferenceBL': 'msDFSR-ComputerReferenceBL', + 'ms-DFSR-ConflictPath': 'msDFSR-ConflictPath', + 'ms-DFSR-ConflictSizeInMb': 'msDFSR-ConflictSizeInMb', + 'ms-DFSR-ContentSetGuid': 'msDFSR-ContentSetGuid', + 'ms-DFSR-DefaultCompressionExclusionFilter': 'msDFSR-DefaultCompressionExclusionFilter', + 'ms-DFSR-DeletedPath': 'msDFSR-DeletedPath', + 'ms-DFSR-DeletedSizeInMb': 'msDFSR-DeletedSizeInMb', + 'ms-DFSR-DfsLinkTarget': 'msDFSR-DfsLinkTarget', + 'ms-DFSR-DfsPath': 'msDFSR-DfsPath', + 'ms-DFSR-DirectoryFilter': 'msDFSR-DirectoryFilter', + 'ms-DFSR-DisablePacketPrivacy': 'msDFSR-DisablePacketPrivacy', + 'ms-DFSR-Enabled': 'msDFSR-Enabled', + 'ms-DFSR-Extension': 'msDFSR-Extension', + 'ms-DFSR-FileFilter': 'msDFSR-FileFilter', + 'ms-DFSR-Flags': 'msDFSR-Flags', + 'ms-DFSR-Keywords': 'msDFSR-Keywords', + 'ms-DFSR-MaxAgeInCacheInMin': 'msDFSR-MaxAgeInCacheInMin', + 'ms-DFSR-MemberReference': 'msDFSR-MemberReference', + 'ms-DFSR-MemberReferenceBL': 'msDFSR-MemberReferenceBL', + 'ms-DFSR-MinDurationCacheInMin': 'msDFSR-MinDurationCacheInMin', + 'ms-DFSR-OnDemandExclusionDirectoryFilter': 'msDFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter': 'msDFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options': 'msDFSR-Options', + 'ms-DFSR-Options2': 'msDFSR-Options2', + 'ms-DFSR-Priority': 'msDFSR-Priority', + 'ms-DFSR-RdcEnabled': 'msDFSR-RdcEnabled', + 'ms-DFSR-RdcMinFileSizeInKb': 'msDFSR-RdcMinFileSizeInKb', + 'ms-DFSR-ReadOnly': 'msDFSR-ReadOnly', + 'ms-DFSR-ReplicationGroupGuid': 'msDFSR-ReplicationGroupGuid', + 'ms-DFSR-ReplicationGroupType': 'msDFSR-ReplicationGroupType', + 'ms-DFSR-RootFence': 'msDFSR-RootFence', + 'ms-DFSR-RootPath': 'msDFSR-RootPath', + 'ms-DFSR-RootSizeInMb': 'msDFSR-RootSizeInMb', + 'ms-DFSR-Schedule': 'msDFSR-Schedule', + 'ms-DFSR-StagingCleanupTriggerInPercent': 'msDFSR-StagingCleanupTriggerInPercent', + 'ms-DFSR-StagingPath': 'msDFSR-StagingPath', + 'ms-DFSR-StagingSizeInMb': 'msDFSR-StagingSizeInMb', + 'ms-DFSR-TombstoneExpiryInMin': 'msDFSR-TombstoneExpiryInMin', + 'ms-DFSR-Version': 'msDFSR-Version', + 'ms-DNS-DNSKEY-Record-Set-TTL': 'msDNS-DNSKEYRecordSetTTL', + 'ms-DNS-DNSKEY-Records': 'msDNS-DNSKEYRecords', + 'ms-DNS-DS-Record-Algorithms': 'msDNS-DSRecordAlgorithms', + 'ms-DNS-DS-Record-Set-TTL': 'msDNS-DSRecordSetTTL', + 'ms-DNS-Is-Signed': 'msDNS-IsSigned', + 'ms-DNS-Keymaster-Zones': 'msDNS-KeymasterZones', + 'ms-DNS-Maintain-Trust-Anchor': 'msDNS-MaintainTrustAnchor', + 'ms-DNS-NSEC3-Current-Salt': 'msDNS-NSEC3CurrentSalt', + 'ms-DNS-NSEC3-Hash-Algorithm': 'msDNS-NSEC3HashAlgorithm', + 'ms-DNS-NSEC3-Iterations': 'msDNS-NSEC3Iterations', + 'ms-DNS-NSEC3-OptOut': 'msDNS-NSEC3OptOut', + 'ms-DNS-NSEC3-Random-Salt-Length': 'msDNS-NSEC3RandomSaltLength', + 'ms-DNS-NSEC3-User-Salt': 'msDNS-NSEC3UserSalt', + 'ms-DNS-Parent-Has-Secure-Delegation': 'msDNS-ParentHasSecureDelegation', + 'ms-DNS-Propagation-Time': 'msDNS-PropagationTime', + 'ms-DNS-RFC5011-Key-Rollovers': 'msDNS-RFC5011KeyRollovers', + 'ms-DNS-Secure-Delegation-Polling-Period': 'msDNS-SecureDelegationPollingPeriod', + 'ms-DNS-Sign-With-NSEC3': 'msDNS-SignWithNSEC3', + 'ms-DNS-Signature-Inception-Offset': 'msDNS-SignatureInceptionOffset', + 'ms-DNS-Signing-Key-Descriptors': 'msDNS-SigningKeyDescriptors', + 'ms-DNS-Signing-Keys': 'msDNS-SigningKeys', + 'ms-DS-Additional-Dns-Host-Name': 'msDS-AdditionalDnsHostName', + 'ms-DS-Additional-Sam-Account-Name': 'msDS-AdditionalSamAccountName', + 'ms-DS-Allowed-DNS-Suffixes': 'msDS-AllowedDNSSuffixes', + 'ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity': 'msDS-AllowedToActOnBehalfOfOtherIdentity', + 'ms-DS-Allowed-To-Delegate-To': 'msDS-AllowedToDelegateTo', + 'ms-DS-Applies-To-Resource-Types': 'msDS-AppliesToResourceTypes', + 'ms-DS-Approx-Immed-Subordinates': 'msDS-Approx-Immed-Subordinates', + 'ms-DS-AuthenticatedAt-DC': 'msDS-AuthenticatedAtDC', + 'ms-DS-AuthenticatedTo-Accountlist': 'msDS-AuthenticatedToAccountlist', + 'ms-DS-Auxiliary-Classes': 'msDS-Auxiliary-Classes', + 'ms-DS-Az-Application-Data': 'msDS-AzApplicationData', + 'ms-DS-Az-Application-Name': 'msDS-AzApplicationName', + 'ms-DS-Az-Application-Version': 'msDS-AzApplicationVersion', + 'ms-DS-Az-Biz-Rule': 'msDS-AzBizRule', + 'ms-DS-Az-Biz-Rule-Language': 'msDS-AzBizRuleLanguage', + 'ms-DS-Az-Class-ID': 'msDS-AzClassId', + 'ms-DS-Az-Domain-Timeout': 'msDS-AzDomainTimeout', + 'ms-DS-Az-Generate-Audits': 'msDS-AzGenerateAudits', + 'ms-DS-Az-Generic-Data': 'msDS-AzGenericData', + 'ms-DS-Az-LDAP-Query': 'msDS-AzLDAPQuery', + 'ms-DS-Az-Last-Imported-Biz-Rule-Path': 'msDS-AzLastImportedBizRulePath', + 'ms-DS-Az-Major-Version': 'msDS-AzMajorVersion', + 'ms-DS-Az-Minor-Version': 'msDS-AzMinorVersion', + 'ms-DS-Az-Object-Guid': 'msDS-AzObjectGuid', + 'ms-DS-Az-Operation-ID': 'msDS-AzOperationID', + 'ms-DS-Az-Scope-Name': 'msDS-AzScopeName', + 'ms-DS-Az-Script-Engine-Cache-Max': 'msDS-AzScriptEngineCacheMax', + 'ms-DS-Az-Script-Timeout': 'msDS-AzScriptTimeout', + 'ms-DS-Az-Task-Is-Role-Definition': 'msDS-AzTaskIsRoleDefinition', + 'ms-DS-Behavior-Version': 'msDS-Behavior-Version', + 'ms-DS-BridgeHead-Servers-Used': 'msDS-BridgeHeadServersUsed', + 'ms-DS-Byte-Array': 'msDS-ByteArray', + 'ms-DS-Cached-Membership': 'msDS-Cached-Membership', + 'ms-DS-Cached-Membership-Time-Stamp': 'msDS-Cached-Membership-Time-Stamp', + 'ms-DS-Claim-Attribute-Source': 'msDS-ClaimAttributeSource', + 'ms-DS-Claim-Is-Single-Valued': 'msDS-ClaimIsSingleValued', + 'ms-DS-Claim-Is-Value-Space-Restricted': 'msDS-ClaimIsValueSpaceRestricted', + 'ms-DS-Claim-Possible-Values': 'msDS-ClaimPossibleValues', + 'ms-DS-Claim-Shares-Possible-Values-With': 'msDS-ClaimSharesPossibleValuesWith', + 'ms-DS-Claim-Shares-Possible-Values-With-BL': 'msDS-ClaimSharesPossibleValuesWithBL', + 'ms-DS-Claim-Source': 'msDS-ClaimSource', + 'ms-DS-Claim-Source-Type': 'msDS-ClaimSourceType', + 'ms-DS-Claim-Type-Applies-To-Class': 'msDS-ClaimTypeAppliesToClass', + 'ms-DS-Claim-Value-Type': 'msDS-ClaimValueType', + 'ms-DS-Date-Time': 'msDS-DateTime', + 'ms-DS-Default-Quota': 'msDS-DefaultQuota', + 'ms-DS-Deleted-Object-Lifetime': 'msDS-DeletedObjectLifetime', + 'ms-DS-Disable-For-Instances': 'msDS-DisableForInstances', + 'ms-DS-Disable-For-Instances-BL': 'msDS-DisableForInstancesBL', + 'ms-DS-DnsRootAlias': 'msDS-DnsRootAlias', + 'ms-DS-Egress-Claims-Transformation-Policy': 'msDS-EgressClaimsTransformationPolicy', + 'ms-DS-Enabled-Feature': 'msDS-EnabledFeature', + 'ms-DS-Enabled-Feature-BL': 'msDS-EnabledFeatureBL', + 'ms-DS-Entry-Time-To-Die': 'msDS-Entry-Time-To-Die', + 'ms-DS-ExecuteScriptPassword': 'msDS-ExecuteScriptPassword', + 'ms-DS-External-Key': 'msDS-ExternalKey', + 'ms-DS-External-Store': 'msDS-ExternalStore', + 'ms-DS-Failed-Interactive-Logon-Count': 'msDS-FailedInteractiveLogonCount', + 'ms-DS-Failed-Interactive-Logon-Count-At-Last-Successful-Logon': 'msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon', + 'ms-DS-Filter-Containers': 'msDS-FilterContainers', + 'ms-DS-Generation-Id': 'msDS-GenerationId', + 'ms-DS-GeoCoordinates-Altitude': 'msDS-GeoCoordinatesAltitude', + 'ms-DS-GeoCoordinates-Latitude': 'msDS-GeoCoordinatesLatitude', + 'ms-DS-GeoCoordinates-Longitude': 'msDS-GeoCoordinatesLongitude', + 'ms-DS-GroupMSAMembership': 'msDS-GroupMSAMembership', + 'ms-DS-HAB-Seniority-Index': 'msDS-HABSeniorityIndex', + 'ms-DS-Has-Domain-NCs': 'msDS-HasDomainNCs', + 'ms-DS-Has-Full-Replica-NCs': 'msDS-hasFullReplicaNCs', + 'ms-DS-Has-Instantiated-NCs': 'msDS-HasInstantiatedNCs', + 'ms-DS-Has-Master-NCs': 'msDS-hasMasterNCs', + 'ms-DS-Host-Service-Account': 'msDS-HostServiceAccount', + 'ms-DS-Host-Service-Account-BL': 'msDS-HostServiceAccountBL', + 'ms-DS-Ingress-Claims-Transformation-Policy': 'msDS-IngressClaimsTransformationPolicy', + 'ms-DS-IntId': 'msDS-IntId', + 'ms-DS-Integer': 'msDS-Integer', + 'ms-DS-Is-Domain-For': 'msDS-IsDomainFor', + 'ms-DS-Is-Full-Replica-For': 'msDS-IsFullReplicaFor', + 'ms-DS-Is-Partial-Replica-For': 'msDS-IsPartialReplicaFor', + 'ms-DS-Is-Possible-Values-Present': 'msDS-IsPossibleValuesPresent', + 'ms-DS-Is-Primary-Computer-For': 'msDS-IsPrimaryComputerFor', + 'ms-DS-Is-Used-As-Resource-Security-Attribute': 'msDS-IsUsedAsResourceSecurityAttribute', + 'ms-DS-Is-User-Cachable-At-Rodc': 'msDS-IsUserCachableAtRodc', + 'ms-DS-KeyVersionNumber': 'msDS-KeyVersionNumber', + 'ms-DS-KrbTgt-Link': 'msDS-KrbTgtLink', + 'ms-DS-KrbTgt-Link-BL': 'msDS-KrbTgtLinkBl', + 'ms-DS-Last-Failed-Interactive-Logon-Time': 'msDS-LastFailedInteractiveLogonTime', + 'ms-DS-Last-Known-RDN': 'msDS-LastKnownRDN', + 'ms-DS-Last-Successful-Interactive-Logon-Time': 'msDS-LastSuccessfulInteractiveLogonTime', + 'ms-DS-Lockout-Duration': 'msDS-LockoutDuration', + 'ms-DS-Lockout-Observation-Window': 'msDS-LockoutObservationWindow', + 'ms-DS-Lockout-Threshold': 'msDS-LockoutThreshold', + 'ms-DS-Logon-Time-Sync-Interval': 'msDS-LogonTimeSyncInterval', + 'ms-DS-ManagedPassword': 'msDS-ManagedPassword', + 'ms-DS-ManagedPasswordId': 'msDS-ManagedPasswordId', + 'ms-DS-ManagedPasswordInterval': 'msDS-ManagedPasswordInterval', + 'ms-DS-ManagedPasswordPreviousId': 'msDS-ManagedPasswordPreviousId', + 'ms-DS-Mastered-By': 'msDs-masteredBy', + 'ms-DS-Max-Values': 'msDs-MaxValues', + 'ms-DS-Maximum-Password-Age': 'msDS-MaximumPasswordAge', + 'ms-DS-Members-For-Az-Role': 'msDS-MembersForAzRole', + 'ms-DS-Members-For-Az-Role-BL': 'msDS-MembersForAzRoleBL', + 'ms-DS-Members-Of-Resource-Property-List': 'msDS-MembersOfResourcePropertyList', + 'ms-DS-Members-Of-Resource-Property-List-BL': 'msDS-MembersOfResourcePropertyListBL', + 'ms-DS-Minimum-Password-Age': 'msDS-MinimumPasswordAge', + 'ms-DS-Minimum-Password-Length': 'msDS-MinimumPasswordLength', + 'ms-DS-NC-RO-Replica-Locations': 'msDS-NC-RO-Replica-Locations', + 'ms-DS-NC-RO-Replica-Locations-BL': 'msDS-NC-RO-Replica-Locations-BL', + 'ms-DS-NC-Repl-Cursors': 'msDS-NCReplCursors', + 'ms-DS-NC-Repl-Inbound-Neighbors': 'msDS-NCReplInboundNeighbors', + 'ms-DS-NC-Repl-Outbound-Neighbors': 'msDS-NCReplOutboundNeighbors', + 'ms-DS-NC-Replica-Locations': 'msDS-NC-Replica-Locations', + 'ms-DS-NC-Type': 'msDS-NcType', + 'ms-DS-Never-Reveal-Group': 'msDS-NeverRevealGroup', + 'ms-DS-Non-Members': 'msDS-NonMembers', + 'ms-DS-Non-Members-BL': 'msDS-NonMembersBL', + 'ms-DS-Non-Security-Group-Extra-Classes': 'msDS-Non-Security-Group-Extra-Classes', + 'ms-DS-OIDToGroup-Link': 'msDS-OIDToGroupLink', + 'ms-DS-OIDToGroup-Link-BL': 'msDS-OIDToGroupLinkBl', + 'ms-DS-Object-Reference': 'msDS-ObjectReference', + 'ms-DS-Object-Reference-BL': 'msDS-ObjectReferenceBL', + 'ms-DS-Operations-For-Az-Role': 'msDS-OperationsForAzRole', + 'ms-DS-Operations-For-Az-Role-BL': 'msDS-OperationsForAzRoleBL', + 'ms-DS-Operations-For-Az-Task': 'msDS-OperationsForAzTask', + 'ms-DS-Operations-For-Az-Task-BL': 'msDS-OperationsForAzTaskBL', + 'ms-DS-Optional-Feature-Flags': 'msDS-OptionalFeatureFlags', + 'ms-DS-Optional-Feature-GUID': 'msDS-OptionalFeatureGUID', + 'ms-DS-Other-Settings': 'msDS-Other-Settings', + 'ms-DS-PSO-Applied': 'msDS-PSOApplied', + 'ms-DS-PSO-Applies-To': 'msDS-PSOAppliesTo', + 'ms-DS-Password-Complexity-Enabled': 'msDS-PasswordComplexityEnabled', + 'ms-DS-Password-History-Length': 'msDS-PasswordHistoryLength', + 'ms-DS-Password-Reversible-Encryption-Enabled': 'msDS-PasswordReversibleEncryptionEnabled', + 'ms-DS-Password-Settings-Precedence': 'msDS-PasswordSettingsPrecedence', + 'ms-DS-Phonetic-Company-Name': 'msDS-PhoneticCompanyName', + 'ms-DS-Phonetic-Department': 'msDS-PhoneticDepartment', + 'ms-DS-Phonetic-Display-Name': 'msDS-PhoneticDisplayName', + 'ms-DS-Phonetic-First-Name': 'msDS-PhoneticFirstName', + 'ms-DS-Phonetic-Last-Name': 'msDS-PhoneticLastName', + 'ms-DS-Port-LDAP': 'msDS-PortLDAP', + 'ms-DS-Port-SSL': 'msDS-PortSSL', + 'ms-DS-Preferred-GC-Site': 'msDS-Preferred-GC-Site', + 'ms-DS-Primary-Computer': 'msDS-PrimaryComputer', + 'ms-DS-Principal-Name': 'msDS-PrincipalName', + 'ms-DS-Promotion-Settings': 'msDS-PromotionSettings', + 'ms-DS-Quota-Amount': 'msDS-QuotaAmount', + 'ms-DS-Quota-Effective': 'msDS-QuotaEffective', + 'ms-DS-Quota-Trustee': 'msDS-QuotaTrustee', + 'ms-DS-Quota-Used': 'msDS-QuotaUsed', + 'ms-DS-Repl-Attribute-Meta-Data': 'msDS-ReplAttributeMetaData', + 'ms-DS-Repl-Authentication-Mode': 'msDS-ReplAuthenticationMode', + 'ms-DS-Repl-Value-Meta-Data': 'msDS-ReplValueMetaData', + 'ms-DS-Replication-Notify-First-DSA-Delay': 'msDS-Replication-Notify-First-DSA-Delay', + 'ms-DS-Replication-Notify-Subsequent-DSA-Delay': 'msDS-Replication-Notify-Subsequent-DSA-Delay', + 'ms-DS-ReplicationEpoch': 'msDS-ReplicationEpoch', + 'ms-DS-Required-Domain-Behavior-Version': 'msDS-RequiredDomainBehaviorVersion', + 'ms-DS-Required-Forest-Behavior-Version': 'msDS-RequiredForestBehaviorVersion', + 'ms-DS-Resultant-PSO': 'msDS-ResultantPSO', + 'ms-DS-Retired-Repl-NC-Signatures': 'msDS-RetiredReplNCSignatures', + 'ms-DS-Reveal-OnDemand-Group': 'msDS-RevealOnDemandGroup', + 'ms-DS-Revealed-DSAs': 'msDS-RevealedDSAs', + 'ms-DS-Revealed-List': 'msDS-RevealedList', + 'ms-DS-Revealed-List-BL': 'msDS-RevealedListBL', + 'ms-DS-Revealed-Users': 'msDS-RevealedUsers', + 'ms-DS-SCP-Container': 'msDS-SCPContainer', + 'ms-DS-SD-Reference-Domain': 'msDS-SDReferenceDomain', + 'ms-DS-SPN-Suffixes': 'msDS-SPNSuffixes', + 'ms-DS-Secondary-KrbTgt-Number': 'msDS-SecondaryKrbTgtNumber', + 'ms-DS-Security-Group-Extra-Classes': 'msDS-Security-Group-Extra-Classes', + 'ms-DS-Seniority-Index': 'msDS-SeniorityIndex', + 'ms-DS-Service-Account': 'msDS-ServiceAccount', + 'ms-DS-Service-Account-BL': 'msDS-ServiceAccountBL', + 'ms-DS-Service-Account-DNS-Domain': 'msDS-ServiceAccountDNSDomain', + 'ms-DS-Settings': 'msDS-Settings', + 'ms-DS-Site-Affinity': 'msDS-Site-Affinity', + 'ms-DS-SiteName': 'msDS-SiteName', + 'ms-DS-Source-Object-DN': 'msDS-SourceObjectDN', + 'ms-DS-Supported-Encryption-Types': 'msDS-SupportedEncryptionTypes', + 'ms-DS-TDO-Egress-BL': 'msDS-TDOEgressBL', + 'ms-DS-TDO-Ingress-BL': 'msDS-TDOIngressBL', + 'ms-DS-Tasks-For-Az-Role': 'msDS-TasksForAzRole', + 'ms-DS-Tasks-For-Az-Role-BL': 'msDS-TasksForAzRoleBL', + 'ms-DS-Tasks-For-Az-Task': 'msDS-TasksForAzTask', + 'ms-DS-Tasks-For-Az-Task-BL': 'msDS-TasksForAzTaskBL', + 'ms-DS-Tombstone-Quota-Factor': 'msDS-TombstoneQuotaFactor', + 'ms-DS-Top-Quota-Usage': 'msDS-TopQuotaUsage', + 'ms-DS-Transformation-Rules': 'msDS-TransformationRules', + 'ms-DS-Transformation-Rules-Compiled': 'msDS-TransformationRulesCompiled', + 'ms-DS-Trust-Forest-Trust-Info': 'msDS-TrustForestTrustInfo', + 'ms-DS-USN-Last-Sync-Success': 'msDS-USNLastSyncSuccess', + 'ms-DS-UpdateScript': 'msDS-UpdateScript', + 'ms-DS-User-Account-Auto-Locked': 'ms-DS-UserAccountAutoLocked', + 'ms-DS-User-Account-Control-Computed': 'msDS-User-Account-Control-Computed', + 'ms-DS-User-Account-Disabled': 'msDS-UserAccountDisabled', + 'ms-DS-User-Dont-Expire-Password': 'msDS-UserDontExpirePassword', + 'ms-DS-User-Encrypted-Text-Password-Allowed': 'ms-DS-UserEncryptedTextPasswordAllowed', + 'ms-DS-User-Password-Expired': 'msDS-UserPasswordExpired', + 'ms-DS-User-Password-Expiry-Time-Computed': 'msDS-UserPasswordExpiryTimeComputed', + 'ms-DS-User-Password-Not-Required': 'ms-DS-UserPasswordNotRequired', + 'ms-DS-Value-Type-Reference': 'msDS-ValueTypeReference', + 'ms-DS-Value-Type-Reference-BL': 'msDS-ValueTypeReferenceBL', + 'ms-DS-isGC': 'msDS-isGC', + 'ms-DS-isRODC': 'msDS-isRODC', + 'ms-DS-local-Effective-Deletion-Time': 'msDS-LocalEffectiveDeletionTime', + 'ms-DS-local-Effective-Recycle-Time': 'msDS-LocalEffectiveRecycleTime', + 'ms-Exch-Assistant-Name': 'msExchAssistantName', + 'ms-Exch-House-Identifier': 'msExchHouseIdentifier', + 'ms-Exch-LabeledURI': 'msExchLabeledURI', + 'ms-Exch-Owner-BL': 'ownerBL', + 'ms-FRS-Hub-Member': 'msFRS-Hub-Member', + 'ms-FRS-Topology-Pref': 'msFRS-Topology-Pref', + 'ms-FVE-KeyPackage': 'msFVE-KeyPackage', + 'ms-FVE-RecoveryGuid': 'msFVE-RecoveryGuid', + 'ms-FVE-RecoveryPassword': 'msFVE-RecoveryPassword', + 'ms-FVE-VolumeGuid': 'msFVE-VolumeGuid', + 'ms-IIS-FTP-Dir': 'msIIS-FTPDir', + 'ms-IIS-FTP-Root': 'msIIS-FTPRoot', + 'ms-Imaging-Hash-Algorithm': 'msImaging-HashAlgorithm', + 'ms-Imaging-PSP-Identifier': 'msImaging-PSPIdentifier', + 'ms-Imaging-PSP-String': 'msImaging-PSPString', + 'ms-Imaging-Thumbprint-Hash': 'msImaging-ThumbprintHash', + 'ms-Kds-CreateTime': 'msKds-CreateTime', + 'ms-Kds-DomainID': 'msKds-DomainID', + 'ms-Kds-KDF-AlgorithmID': 'msKds-KDFAlgorithmID', + 'ms-Kds-KDF-Param': 'msKds-KDFParam', + 'ms-Kds-PrivateKey-Length': 'msKds-PrivateKeyLength', + 'ms-Kds-PublicKey-Length': 'msKds-PublicKeyLength', + 'ms-Kds-RootKeyData': 'msKds-RootKeyData', + 'ms-Kds-SecretAgreement-AlgorithmID': 'msKds-SecretAgreementAlgorithmID', + 'ms-Kds-SecretAgreement-Param': 'msKds-SecretAgreementParam', + 'ms-Kds-UseStartTime': 'msKds-UseStartTime', + 'ms-Kds-Version': 'msKds-Version', + 'ms-PKI-AccountCredentials': 'msPKIAccountCredentials', + 'ms-PKI-Cert-Template-OID': 'msPKI-Cert-Template-OID', + 'ms-PKI-Certificate-Application-Policy': 'msPKI-Certificate-Application-Policy', + 'ms-PKI-Certificate-Name-Flag': 'msPKI-Certificate-Name-Flag', + 'ms-PKI-Certificate-Policy': 'msPKI-Certificate-Policy', + 'ms-PKI-Credential-Roaming-Tokens': 'msPKI-CredentialRoamingTokens', + 'ms-PKI-DPAPIMasterKeys': 'msPKIDPAPIMasterKeys', + 'ms-PKI-Enrollment-Flag': 'msPKI-Enrollment-Flag', + 'ms-PKI-Enrollment-Servers': 'msPKI-Enrollment-Servers', + 'ms-PKI-Minimal-Key-Size': 'msPKI-Minimal-Key-Size', + 'ms-PKI-OID-Attribute': 'msPKI-OID-Attribute', + 'ms-PKI-OID-CPS': 'msPKI-OID-CPS', + 'ms-PKI-OID-LocalizedName': 'msPKI-OIDLocalizedName', + 'ms-PKI-OID-User-Notice': 'msPKI-OID-User-Notice', + 'ms-PKI-Private-Key-Flag': 'msPKI-Private-Key-Flag', + 'ms-PKI-RA-Application-Policies': 'msPKI-RA-Application-Policies', + 'ms-PKI-RA-Policies': 'msPKI-RA-Policies', + 'ms-PKI-RA-Signature': 'msPKI-RA-Signature', + 'ms-PKI-RoamingTimeStamp': 'msPKIRoamingTimeStamp', + 'ms-PKI-Site-Name': 'msPKI-Site-Name', + 'ms-PKI-Supersede-Templates': 'msPKI-Supersede-Templates', + 'ms-PKI-Template-Minor-Revision': 'msPKI-Template-Minor-Revision', + 'ms-PKI-Template-Schema-Version': 'msPKI-Template-Schema-Version', + 'ms-RADIUS-FramedInterfaceId': 'msRADIUS-FramedInterfaceId', + 'ms-RADIUS-FramedIpv6Prefix': 'msRADIUS-FramedIpv6Prefix', + 'ms-RADIUS-FramedIpv6Route': 'msRADIUS-FramedIpv6Route', + 'ms-RADIUS-SavedFramedInterfaceId': 'msRADIUS-SavedFramedInterfaceId', + 'ms-RADIUS-SavedFramedIpv6Prefix': 'msRADIUS-SavedFramedIpv6Prefix', + 'ms-RADIUS-SavedFramedIpv6Route': 'msRADIUS-SavedFramedIpv6Route', + 'ms-RRAS-Attribute': 'msRRASAttribute', + 'ms-RRAS-Vendor-Attribute-Entry': 'msRRASVendorAttributeEntry', + 'ms-SPP-CSVLK-Partial-Product-Key': 'msSPP-CSVLKPartialProductKey', + 'ms-SPP-CSVLK-Pid': 'msSPP-CSVLKPid', + 'ms-SPP-CSVLK-Sku-Id': 'msSPP-CSVLKSkuId', + 'ms-SPP-Config-License': 'msSPP-ConfigLicense', + 'ms-SPP-Confirmation-Id': 'msSPP-ConfirmationId', + 'ms-SPP-Installation-Id': 'msSPP-InstallationId', + 'ms-SPP-Issuance-License': 'msSPP-IssuanceLicense', + 'ms-SPP-KMS-Ids': 'msSPP-KMSIds', + 'ms-SPP-Online-License': 'msSPP-OnlineLicense', + 'ms-SPP-Phone-License': 'msSPP-PhoneLicense', + 'ms-TAPI-Conference-Blob': 'msTAPI-ConferenceBlob', + 'ms-TAPI-Ip-Address': 'msTAPI-IpAddress', + 'ms-TAPI-Protocol-Id': 'msTAPI-ProtocolId', + 'ms-TAPI-Unique-Identifier': 'msTAPI-uid', + 'ms-TPM-Owner-Information-Temp': 'msTPM-OwnerInformationTemp', + 'ms-TPM-OwnerInformation': 'msTPM-OwnerInformation', + 'ms-TPM-Srk-Pub-Thumbprint': 'msTPM-SrkPubThumbprint', + 'ms-TPM-Tpm-Information-For-Computer': 'msTPM-TpmInformationForComputer', + 'ms-TPM-Tpm-Information-For-Computer-BL': 'msTPM-TpmInformationForComputerBL', + 'ms-TS-Allow-Logon': 'msTSAllowLogon', + 'ms-TS-Broken-Connection-Action': 'msTSBrokenConnectionAction', + 'ms-TS-Connect-Client-Drives': 'msTSConnectClientDrives', + 'ms-TS-Connect-Printer-Drives': 'msTSConnectPrinterDrives', + 'ms-TS-Default-To-Main-Printer': 'msTSDefaultToMainPrinter', + 'ms-TS-Endpoint-Data': 'msTSEndpointData', + 'ms-TS-Endpoint-Plugin': 'msTSEndpointPlugin', + 'ms-TS-Endpoint-Type': 'msTSEndpointType', + 'ms-TS-Home-Directory': 'msTSHomeDirectory', + 'ms-TS-Home-Drive': 'msTSHomeDrive', + 'ms-TS-Initial-Program': 'msTSInitialProgram', + 'ms-TS-Max-Connection-Time': 'msTSMaxConnectionTime', + 'ms-TS-Max-Disconnection-Time': 'msTSMaxDisconnectionTime', + 'ms-TS-Max-Idle-Time': 'msTSMaxIdleTime', + 'ms-TS-Primary-Desktop': 'msTSPrimaryDesktop', + 'ms-TS-Primary-Desktop-BL': 'msTSPrimaryDesktopBL', + 'ms-TS-Profile-Path': 'msTSProfilePath', + 'ms-TS-Reconnection-Action': 'msTSReconnectionAction', + 'ms-TS-Remote-Control': 'msTSRemoteControl', + 'ms-TS-Secondary-Desktop-BL': 'msTSSecondaryDesktopBL', + 'ms-TS-Secondary-Desktops': 'msTSSecondaryDesktops', + 'ms-TS-Work-Directory': 'msTSWorkDirectory', + 'ms-WMI-Author': 'msWMI-Author', + 'ms-WMI-ChangeDate': 'msWMI-ChangeDate', + 'ms-WMI-Class': 'msWMI-Class', + 'ms-WMI-ClassDefinition': 'msWMI-ClassDefinition', + 'ms-WMI-CreationDate': 'msWMI-CreationDate', + 'ms-WMI-Genus': 'msWMI-Genus', + 'ms-WMI-ID': 'msWMI-ID', + 'ms-WMI-Mof': 'msWMI-Mof', + 'ms-WMI-Name': 'msWMI-Name', + 'ms-WMI-NormalizedClass': 'msWMI-NormalizedClass', + 'ms-WMI-Parm1': 'msWMI-Parm1', + 'ms-WMI-Parm2': 'msWMI-Parm2', + 'ms-WMI-Parm3': 'msWMI-Parm3', + 'ms-WMI-Parm4': 'msWMI-Parm4', + 'ms-WMI-PropertyName': 'msWMI-PropertyName', + 'ms-WMI-Query': 'msWMI-Query', + 'ms-WMI-QueryLanguage': 'msWMI-QueryLanguage', + 'ms-WMI-ScopeGuid': 'msWMI-ScopeGuid', + 'ms-WMI-SourceOrganization': 'msWMI-SourceOrganization', + 'ms-WMI-TargetClass': 'msWMI-TargetClass', + 'ms-WMI-TargetNameSpace': 'msWMI-TargetNameSpace', + 'ms-WMI-TargetObject': 'msWMI-TargetObject', + 'ms-WMI-TargetPath': 'msWMI-TargetPath', + 'ms-WMI-TargetType': 'msWMI-TargetType', + 'ms-WMI-int8Default': 'msWMI-Int8Default', + 'ms-WMI-int8Max': 'msWMI-Int8Max', + 'ms-WMI-int8Min': 'msWMI-Int8Min', + 'ms-WMI-int8ValidValues': 'msWMI-Int8ValidValues', + 'ms-WMI-intDefault': 'msWMI-IntDefault', + 'ms-WMI-intFlags1': 'msWMI-intFlags1', + 'ms-WMI-intFlags2': 'msWMI-intFlags2', + 'ms-WMI-intFlags3': 'msWMI-intFlags3', + 'ms-WMI-intFlags4': 'msWMI-intFlags4', + 'ms-WMI-intMax': 'msWMI-IntMax', + 'ms-WMI-intMin': 'msWMI-IntMin', + 'ms-WMI-intValidValues': 'msWMI-IntValidValues', + 'ms-WMI-stringDefault': 'msWMI-StringDefault', + 'ms-WMI-stringValidValues': 'msWMI-StringValidValues', + 'ms-ds-Schema-Extensions': 'msDs-Schema-Extensions', + 'ms-ieee-80211-Data': 'msieee80211-Data', + 'ms-ieee-80211-Data-Type': 'msieee80211-DataType', + 'ms-ieee-80211-ID': 'msieee80211-ID', + 'ms-net-ieee-80211-GP-PolicyData': 'ms-net-ieee-80211-GP-PolicyData', + 'ms-net-ieee-80211-GP-PolicyGUID': 'ms-net-ieee-80211-GP-PolicyGUID', + 'ms-net-ieee-80211-GP-PolicyReserved': 'ms-net-ieee-80211-GP-PolicyReserved', + 'ms-net-ieee-8023-GP-PolicyData': 'ms-net-ieee-8023-GP-PolicyData', + 'ms-net-ieee-8023-GP-PolicyGUID': 'ms-net-ieee-8023-GP-PolicyGUID', + 'ms-net-ieee-8023-GP-PolicyReserved': 'ms-net-ieee-8023-GP-PolicyReserved', + 'msNPAllowDialin': 'msNPAllowDialin', + 'msNPCalledStationID': 'msNPCalledStationID', + 'msNPCallingStationID': 'msNPCallingStationID', + 'msNPSavedCallingStationID': 'msNPSavedCallingStationID', + 'msRADIUSCallbackNumber': 'msRADIUSCallbackNumber', + 'msRADIUSFramedIPAddress': 'msRADIUSFramedIPAddress', + 'msRADIUSFramedRoute': 'msRADIUSFramedRoute', + 'msRADIUSServiceType': 'msRADIUSServiceType', + 'msRASSavedCallbackNumber': 'msRASSavedCallbackNumber', + 'msRASSavedFramedIPAddress': 'msRASSavedFramedIPAddress', + 'msRASSavedFramedRoute': 'msRASSavedFramedRoute', + 'msSFU-30-Aliases': 'msSFU30Aliases', + 'msSFU-30-Crypt-Method': 'msSFU30CryptMethod', + 'msSFU-30-Domains': 'msSFU30Domains', + 'msSFU-30-Field-Separator': 'msSFU30FieldSeparator', + 'msSFU-30-Intra-Field-Separator': 'msSFU30IntraFieldSeparator', + 'msSFU-30-Is-Valid-Container': 'msSFU30IsValidContainer', + 'msSFU-30-Key-Attributes': 'msSFU30KeyAttributes', + 'msSFU-30-Key-Values': 'msSFU30KeyValues', + 'msSFU-30-Map-Filter': 'msSFU30MapFilter', + 'msSFU-30-Master-Server-Name': 'msSFU30MasterServerName', + 'msSFU-30-Max-Gid-Number': 'msSFU30MaxGidNumber', + 'msSFU-30-Max-Uid-Number': 'msSFU30MaxUidNumber', + 'msSFU-30-NSMAP-Field-Position': 'msSFU30NSMAPFieldPosition', + 'msSFU-30-Name': 'msSFU30Name', + 'msSFU-30-Netgroup-Host-At-Domain': 'msSFU30NetgroupHostAtDomain', + 'msSFU-30-Netgroup-User-At-Domain': 'msSFU30NetgroupUserAtDomain', + 'msSFU-30-Nis-Domain': 'msSFU30NisDomain', + 'msSFU-30-Order-Number': 'msSFU30OrderNumber', + 'msSFU-30-Posix-Member': 'msSFU30PosixMember', + 'msSFU-30-Posix-Member-Of': 'msSFU30PosixMemberOf', + 'msSFU-30-Result-Attributes': 'msSFU30ResultAttributes', + 'msSFU-30-Search-Attributes': 'msSFU30SearchAttributes', + 'msSFU-30-Search-Container': 'msSFU30SearchContainer', + 'msSFU-30-Yp-Servers': 'msSFU30YpServers', + 'netboot-Allow-New-Clients': 'netbootAllowNewClients', + 'netboot-Answer-Only-Valid-Clients': 'netbootAnswerOnlyValidClients', + 'netboot-Answer-Requests': 'netbootAnswerRequests', + 'netboot-Current-Client-Count': 'netbootCurrentClientCount', + 'netboot-IntelliMirror-OSes': 'netbootIntelliMirrorOSes', + 'netboot-Limit-Clients': 'netbootLimitClients', + 'netboot-Locally-Installed-OSes': 'netbootLocallyInstalledOSes', + 'netboot-Max-Clients': 'netbootMaxClients', + 'netboot-New-Machine-Naming-Policy': 'netbootNewMachineNamingPolicy', + 'netboot-New-Machine-OU': 'netbootNewMachineOU', + 'netboot-SCP-BL': 'netbootSCPBL', + 'netboot-Server': 'netbootServer', + 'netboot-Tools': 'netbootTools', + 'nisMapEntry': 'nisMapEntry', + 'nisMapName': 'nisMapName', + 'nisNetgroupTriple': 'nisNetgroupTriple', + 'oncRpcNumber': 'oncRpcNumber', + 'organizationalStatus': 'organizationalStatus', + 'photo': 'photo', + 'preferredLanguage': 'preferredLanguage', + 'roomNumber': 'roomNumber', + 'rpc-Ns-Annotation': 'rpcNsAnnotation', + 'rpc-Ns-Bindings': 'rpcNsBindings', + 'rpc-Ns-Codeset': 'rpcNsCodeset', + 'rpc-Ns-Entry-Flags': 'rpcNsEntryFlags', + 'rpc-Ns-Group': 'rpcNsGroup', + 'rpc-Ns-Interface-ID': 'rpcNsInterfaceID', + 'rpc-Ns-Object-ID': 'rpcNsObjectID', + 'rpc-Ns-Priority': 'rpcNsPriority', + 'rpc-Ns-Profile-Entry': 'rpcNsProfileEntry', + 'rpc-Ns-Transfer-Syntax': 'rpcNsTransferSyntax', + 'secretary': 'secretary', + 'shadowExpire': 'shadowExpire', + 'shadowFlag': 'shadowFlag', + 'shadowInactive': 'shadowInactive', + 'shadowLastChange': 'shadowLastChange', + 'shadowMax': 'shadowMax', + 'shadowMin': 'shadowMin', + 'shadowWarning': 'shadowWarning', + 'uid': 'uid', + 'uidNumber': 'uidNumber', + 'uniqueIdentifier': 'uniqueIdentifier', + 'uniqueMember': 'uniqueMember', + 'unixHomeDirectory': 'unixHomeDirectory', + 'unixUserPassword': 'unixUserPassword', + 'unstructuredAddress': 'unstructuredAddress', + 'unstructuredName': 'unstructuredName', + 'userClass': 'userClass', + 'userPKCS12': 'userPKCS12', + 'x500uniqueIdentifier': 'x500uniqueIdentifier' + }, + + /** + * Knowledge for the Active Directory Schema - Classes + * + * See http://msdn.microsoft.com/en-us/library/windows/desktop/ms680938%28v=vs.85%29.aspx + * + * Each class has a set of direct attributes and a set of auxiliary classes. Thus the + * class will look like this: + * + * 'User': { + * 'ldapname': 'user', + * 'attributes': [ 'Common-Name', 'Given-Name', 'Surname' ], + * 'classes' [ 'Security-Principal', 'Mail-Recipient' ] + * }, + * + * We will add auxiliary classes to the list of object classes to display, then display the + * attributes (which are in CN form, not LDAP form). + * + * The content is generated by get-ad-classes.pl from the MSDN website + */ + adSchemaClasses: { + 'ms-DS-Claim-Type-Property-Base': { + 'classes': [], + 'ldapname': 'msDS-ClaimTypePropertyBase', + 'attributes': [ + 'Enabled', + 'ms-DS-Claim-Possible-Values', + 'ms-DS-Claim-Shares-Possible-Values-With' + ] + }, + 'ms-DS-Claims-Transformation-Policies': { + 'classes': [], + 'ldapname': 'msDS-ClaimsTransformationPolicies', + 'attributes': [] + }, + 'MSMQ-Configuration': { + 'classes': [], + 'ldapname': 'mSMQConfiguration', + 'attributes': [ + 'MSMQ-Computer-Type', + 'MSMQ-Computer-Type-Ex', + 'MSMQ-Dependent-Client-Services', + 'MSMQ-Ds-Services', + 'MSMQ-Encrypt-Key', + 'MSMQ-Foreign', + 'MSMQ-In-Routing-Servers', + 'MSMQ-Journal-Quota', + 'MSMQ-OS-Type', + 'MSMQ-Out-Routing-Servers', + 'MSMQ-Owner-ID', + 'MSMQ-Quota', + 'MSMQ-Routing-Services', + 'MSMQ-Service-Type', + 'MSMQ-Sign-Key', + 'MSMQ-Sites' + ] + }, + 'Com-Connection-Point': { + 'classes': [], + 'ldapname': 'comConnectionPoint', + 'attributes': [ + 'Common-Name', + 'Marshalled-Interface', + 'Moniker', + 'Moniker-Display-Name' + ] + }, + 'ms-DFSR-Content': { + 'classes': [], + 'ldapname': 'msDFSR-Content', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'rpc-Server': { + 'classes': [], + 'ldapname': 'rpcServer', + 'attributes': [ + 'rpc-Ns-Codeset', + 'rpc-Ns-Entry-Flags', + 'rpc-Ns-Object-ID' + ] + }, + 'ms-TPM-Information-Object': { + 'classes': [], + 'ldapname': 'msTPM-InformationObject', + 'attributes': [ + 'ms-TPM-Owner-Information-Temp', + 'ms-TPM-OwnerInformation', + 'ms-TPM-Srk-Pub-Thumbprint' + ] + }, + 'MS-SQL-SQLRepository': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLRepository', + 'attributes': [ + 'MS-SQL-Build', + 'MS-SQL-Contact', + 'MS-SQL-Description', + 'MS-SQL-InformationDirectory', + 'MS-SQL-Name', + 'MS-SQL-Status', + 'MS-SQL-Version' + ] + }, + 'ms-DNS-Server-Settings': { + 'classes': [], + 'ldapname': 'msDNS-ServerSettings', + 'attributes': [ + 'ms-DNS-Keymaster-Zones' + ] + }, + 'MSMQ-Site-Link': { + 'classes': [], + 'ldapname': 'mSMQSiteLink', + 'attributes': [ + 'MSMQ-Cost', + 'MSMQ-Site-1', + 'MSMQ-Site-2', + 'MSMQ-Site-Gates', + 'MSMQ-Site-Gates-Mig' + ] + }, + 'Locality': { + 'classes': [], + 'ldapname': 'locality', + 'attributes': [ + 'Locality-Name', + 'Organization', + 'Search-Guide', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address' + ] + }, + 'NTFRS-Replica-Set': { + 'classes': [], + 'ldapname': 'nTFRSReplicaSet', + 'attributes': [ + 'FRS-DS-Poll', + 'FRS-Directory-Filter', + 'FRS-Extensions', + 'FRS-File-Filter', + 'FRS-Flags', + 'FRS-Level-Limit', + 'FRS-Partner-Auth-Level', + 'FRS-Primary-Member', + 'FRS-Replica-Set-GUID', + 'FRS-Replica-Set-Type', + 'FRS-Root-Security', + 'FRS-Service-Command', + 'FRS-Version-GUID', + 'Managed-By', + 'Schedule', + 'ms-FRS-Hub-Member', + 'ms-FRS-Topology-Pref' + ] + }, + 'ms-WMI-UnknownRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-UnknownRangeParam', + 'attributes': [ + 'ms-WMI-NormalizedClass', + 'ms-WMI-TargetObject' + ] + }, + 'PKI-Enrollment-Service': { + 'classes': [], + 'ldapname': 'pKIEnrollmentService', + 'attributes': [ + 'CA-Certificate', + 'CA-Certificate-DN', + 'Certificate-Templates', + 'DNS-Host-Name', + 'Enrollment-Providers', + 'Signature-Algorithms', + 'ms-PKI-Enrollment-Servers', + 'ms-PKI-Site-Name' + ] + }, + 'rpc-Entry': { + 'classes': [], + 'ldapname': 'rpcEntry', + 'attributes': [] + }, + 'Top': { + 'classes': [], + 'ldapname': 'top', + 'attributes': [ + '', + 'Admin-Description', + 'Admin-Display-Name', + 'Allowed-Attributes', + 'Allowed-Attributes-Effective', + 'Allowed-Child-Classes', + 'Allowed-Child-Classes-Effective', + 'Bridgehead-Server-List-BL', + 'Canonical-Name', + 'Common-Name', + 'Create-Time-Stamp', + 'DS-Core-Propagation-Data', + 'DSA-Signature', + 'Description', + 'Display-Name', + 'Display-Name-Printable', + 'Extension-Name', + 'FRS-Member-Reference-BL', + 'FSMO-Role-Owner', + 'Flags', + 'From-Entry', + 'Frs-Computer-Reference-BL', + 'Instance-Type', + 'Is-Critical-System-Object', + 'Is-Deleted', + 'Is-Member-Of-DL', + 'Is-Privilege-Holder', + 'Is-Recycled', + 'Last-Known-Parent', + 'MS-DS-Consistency-Child-Count', + 'MS-DS-Consistency-Guid', + 'Managed-Objects', + 'Mastered-By', + 'Modify-Time-Stamp', + 'NT-Security-Descriptor', + 'Non-Security-Member-BL', + 'Obj-Dist-Name', + 'Object-Category', + 'Object-Class', + 'Object-Guid', + 'Object-Version', + 'Other-Well-Known-Objects', + 'Partial-Attribute-Deletion-List', + 'Partial-Attribute-Set', + 'Possible-Inferiors', + 'Proxied-Object-Name', + 'Proxy-Addresses', + 'Query-Policy-BL', + 'RDN', + 'Repl-Property-Meta-Data', + 'Repl-UpToDate-Vector', + 'Reports', + 'Reps-From', + 'Reps-To', + 'Revision', + 'SD-Rights-Effective', + 'Server-Reference-BL', + 'Show-In-Advanced-View-Only', + 'Site-Object-BL', + 'Structural-Object-Class', + 'Sub-Refs', + 'SubSchemaSubEntry', + 'System-Flags', + 'USN-Changed', + 'USN-Created', + 'USN-DSA-Last-Obj-Removed', + 'USN-Intersite', + 'USN-Last-Obj-Rem', + 'USN-Source', + 'WWW-Home-Page', + 'WWW-Page-Other', + 'Wbem-Path', + 'Well-Known-Objects', + 'When-Changed', + 'When-Created', + 'ms-COM-PartitionSetLink', + 'ms-COM-UserLink', + 'ms-DFSR-ComputerReferenceBL', + 'ms-DFSR-MemberReferenceBL', + 'ms-DS-Approx-Immed-Subordinates', + 'ms-DS-AuthenticatedTo-Accountlist', + 'ms-DS-Claim-Shares-Possible-Values-With-BL', + 'ms-DS-Disable-For-Instances-BL', + 'ms-DS-Enabled-Feature-BL', + 'ms-DS-Host-Service-Account-BL', + 'ms-DS-Is-Domain-For', + 'ms-DS-Is-Full-Replica-For', + 'ms-DS-Is-Partial-Replica-For', + 'ms-DS-Is-Primary-Computer-For', + 'ms-DS-KrbTgt-Link-BL', + 'ms-DS-Last-Known-RDN', + 'ms-DS-Mastered-By', + 'ms-DS-Members-For-Az-Role-BL', + 'ms-DS-Members-Of-Resource-Property-List-BL', + 'ms-DS-NC-RO-Replica-Locations-BL', + 'ms-DS-NC-Repl-Cursors', + 'ms-DS-NC-Repl-Inbound-Neighbors', + 'ms-DS-NC-Repl-Outbound-Neighbors', + 'ms-DS-NC-Type', + 'ms-DS-Non-Members-BL', + 'ms-DS-OIDToGroup-Link-BL', + 'ms-DS-Object-Reference-BL', + 'ms-DS-Operations-For-Az-Role-BL', + 'ms-DS-Operations-For-Az-Task-BL', + 'ms-DS-PSO-Applied', + 'ms-DS-Principal-Name', + 'ms-DS-Repl-Attribute-Meta-Data', + 'ms-DS-Repl-Value-Meta-Data', + 'ms-DS-Revealed-DSAs', + 'ms-DS-Revealed-List-BL', + 'ms-DS-Service-Account-BL', + 'ms-DS-TDO-Egress-BL', + 'ms-DS-TDO-Ingress-BL', + 'ms-DS-Tasks-For-Az-Role-BL', + 'ms-DS-Tasks-For-Az-Task-BL', + 'ms-DS-Value-Type-Reference-BL', + 'ms-DS-local-Effective-Deletion-Time', + 'ms-DS-local-Effective-Recycle-Time', + 'ms-Exch-Owner-BL', + 'msSFU-30-Posix-Member-Of', + 'netboot-SCP-BL' + ] + }, + 'ms-DS-Resource-Property': { + 'classes': [], + 'ldapname': 'msDS-ResourceProperty', + 'attributes': [ + 'ms-DS-Applies-To-Resource-Types', + 'ms-DS-Is-Used-As-Resource-Security-Attribute', + 'ms-DS-Value-Type-Reference' + ] + }, + 'ms-DFSR-Subscription': { + 'classes': [], + 'ldapname': 'msDFSR-Subscription', + 'attributes': [ + 'ms-DFSR-CachePolicy', + 'ms-DFSR-ConflictPath', + 'ms-DFSR-ConflictSizeInMb', + 'ms-DFSR-ContentSetGuid', + 'ms-DFSR-DeletedPath', + 'ms-DFSR-DeletedSizeInMb', + 'ms-DFSR-DfsLinkTarget', + 'ms-DFSR-Enabled', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-MaxAgeInCacheInMin', + 'ms-DFSR-MinDurationCacheInMin', + 'ms-DFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-ReadOnly', + 'ms-DFSR-ReplicationGroupGuid', + 'ms-DFSR-RootFence', + 'ms-DFSR-RootPath', + 'ms-DFSR-RootSizeInMb', + 'ms-DFSR-StagingCleanupTriggerInPercent', + 'ms-DFSR-StagingPath', + 'ms-DFSR-StagingSizeInMb' + ] + }, + 'ieee802Device': { + 'classes': [], + 'ldapname': 'ieee802Device', + 'attributes': [ + 'Common-Name', + 'macAddress' + ] + }, + 'ms-DFS-Namespace-v2': { + 'classes': [], + 'ldapname': 'msDFS-Namespacev2', + 'attributes': [ + 'ms-DFS-Comment-v2', + 'ms-DFS-Generation-GUID-v2', + 'ms-DFS-Last-Modified-v2', + 'ms-DFS-Namespace-Identity-GUID-v2', + 'ms-DFS-Properties-v2', + 'ms-DFS-Schema-Major-Version', + 'ms-DFS-Schema-Minor-Version', + 'ms-DFS-Target-List-v2', + 'ms-DFS-Ttl-v2' + ] + }, + 'MS-SQL-SQLServer': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLServer', + 'attributes': [ + 'MS-SQL-AppleTalk', + 'MS-SQL-Build', + 'MS-SQL-CharacterSet', + 'MS-SQL-Clustered', + 'MS-SQL-Contact', + 'MS-SQL-GPSHeight', + 'MS-SQL-GPSLatitude', + 'MS-SQL-GPSLongitude', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastUpdatedDate', + 'MS-SQL-Location', + 'MS-SQL-Memory', + 'MS-SQL-MultiProtocol', + 'MS-SQL-Name', + 'MS-SQL-NamedPipe', + 'MS-SQL-RegisteredOwner', + 'MS-SQL-SPX', + 'MS-SQL-ServiceAccount', + 'MS-SQL-SortOrder', + 'MS-SQL-Status', + 'MS-SQL-TCPIP', + 'MS-SQL-UnicodeSortOrder', + 'MS-SQL-Vines' + ] + }, + 'rpc-Group': { + 'classes': [], + 'ldapname': 'rpcGroup', + 'attributes': [ + 'rpc-Ns-Group', + 'rpc-Ns-Object-ID' + ] + }, + 'ms-TAPI-Rt-Conference': { + 'classes': [], + 'ldapname': 'msTAPI-RtConference', + 'attributes': [ + 'ms-TAPI-Conference-Blob', + 'ms-TAPI-Protocol-Id', + 'ms-TAPI-Unique-Identifier' + ] + }, + 'Intellimirror-Group': { + 'classes': [], + 'ldapname': 'intellimirrorGroup', + 'attributes': [] + }, + 'Link-Track-Object-Move-Table': { + 'classes': [], + 'ldapname': 'linkTrackObjectMoveTable', + 'attributes': [] + }, + 'ms-DS-Quota-Container': { + 'classes': [], + 'ldapname': 'msDS-QuotaContainer', + 'attributes': [ + 'Common-Name', + 'ms-DS-Default-Quota', + 'ms-DS-Quota-Effective', + 'ms-DS-Quota-Used', + 'ms-DS-Tombstone-Quota-Factor', + 'ms-DS-Top-Quota-Usage' + ] + }, + 'Print-Queue': { + 'classes': [], + 'ldapname': 'printQueue', + 'attributes': [ + 'Asset-Number', + 'Bytes-Per-Minute', + 'Default-Priority', + 'Driver-Name', + 'Driver-Version', + 'Location', + 'Operating-System', + 'Operating-System-Hotfix', + 'Operating-System-Service-Pack', + 'Operating-System-Version', + 'Physical-Location-Object', + 'Port-Name', + 'Print-Attributes', + 'Print-Bin-Names', + 'Print-Collate', + 'Print-Color', + 'Print-Duplex-Supported', + 'Print-End-Time', + 'Print-Form-Name', + 'Print-Keep-Printed-Jobs', + 'Print-Language', + 'Print-MAC-Address', + 'Print-Max-Copies', + 'Print-Max-Resolution-Supported', + 'Print-Max-X-Extent', + 'Print-Max-Y-Extent', + 'Print-Media-Ready', + 'Print-Media-Supported', + 'Print-Memory', + 'Print-Min-X-Extent', + 'Print-Min-Y-Extent', + 'Print-Network-Address', + 'Print-Notify', + 'Print-Number-Up', + 'Print-Orientations-Supported', + 'Print-Owner', + 'Print-Pages-Per-Minute', + 'Print-Rate', + 'Print-Rate-Unit', + 'Print-Separator-File', + 'Print-Share-Name', + 'Print-Spooling', + 'Print-Stapling-Supported', + 'Print-Start-Time', + 'Print-Status', + 'Printer-Name', + 'Priority', + 'Server-Name', + 'Short-Server-Name', + 'UNC-Name', + 'Version-Number' + ] + }, + 'ms-COM-Partition': { + 'classes': [], + 'ldapname': 'msCOM-Partition', + 'attributes': [ + 'ms-COM-ObjectId' + ] + }, + 'Mail-Recipient': { + 'classes': [], + 'ldapname': 'mailRecipient', + 'attributes': [ + 'Comment', + 'Common-Name', + 'Garbage-Coll-Period', + 'Legacy-Exchange-DN', + 'Show-In-Address-Book', + 'Telephone-Number', + 'Text-Encoded-OR-Address', + 'User-Cert', + 'User-SMIME-Certificate', + 'X509-Cert', + 'labeledURI', + 'ms-DS-GeoCoordinates-Altitude', + 'ms-DS-GeoCoordinates-Latitude', + 'ms-DS-GeoCoordinates-Longitude', + 'ms-DS-Phonetic-Display-Name', + 'ms-Exch-Assistant-Name', + 'ms-Exch-LabeledURI', + 'secretary' + ] + }, + 'Organizational-Role': { + 'classes': [], + 'ldapname': 'organizationalRole', + 'attributes': [ + 'Common-Name', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Locality-Name', + 'Organizational-Unit-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'Role-Occupant', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'X121-Address' + ] + }, + 'ms-DFSR-ContentSet': { + 'classes': [], + 'ldapname': 'msDFSR-ContentSet', + 'attributes': [ + 'Description', + 'ms-DFSR-ConflictSizeInMb', + 'ms-DFSR-DefaultCompressionExclusionFilter', + 'ms-DFSR-DeletedSizeInMb', + 'ms-DFSR-DfsPath', + 'ms-DFSR-DirectoryFilter', + 'ms-DFSR-Extension', + 'ms-DFSR-FileFilter', + 'ms-DFSR-Flags', + 'ms-DFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-Priority', + 'ms-DFSR-RootSizeInMb', + 'ms-DFSR-StagingSizeInMb' + ] + }, + 'ms-FVE-RecoveryInformation': { + 'classes': [], + 'ldapname': 'msFVE-RecoveryInformation', + 'attributes': [ + 'ms-FVE-KeyPackage', + 'ms-FVE-RecoveryGuid', + 'ms-FVE-RecoveryPassword', + 'ms-FVE-VolumeGuid' + ] + }, + 'Dynamic-Object': { + 'classes': [], + 'ldapname': 'dynamicObject', + 'attributes': [ + 'Entry-TTL', + 'ms-DS-Entry-Time-To-Die' + ] + }, + 'Sam-Server': { + 'classes': [], + 'ldapname': 'samServer', + 'attributes': [ + 'SAM-Domain-Updates' + ] + }, + 'ms-net-ieee-80211-GroupPolicy': { + 'classes': [], + 'ldapname': 'ms-net-ieee-80211-GroupPolicy', + 'attributes': [ + 'ms-net-ieee-80211-GP-PolicyData', + 'ms-net-ieee-80211-GP-PolicyGUID', + 'ms-net-ieee-80211-GP-PolicyReserved' + ] + }, + 'NTFRS-Settings': { + 'classes': [], + 'ldapname': 'nTFRSSettings', + 'attributes': [ + 'FRS-Extensions', + 'Managed-By', + 'Organization' + ] + }, + 'FT-Dfs': { + 'classes': [], + 'ldapname': 'fTDfs', + 'attributes': [ + 'Keywords', + 'Managed-By', + 'PKT', + 'PKT-Guid', + 'Remote-Server-Name', + 'UNC-Name' + ] + }, + 'Type-Library': { + 'classes': [], + 'ldapname': 'typeLibrary', + 'attributes': [ + 'COM-ClassID', + 'COM-InterfaceID', + 'COM-Unique-LIBID' + ] + }, + 'CRL-Distribution-Point': { + 'classes': [], + 'ldapname': 'cRLDistributionPoint', + 'attributes': [ + 'Authority-Revocation-List', + 'CRL-Partitioned-Revocation-List', + 'Certificate-Authority-Object', + 'Certificate-Revocation-List', + 'Common-Name', + 'Delta-Revocation-List' + ] + }, + 'Inter-Site-Transport': { + 'classes': [], + 'ldapname': 'interSiteTransport', + 'attributes': [ + 'Options', + 'Repl-Interval', + 'Transport-Address-Attribute', + 'Transport-DLL-Name' + ] + }, + 'Storage': { + 'classes': [], + 'ldapname': 'storage', + 'attributes': [ + 'Icon-Path', + 'Moniker', + 'Moniker-Display-Name' + ] + }, + 'NTDS-Connection': { + 'classes': [], + 'ldapname': 'nTDSConnection', + 'attributes': [ + 'Enabled-Connection', + 'From-Server', + 'Generated-Connection', + 'MS-DS-Replicates-NC-Reason', + 'Options', + 'Schedule', + 'Transport-Type' + ] + }, + 'Cross-Ref-Container': { + 'classes': [], + 'ldapname': 'crossRefContainer', + 'attributes': [ + 'UPN-Suffixes', + 'ms-DS-Behavior-Version', + 'ms-DS-Enabled-Feature', + 'ms-DS-ExecuteScriptPassword', + 'ms-DS-SPN-Suffixes', + 'ms-DS-UpdateScript' + ] + }, + 'ms-Authz-Central-Access-Policies': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessPolicies', + 'attributes': [] + }, + 'Security-Principal': { + 'classes': [], + 'ldapname': 'securityPrincipal', + 'attributes': [ + 'Account-Name-History', + 'Alt-Security-Identities', + 'NT-Security-Descriptor', + 'Object-Sid', + 'Rid', + 'SAM-Account-Name', + 'SAM-Account-Type', + 'SID-History', + 'Security-Identifier', + 'Supplemental-Credentials', + 'Token-Groups', + 'Token-Groups-Global-And-Universal', + 'Token-Groups-No-GC-Acceptable', + 'ms-DS-KeyVersionNumber' + ] + }, + 'ms-DFSR-Topology': { + 'classes': [], + 'ldapname': 'msDFSR-Topology', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'NTDS-Site-Settings': { + 'classes': [], + 'ldapname': 'nTDSSiteSettings', + 'attributes': [ + 'Inter-Site-Topology-Failover', + 'Inter-Site-Topology-Generator', + 'Inter-Site-Topology-Renew', + 'Managed-By', + 'Options', + 'Query-Policy-Object', + 'Schedule', + 'ms-DS-Preferred-GC-Site' + ] + }, + 'Residential-Person': { + 'classes': [], + 'ldapname': 'residentialPerson', + 'attributes': [ + 'Business-Category', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Locality-Name', + 'Organizational-Unit-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'State-Or-Province-Name', + 'Street-Address', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'Title', + 'X121-Address' + ] + }, + 'Attribute-Schema': { + 'classes': [], + 'ldapname': 'attributeSchema', + 'attributes': [ + 'Attribute-ID', + 'Attribute-Security-GUID', + 'Attribute-Syntax', + 'Class-Display-Name', + 'Common-Name', + 'Extended-Chars-Allowed', + 'Is-Defunct', + 'Is-Ephemeral', + 'Is-Member-Of-Partial-Attribute-Set', + 'Is-Single-Valued', + 'LDAP-Display-Name', + 'Link-ID', + 'MAPI-ID', + 'OM-Object-Class', + 'OM-Syntax', + 'Range-Lower', + 'Range-Upper', + 'Schema-Flags-Ex', + 'Schema-ID-GUID', + 'Search-Flags', + 'System-Only', + 'ms-DS-IntId', + 'ms-ds-Schema-Extensions' + ] + }, + 'Ipsec-Filter': { + 'classes': [], + 'ldapname': 'ipsecFilter', + 'attributes': [] + }, + 'Control-Access-Right': { + 'classes': [], + 'ldapname': 'controlAccessRight', + 'attributes': [ + 'Applies-To', + 'Localization-Display-Id', + 'Rights-Guid', + 'Valid-Accesses' + ] + }, + 'Organizational-Unit': { + 'classes': [], + 'ldapname': 'organizationalUnit', + 'attributes': [ + 'Business-Category', + 'Country-Code', + 'Country-Name', + 'Default-Group', + 'Desktop-Profile', + 'Destination-Indicator', + 'Domain-DNS', + 'Facsimile-Telephone-Number', + 'GP-Link', + 'GP-Options', + 'International-ISDN-Number', + 'Locality-Name', + 'Logo', + 'Managed-By', + 'Organizational-Unit-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'Search-Guide', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'Text-Country', + 'UPN-Suffixes', + 'User-Password', + 'X121-Address', + 'ms-COM-UserPartitionSetLink' + ] + }, + 'msSFU-30-Domain-Info': { + 'classes': [], + 'ldapname': 'msSFU30DomainInfo', + 'attributes': [ + 'msSFU-30-Crypt-Method', + 'msSFU-30-Domains', + 'msSFU-30-Is-Valid-Container', + 'msSFU-30-Master-Server-Name', + 'msSFU-30-Max-Gid-Number', + 'msSFU-30-Max-Uid-Number', + 'msSFU-30-Order-Number', + 'msSFU-30-Search-Container', + 'msSFU-30-Yp-Servers' + ] + }, + 'ACS-Resource-Limits': { + 'classes': [], + 'ldapname': 'aCSResourceLimits', + 'attributes': [ + 'ACS-Allocable-RSVP-Bandwidth', + 'ACS-Max-Peak-Bandwidth', + 'ACS-Max-Peak-Bandwidth-Per-Flow', + 'ACS-Max-Token-Rate-Per-Flow', + 'ACS-Service-Type' + ] + }, + 'Group': { + 'classes': [ + 'Security-Principal', + 'Mail-Recipient' + ], + 'ldapname': 'group', + 'attributes': [ + 'Admin-Count', + 'Control-Access-Rights', + 'Desktop-Profile', + 'E-mail-Addresses', + 'Group-Attributes', + 'Group-Membership-SAM', + 'Group-Type', + 'Managed-By', + 'Member', + 'NT-Group-Members', + 'Non-Security-Member', + 'Operator-Count', + 'Primary-Group-Token', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Biz-Rule', + 'ms-DS-Az-Biz-Rule-Language', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-LDAP-Query', + 'ms-DS-Az-Last-Imported-Biz-Rule-Path', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Non-Members', + 'ms-DS-Primary-Computer', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'msSFU-30-Posix-Member' + ] + }, + 'Contact': { + 'classes': [ + 'Mail-Recipient' + ], + 'ldapname': 'contact', + 'attributes': [ + 'Additional-Information', + 'Common-Name', + 'ms-DS-Source-Object-DN' + ] + }, + 'ms-DS-Service-Connection-Point-Publication-Service': { + 'classes': [], + 'ldapname': 'msDS-ServiceConnectionPointPublicationService', + 'attributes': [ + 'Enabled', + 'Keywords', + 'ms-DS-Disable-For-Instances', + 'ms-DS-SCP-Container' + ] + }, + 'Device': { + 'classes': [], + 'ldapname': 'device', + 'attributes': [ + 'Common-Name', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Owner', + 'See-Also', + 'Serial-Number', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Computer': { + 'classes': [], + 'ldapname': 'computer', + 'attributes': [ + 'Catalogs', + 'Common-Name', + 'DNS-Host-Name', + 'Default-Local-Policy-Object', + 'Local-Policy-Flags', + 'Location', + 'MS-TS-Property01', + 'MS-TS-Property02', + 'Machine-Role', + 'Managed-By', + 'Netboot-GUID', + 'Netboot-Initialization', + 'Netboot-Machine-File-Path', + 'Netboot-Mirror-Data-File', + 'Netboot-SIF-File', + 'Network-Address', + 'Operating-System', + 'Operating-System-Hotfix', + 'Operating-System-Service-Pack', + 'Operating-System-Version', + 'Physical-Location-Object', + 'Policy-Replication-Flags', + 'RID-Set-References', + 'Site-GUID', + 'Volume-Count', + 'ms-DS-Additional-Dns-Host-Name', + 'ms-DS-Additional-Sam-Account-Name', + 'ms-DS-AuthenticatedAt-DC', + 'ms-DS-ExecuteScriptPassword', + 'ms-DS-Generation-Id', + 'ms-DS-Host-Service-Account', + 'ms-DS-Is-User-Cachable-At-Rodc', + 'ms-DS-KrbTgt-Link', + 'ms-DS-Never-Reveal-Group', + 'ms-DS-Promotion-Settings', + 'ms-DS-Reveal-OnDemand-Group', + 'ms-DS-Revealed-List', + 'ms-DS-Revealed-Users', + 'ms-DS-SiteName', + 'ms-DS-isGC', + 'ms-DS-isRODC', + 'ms-Imaging-Hash-Algorithm', + 'ms-Imaging-Thumbprint-Hash', + 'ms-TPM-OwnerInformation', + 'ms-TPM-Tpm-Information-For-Computer', + 'ms-TS-Endpoint-Data', + 'ms-TS-Endpoint-Plugin', + 'ms-TS-Endpoint-Type', + 'ms-TS-Primary-Desktop-BL', + 'ms-TS-Secondary-Desktop-BL', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Display-Specifier': { + 'classes': [], + 'ldapname': 'displaySpecifier', + 'attributes': [ + 'Admin-Context-Menu', + 'Admin-Multiselect-Property-Pages', + 'Admin-Property-Pages', + 'Attribute-Display-Names', + 'Class-Display-Name', + 'Context-Menu', + 'Create-Dialog', + 'Create-Wizard-Ext', + 'Creation-Wizard', + 'Extra-Columns', + 'Icon-Path', + 'Query-Filter', + 'Scope-Flags', + 'Shell-Context-Menu', + 'Shell-Property-Pages', + 'Treat-As-Leaf' + ] + }, + 'DS-UI-Settings': { + 'classes': [], + 'ldapname': 'dSUISettings', + 'attributes': [ + 'DS-UI-Admin-Maximum', + 'DS-UI-Admin-Notification', + 'DS-UI-Shell-Maximum', + 'ms-DS-Filter-Containers', + 'ms-DS-Non-Security-Group-Extra-Classes', + 'ms-DS-Security-Group-Extra-Classes' + ] + }, + 'ms-DS-Resource-Properties': { + 'classes': [], + 'ldapname': 'msDS-ResourceProperties', + 'attributes': [] + }, + 'ms-DFSR-Subscriber': { + 'classes': [], + 'ldapname': 'msDFSR-Subscriber', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-MemberReference', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-ReplicationGroupGuid' + ] + }, + 'Server': { + 'classes': [], + 'ldapname': 'server', + 'attributes': [ + 'Bridgehead-Transport-List', + 'DNS-Host-Name', + 'Managed-By', + 'NETBIOS-Name', + 'SMTP-Mail-Address', + 'Serial-Number', + 'Server-Reference', + 'ms-DS-Is-User-Cachable-At-Rodc', + 'ms-DS-SiteName', + 'ms-DS-isGC', + 'ms-DS-isRODC' + ] + }, + 'Index-Server-Catalog': { + 'classes': [], + 'ldapname': 'indexServerCatalog', + 'attributes': [ + 'Creator', + 'Friendly-Names', + 'IndexedScopes', + 'QueryPoint', + 'UNC-Name' + ] + }, + 'Security-Object': { + 'classes': [], + 'ldapname': 'securityObject', + 'attributes': [ + 'Common-Name' + ] + }, + 'Secret': { + 'classes': [], + 'ldapname': 'secret', + 'attributes': [ + 'Current-Value', + 'Last-Set-Time', + 'Prior-Set-Time', + 'Prior-Value' + ] + }, + 'ms-WMI-ShadowObject': { + 'classes': [], + 'ldapname': 'msWMI-ShadowObject', + 'attributes': [ + 'ms-WMI-TargetObject' + ] + }, + 'ms-Imaging-PSPs': { + 'classes': [], + 'ldapname': 'msImaging-PSPs', + 'attributes': [] + }, + 'ms-WMI-PolicyType': { + 'classes': [], + 'ldapname': 'msWMI-PolicyType', + 'attributes': [ + 'ms-WMI-Author', + 'ms-WMI-ChangeDate', + 'ms-WMI-CreationDate', + 'ms-WMI-ID', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-SourceOrganization', + 'ms-WMI-TargetObject', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'documentSeries': { + 'classes': [], + 'ldapname': 'documentSeries', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'See-Also', + 'Telephone-Number' + ] + }, + 'Display-Template': { + 'classes': [], + 'ldapname': 'displayTemplate', + 'attributes': [ + 'Address-Entry-Display-Table', + 'Address-Entry-Display-Table-MSDOS', + 'Common-Name', + 'Help-Data16', + 'Help-Data32', + 'Help-File-Name', + 'Original-Display-Table', + 'Original-Display-Table-MSDOS' + ] + }, + 'ms-WMI-WMIGPO': { + 'classes': [], + 'ldapname': 'msWMI-WMIGPO', + 'attributes': [ + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-TargetClass', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'ms-WMI-RangeParam': { + 'classes': [], + 'ldapname': 'msWMI-RangeParam', + 'attributes': [ + 'ms-WMI-PropertyName', + 'ms-WMI-TargetClass', + 'ms-WMI-TargetType' + ] + }, + 'MS-SQL-OLAPServer': { + 'classes': [], + 'ldapname': 'mS-SQL-OLAPServer', + 'attributes': [ + 'MS-SQL-Build', + 'MS-SQL-Contact', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-Language', + 'MS-SQL-Name', + 'MS-SQL-PublicationURL', + 'MS-SQL-RegisteredOwner', + 'MS-SQL-ServiceAccount', + 'MS-SQL-Status', + 'MS-SQL-Version' + ] + }, + 'MSMQ-Settings': { + 'classes': [], + 'ldapname': 'mSMQSettings', + 'attributes': [ + 'MSMQ-Dependent-Client-Service', + 'MSMQ-Ds-Service', + 'MSMQ-Migrated', + 'MSMQ-Nt4-Flags', + 'MSMQ-Owner-ID', + 'MSMQ-QM-ID', + 'MSMQ-Routing-Service', + 'MSMQ-Services', + 'MSMQ-Site-Name', + 'MSMQ-Site-Name-Ex' + ] + }, + 'RRAS-Administration-Connection-Point': { + 'classes': [], + 'ldapname': 'rRASAdministrationConnectionPoint', + 'attributes': [ + 'ms-RRAS-Attribute' + ] + }, + 'rpc-Server-Element': { + 'classes': [], + 'ldapname': 'rpcServerElement', + 'attributes': [ + 'rpc-Ns-Bindings', + 'rpc-Ns-Interface-ID', + 'rpc-Ns-Transfer-Syntax' + ] + }, + 'ms-Print-ConnectionPolicy': { + 'classes': [], + 'ldapname': 'msPrint-ConnectionPolicy', + 'attributes': [ + 'Common-Name', + 'Print-Attributes', + 'Printer-Name', + 'Server-Name', + 'UNC-Name' + ] + }, + 'NTFRS-Subscriber': { + 'classes': [], + 'ldapname': 'nTFRSSubscriber', + 'attributes': [ + 'FRS-Extensions', + 'FRS-Fault-Condition', + 'FRS-Flags', + 'FRS-Member-Reference', + 'FRS-Root-Path', + 'FRS-Service-Command', + 'FRS-Service-Command-Status', + 'FRS-Staging-Path', + 'FRS-Time-Last-Command', + 'FRS-Time-Last-Config-Change', + 'FRS-Update-Timeout', + 'Schedule' + ] + }, + 'nisObject': { + 'classes': [], + 'ldapname': 'nisObject', + 'attributes': [ + 'Common-Name', + 'Description', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapEntry', + 'nisMapName' + ] + }, + 'ms-DS-Az-Role': { + 'classes': [], + 'ldapname': 'msDS-AzRole', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Members-For-Az-Role', + 'ms-DS-Operations-For-Az-Role', + 'ms-DS-Tasks-For-Az-Role' + ] + }, + 'ms-DFSR-ReplicationGroup': { + 'classes': [], + 'ldapname': 'msDFSR-ReplicationGroup', + 'attributes': [ + 'Description', + 'ms-DFSR-ConflictSizeInMb', + 'ms-DFSR-DefaultCompressionExclusionFilter', + 'ms-DFSR-DeletedSizeInMb', + 'ms-DFSR-DirectoryFilter', + 'ms-DFSR-Extension', + 'ms-DFSR-FileFilter', + 'ms-DFSR-Flags', + 'ms-DFSR-OnDemandExclusionDirectoryFilter', + 'ms-DFSR-OnDemandExclusionFileFilter', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-ReplicationGroupType', + 'ms-DFSR-RootSizeInMb', + 'ms-DFSR-Schedule', + 'ms-DFSR-StagingSizeInMb', + 'ms-DFSR-TombstoneExpiryInMin', + 'ms-DFSR-Version' + ] + }, + 'ms-COM-PartitionSet': { + 'classes': [], + 'ldapname': 'msCOM-PartitionSet', + 'attributes': [ + 'ms-COM-DefaultPartitionLink', + 'ms-COM-ObjectId', + 'ms-COM-PartitionLink' + ] + }, + 'ms-DS-Az-Scope': { + 'classes': [], + 'ldapname': 'msDS-AzScope', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Scope-Name' + ] + }, + 'bootableDevice': { + 'classes': [], + 'ldapname': 'bootableDevice', + 'attributes': [ + 'Common-Name', + 'bootFile', + 'bootParameter' + ] + }, + 'posixGroup': { + 'classes': [], + 'ldapname': 'posixGroup', + 'attributes': [ + 'Common-Name', + 'Description', + 'User-Password', + 'gidNumber', + 'memberUid', + 'unixUserPassword' + ] + }, + 'MS-SQL-OLAPCube': { + 'classes': [], + 'ldapname': 'mS-SQL-OLAPCube', + 'attributes': [ + 'MS-SQL-Contact', + 'MS-SQL-Description', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastUpdatedDate', + 'MS-SQL-Name', + 'MS-SQL-PublicationURL', + 'MS-SQL-Size', + 'MS-SQL-Status' + ] + }, + 'friendlyCountry': { + 'classes': [], + 'ldapname': 'friendlyCountry', + 'attributes': [ + 'Text-Country' + ] + }, + 'rpc-Profile-Element': { + 'classes': [], + 'ldapname': 'rpcProfileElement', + 'attributes': [ + 'rpc-Ns-Annotation', + 'rpc-Ns-Interface-ID', + 'rpc-Ns-Priority', + 'rpc-Ns-Profile-Entry' + ] + }, + 'ms-DS-Group-Managed-Service-Account': { + 'classes': [], + 'ldapname': 'msDS-GroupManagedServiceAccount', + 'attributes': [ + 'ms-DS-GroupMSAMembership', + 'ms-DS-ManagedPassword', + 'ms-DS-ManagedPasswordId', + 'ms-DS-ManagedPasswordInterval', + 'ms-DS-ManagedPasswordPreviousId' + ] + }, + 'DSA': { + 'classes': [], + 'ldapname': 'dSA', + 'attributes': [ + 'Knowledge-Information' + ] + }, + 'Subnet-Container': { + 'classes': [], + 'ldapname': 'subnetContainer', + 'attributes': [] + }, + 'ms-DS-Managed-Service-Account': { + 'classes': [], + 'ldapname': 'msDS-ManagedServiceAccount', + 'attributes': [] + }, + 'ms-DFSR-Connection': { + 'classes': [], + 'ldapname': 'msDFSR-Connection', + 'attributes': [ + 'From-Server', + 'ms-DFSR-DisablePacketPrivacy', + 'ms-DFSR-Enabled', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Keywords', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-Priority', + 'ms-DFSR-RdcEnabled', + 'ms-DFSR-RdcMinFileSizeInKb', + 'ms-DFSR-Schedule' + ] + }, + 'ms-DS-Bind-Proxy': { + 'classes': [], + 'ldapname': 'msDS-BindProxy', + 'attributes': [ + 'Object-Sid', + 'ms-DS-Principal-Name' + ] + }, + 'MSMQ-Migrated-User': { + 'classes': [], + 'ldapname': 'mSMQMigratedUser', + 'attributes': [ + 'MSMQ-Digests', + 'MSMQ-Digests-Mig', + 'MSMQ-Sign-Certificates', + 'MSMQ-Sign-Certificates-Mig', + 'MSMQ-User-Sid', + 'Object-Sid' + ] + }, + 'ms-DFS-Deleted-Link-v2': { + 'classes': [], + 'ldapname': 'msDFS-DeletedLinkv2', + 'attributes': [ + 'ms-DFS-Comment-v2', + 'ms-DFS-Last-Modified-v2', + 'ms-DFS-Link-Identity-GUID-v2', + 'ms-DFS-Link-Path-v2', + 'ms-DFS-Namespace-Identity-GUID-v2', + 'ms-DFS-Short-Name-Link-Path-v2' + ] + }, + 'ms-WMI-UintRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-UintRangeParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intMax', + 'ms-WMI-intMin' + ] + }, + 'ms-WMI-IntRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-IntRangeParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intMax', + 'ms-WMI-intMin' + ] + }, + 'inetOrgPerson': { + 'classes': [], + 'ldapname': 'inetOrgPerson', + 'attributes': [ + 'Address-Home', + 'Business-Category', + 'Display-Name', + 'E-mail-Addresses', + 'Employee-Number', + 'Employee-Type', + 'Given-Name', + 'Initials', + 'Manager', + 'Organization-Name', + 'Phone-Home-Primary', + 'Phone-Mobile-Primary', + 'Phone-Pager-Primary', + 'User-SMIME-Certificate', + 'X509-Cert', + 'audio', + 'carLicense', + 'departmentNumber', + 'jpegPhoto', + 'labeledURI', + 'photo', + 'preferredLanguage', + 'roomNumber', + 'secretary', + 'uid', + 'userPKCS12', + 'x500uniqueIdentifier' + ] + }, + 'Physical-Location': { + 'classes': [], + 'ldapname': 'physicalLocation', + 'attributes': [ + 'Configuration', + 'Managed-By' + ] + }, + 'simpleSecurityObject': { + 'classes': [], + 'ldapname': 'simpleSecurityObject', + 'attributes': [ + 'User-Password' + ] + }, + 'RID-Set': { + 'classes': [], + 'ldapname': 'rIDSet', + 'attributes': [ + 'RID-Allocation-Pool', + 'RID-Next-RID', + 'RID-Previous-Allocation-Pool', + 'RID-Used-Pool' + ] + }, + 'Person': { + 'classes': [], + 'ldapname': 'person', + 'attributes': [ + 'Common-Name', + 'See-Also', + 'Serial-Number', + 'Surname', + 'Telephone-Number', + 'User-Password', + 'attributeCertificateAttribute' + ] + }, + 'Application-Version': { + 'classes': [], + 'ldapname': 'applicationVersion', + 'attributes': [ + 'App-Schema-Version', + 'Keywords', + 'Managed-By', + 'Owner', + 'Vendor', + 'Version-Number', + 'Version-Number-Hi', + 'Version-Number-Lo' + ] + }, + 'Foreign-Security-Principal': { + 'classes': [], + 'ldapname': 'foreignSecurityPrincipal', + 'attributes': [ + 'Foreign-Identifier', + 'Object-Sid' + ] + }, + 'ms-WMI-IntSetParam': { + 'classes': [], + 'ldapname': 'msWMI-IntSetParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intValidValues' + ] + }, + 'Connection-Point': { + 'classes': [], + 'ldapname': 'connectionPoint', + 'attributes': [ + 'Common-Name', + 'Keywords', + 'Managed-By', + 'ms-DS-Settings' + ] + }, + 'ms-WMI-Som': { + 'classes': [], + 'ldapname': 'msWMI-Som', + 'attributes': [ + 'ms-WMI-Author', + 'ms-WMI-ChangeDate', + 'ms-WMI-CreationDate', + 'ms-WMI-ID', + 'ms-WMI-Name', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-SourceOrganization', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'ms-WMI-PolicyTemplate': { + 'classes': [], + 'ldapname': 'msWMI-PolicyTemplate', + 'attributes': [ + 'ms-WMI-Author', + 'ms-WMI-ChangeDate', + 'ms-WMI-CreationDate', + 'ms-WMI-ID', + 'ms-WMI-Name', + 'ms-WMI-NormalizedClass', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-SourceOrganization', + 'ms-WMI-TargetClass', + 'ms-WMI-TargetNameSpace', + 'ms-WMI-TargetPath', + 'ms-WMI-TargetType', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'Service-Administration-Point': { + 'classes': [], + 'ldapname': 'serviceAdministrationPoint', + 'attributes': [] + }, + 'Volume': { + 'classes': [], + 'ldapname': 'volume', + 'attributes': [ + 'Content-Indexing-Allowed', + 'Last-Content-Indexed', + 'UNC-Name' + ] + }, + 'document': { + 'classes': [], + 'ldapname': 'document', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'See-Also', + 'documentAuthor', + 'documentIdentifier', + 'documentLocation', + 'documentPublisher', + 'documentTitle', + 'documentVersion' + ] + }, + 'Application-Site-Settings': { + 'classes': [], + 'ldapname': 'applicationSiteSettings', + 'attributes': [ + 'Application-Name', + 'Notification-List' + ] + }, + 'Application-Settings': { + 'classes': [], + 'ldapname': 'applicationSettings', + 'attributes': [ + 'Application-Name', + 'Notification-List', + 'ms-DS-Settings' + ] + }, + 'Servers-Container': { + 'classes': [], + 'ldapname': 'serversContainer', + 'attributes': [] + }, + 'Domain': { + 'classes': [], + 'ldapname': 'domain', + 'attributes': [ + 'Domain-Component', + 'Organization' + ] + }, + 'Group-Of-Names': { + 'classes': [], + 'ldapname': 'groupOfNames', + 'attributes': [ + 'Business-Category', + 'Common-Name', + 'Member', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Owner', + 'See-Also' + ] + }, + 'ms-DS-Az-Application': { + 'classes': [], + 'ldapname': 'msDS-AzApplication', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Application-Name', + 'ms-DS-Az-Application-Version', + 'ms-DS-Az-Class-ID', + 'ms-DS-Az-Generate-Audits', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid' + ] + }, + 'ipHost': { + 'classes': [], + 'ldapname': 'ipHost', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Manager', + 'ipHostNumber', + 'uid' + ] + }, + 'ms-WMI-MergeablePolicyTemplate': { + 'classes': [], + 'ldapname': 'msWMI-MergeablePolicyTemplate', + 'attributes': [] + }, + 'Ipsec-ISAKMP-Policy': { + 'classes': [], + 'ldapname': 'ipsecISAKMPPolicy', + 'attributes': [] + }, + 'ms-WMI-UintSetParam': { + 'classes': [], + 'ldapname': 'msWMI-UintSetParam', + 'attributes': [ + 'ms-WMI-intDefault', + 'ms-WMI-intValidValues' + ] + }, + 'Ipsec-Negotiation-Policy': { + 'classes': [], + 'ldapname': 'ipsecNegotiationPolicy', + 'attributes': [ + 'IPSEC-Negotiation-Policy-Action', + 'IPSEC-Negotiation-Policy-Type' + ] + }, + 'Ipsec-NFA': { + 'classes': [], + 'ldapname': 'ipsecNFA', + 'attributes': [ + 'Ipsec-Filter-Reference', + 'Ipsec-Negotiation-Policy-Reference' + ] + }, + 'ms-net-ieee-8023-GroupPolicy': { + 'classes': [], + 'ldapname': 'ms-net-ieee-8023-GroupPolicy', + 'attributes': [ + 'ms-net-ieee-8023-GP-PolicyData', + 'ms-net-ieee-8023-GP-PolicyGUID', + 'ms-net-ieee-8023-GP-PolicyReserved' + ] + }, + 'Country': { + 'classes': [], + 'ldapname': 'country', + 'attributes': [ + 'Country-Name', + 'Search-Guide', + 'Text-Country' + ] + }, + 'ipNetwork': { + 'classes': [], + 'ldapname': 'ipNetwork', + 'attributes': [ + 'Common-Name', + 'Description', + 'Locality-Name', + 'Manager', + 'ipNetmaskNumber', + 'ipNetworkNumber', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName', + 'uid' + ] + }, + 'Leaf': { + 'classes': [], + 'ldapname': 'leaf', + 'attributes': [] + }, + 'MSMQ-Enterprise-Settings': { + 'classes': [], + 'ldapname': 'mSMQEnterpriseSettings', + 'attributes': [ + 'MSMQ-CSP-Name', + 'MSMQ-Interval1', + 'MSMQ-Interval2', + 'MSMQ-Long-Lived', + 'MSMQ-Name-Style', + 'MSMQ-Version' + ] + }, + 'Application-Entity': { + 'classes': [], + 'ldapname': 'applicationEntity', + 'attributes': [ + 'Common-Name', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Presentation-Address', + 'See-Also', + 'Supported-Application-Context' + ] + }, + 'Organizational-Person': { + 'classes': [], + 'ldapname': 'organizationalPerson', + 'attributes': [ + 'Address', + 'Address-Home', + 'Assistant', + 'Company', + 'Country-Code', + 'Country-Name', + 'Department', + 'Destination-Indicator', + 'Division', + 'E-mail-Addresses', + 'Employee-ID', + 'Facsimile-Telephone-Number', + 'Generation-Qualifier', + 'Given-Name', + 'Initials', + 'International-ISDN-Number', + 'Locality-Name', + 'Logo', + 'MHS-OR-Address', + 'Manager', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Other-Mailbox', + 'Other-Name', + 'Personal-Title', + 'Phone-Fax-Other', + 'Phone-Home-Other', + 'Phone-Home-Primary', + 'Phone-ISDN-Primary', + 'Phone-Ip-Other', + 'Phone-Ip-Primary', + 'Phone-Mobile-Other', + 'Phone-Mobile-Primary', + 'Phone-Office-Other', + 'Phone-Pager-Other', + 'Phone-Pager-Primary', + 'Physical-Delivery-Office-Name', + 'Picture', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'State-Or-Province-Name', + 'Street-Address', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'Telex-Primary', + 'Text-Country', + 'Title', + 'User-Comment', + 'X121-Address', + 'houseIdentifier', + 'ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity', + 'ms-DS-Allowed-To-Delegate-To', + 'ms-DS-HAB-Seniority-Index', + 'ms-DS-Phonetic-Company-Name', + 'ms-DS-Phonetic-Department', + 'ms-DS-Phonetic-Display-Name', + 'ms-DS-Phonetic-First-Name', + 'ms-DS-Phonetic-Last-Name', + 'ms-Exch-House-Identifier' + ] + }, + 'Domain-DNS': { + 'classes': [ + 'Sam-Domain' + ], + 'ldapname': 'domainDNS', + 'attributes': [ + '', + 'Managed-By', + 'ms-DS-Allowed-DNS-Suffixes', + 'ms-DS-Behavior-Version', + 'ms-DS-Enabled-Feature', + 'ms-DS-USN-Last-Sync-Success' + ] + }, + 'Infrastructure-Update': { + 'classes': [], + 'ldapname': 'infrastructureUpdate', + 'attributes': [ + 'DN-Reference-Update', + 'Domain' + ] + }, + 'File-Link-Tracking-Entry': { + 'classes': [], + 'ldapname': 'fileLinkTrackingEntry', + 'attributes': [] + }, + 'MS-SQL-SQLDatabase': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLDatabase', + 'attributes': [ + 'MS-SQL-Alias', + 'MS-SQL-Applications', + 'MS-SQL-Contact', + 'MS-SQL-CreationDate', + 'MS-SQL-Description', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastBackupDate', + 'MS-SQL-LastDiagnosticDate', + 'MS-SQL-Name', + 'MS-SQL-Size', + 'MS-SQL-Status' + ] + }, + 'MS-SQL-SQLPublication': { + 'classes': [], + 'ldapname': 'mS-SQL-SQLPublication', + 'attributes': [ + 'MS-SQL-AllowAnonymousSubscription', + 'MS-SQL-AllowImmediateUpdatingSubscription', + 'MS-SQL-AllowKnownPullSubscription', + 'MS-SQL-AllowQueuedUpdatingSubscription', + 'MS-SQL-AllowSnapshotFilesFTPDownloading', + 'MS-SQL-Database', + 'MS-SQL-Description', + 'MS-SQL-Name', + 'MS-SQL-Publisher', + 'MS-SQL-Status', + 'MS-SQL-ThirdParty', + 'MS-SQL-Type' + ] + }, + 'PKI-Certificate-Template': { + 'classes': [], + 'ldapname': 'pKICertificateTemplate', + 'attributes': [ + 'Display-Name', + 'Flags', + 'PKI-Critical-Extensions', + 'PKI-Default-CSPs', + 'PKI-Default-Key-Spec', + 'PKI-Enrollment-Access', + 'PKI-Expiration-Period', + 'PKI-Extended-Key-Usage', + 'PKI-Key-Usage', + 'PKI-Max-Issuing-Depth', + 'PKI-Overlap-Period', + 'ms-PKI-Cert-Template-OID', + 'ms-PKI-Certificate-Application-Policy', + 'ms-PKI-Certificate-Name-Flag', + 'ms-PKI-Certificate-Policy', + 'ms-PKI-Enrollment-Flag', + 'ms-PKI-Minimal-Key-Size', + 'ms-PKI-Private-Key-Flag', + 'ms-PKI-RA-Application-Policies', + 'ms-PKI-RA-Policies', + 'ms-PKI-RA-Signature', + 'ms-PKI-Supersede-Templates', + 'ms-PKI-Template-Minor-Revision', + 'ms-PKI-Template-Schema-Version' + ] + }, + 'ipProtocol': { + 'classes': [], + 'ldapname': 'ipProtocol', + 'attributes': [ + 'Common-Name', + 'Description', + 'ipProtocolNumber', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'msSFU-30-Mail-Aliases': { + 'classes': [], + 'ldapname': 'msSFU30MailAliases', + 'attributes': [ + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'ms-WMI-Rule': { + 'classes': [], + 'ldapname': 'msWMI-Rule', + 'attributes': [ + 'ms-WMI-Query', + 'ms-WMI-QueryLanguage', + 'ms-WMI-TargetNameSpace' + ] + }, + 'Package-Registration': { + 'classes': [], + 'ldapname': 'packageRegistration', + 'attributes': [ + 'COM-ClassID', + 'COM-InterfaceID', + 'COM-ProgID', + 'COM-Typelib-Id', + 'Can-Upgrade-Script', + 'Categories', + 'File-Ext-Priority', + 'Icon-Path', + 'Install-Ui-Level', + 'Last-Update-Sequence', + 'Locale-ID', + 'Machine-Architecture', + 'Managed-By', + 'Msi-File-List', + 'Msi-Script', + 'Msi-Script-Name', + 'Msi-Script-Path', + 'Msi-Script-Size', + 'Package-Flags', + 'Package-Name', + 'Package-Type', + 'Product-Code', + 'Setup-Command', + 'Upgrade-Product-Code', + 'Vendor', + 'Version-Number-Hi', + 'Version-Number-Lo' + ] + }, + 'MSMQ-Custom-Recipient': { + 'classes': [], + 'ldapname': 'msMQ-Custom-Recipient', + 'attributes': [ + 'MSMQ-Recipient-FormatName' + ] + }, + 'Application-Process': { + 'classes': [], + 'ldapname': 'applicationProcess', + 'attributes': [ + 'Common-Name', + 'Locality-Name', + 'Organizational-Unit-Name', + 'See-Also' + ] + }, + 'ms-DS-Value-Type': { + 'classes': [], + 'ldapname': 'msDS-ValueType', + 'attributes': [ + 'ms-DS-Claim-Is-Single-Valued', + 'ms-DS-Claim-Is-Value-Space-Restricted', + 'ms-DS-Claim-Value-Type', + 'ms-DS-Is-Possible-Values-Present' + ] + }, + 'ms-DS-App-Data': { + 'classes': [], + 'ldapname': 'msDS-AppData', + 'attributes': [ + 'Keywords', + 'Managed-By', + 'Owner', + 'ms-DS-Byte-Array', + 'ms-DS-Date-Time', + 'ms-DS-Integer', + 'ms-DS-Object-Reference' + ] + }, + 'Service-Connection-Point': { + 'classes': [], + 'ldapname': 'serviceConnectionPoint', + 'attributes': [ + 'App-Schema-Version', + 'Service-Binding-Information', + 'Service-Class-Name', + 'Service-DNS-Name', + 'Service-DNS-Name-Type', + 'Vendor', + 'Version-Number', + 'Version-Number-Hi', + 'Version-Number-Lo' + ] + }, + 'ms-DS-Az-Operation': { + 'classes': [], + 'ldapname': 'msDS-AzOperation', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Operation-ID' + ] + }, + 'ms-Kds-Prov-RootKey': { + 'classes': [], + 'ldapname': 'msKds-ProvRootKey', + 'attributes': [ + 'Common-Name', + 'ms-Kds-CreateTime', + 'ms-Kds-DomainID', + 'ms-Kds-KDF-AlgorithmID', + 'ms-Kds-KDF-Param', + 'ms-Kds-PrivateKey-Length', + 'ms-Kds-PublicKey-Length', + 'ms-Kds-RootKeyData', + 'ms-Kds-SecretAgreement-AlgorithmID', + 'ms-Kds-SecretAgreement-Param', + 'ms-Kds-UseStartTime', + 'ms-Kds-Version' + ] + }, + 'Site-Link': { + 'classes': [], + 'ldapname': 'siteLink', + 'attributes': [ + 'Cost', + 'Options', + 'Repl-Interval', + 'Schedule', + 'Site-List' + ] + }, + 'ms-SPP-Activation-Object': { + 'classes': [], + 'ldapname': 'msSPP-ActivationObject', + 'attributes': [ + 'ms-SPP-CSVLK-Partial-Product-Key', + 'ms-SPP-CSVLK-Pid', + 'ms-SPP-CSVLK-Sku-Id', + 'ms-SPP-Config-License', + 'ms-SPP-Confirmation-Id', + 'ms-SPP-Installation-Id', + 'ms-SPP-Issuance-License', + 'ms-SPP-KMS-Ids', + 'ms-SPP-Online-License', + 'ms-SPP-Phone-License' + ] + }, + 'Domain-Policy': { + 'classes': [], + 'ldapname': 'domainPolicy', + 'attributes': [ + 'Authentication-Options', + 'Default-Local-Policy-Object', + 'Domain-Certificate-Authorities', + 'Domain-Policy-Reference', + 'Domain-Wide-Policy', + 'EFSPolicy', + 'Force-Logoff', + 'Ipsec-Policy-Reference', + 'Lock-Out-Observation-Window', + 'Lockout-Duration', + 'Lockout-Threshold', + 'Managed-By', + 'Max-Pwd-Age', + 'Max-Renew-Age', + 'Max-Ticket-Age', + 'Min-Pwd-Age', + 'Min-Pwd-Length', + 'Min-Ticket-Age', + 'Proxy-Lifetime', + 'Public-Key-Policy', + 'Pwd-History-Length', + 'Pwd-Properties', + 'Quality-Of-Service' + ] + }, + 'ms-WMI-SimplePolicyTemplate': { + 'classes': [], + 'ldapname': 'msWMI-SimplePolicyTemplate', + 'attributes': [ + 'ms-WMI-TargetObject' + ] + }, + 'ms-TAPI-Rt-Person': { + 'classes': [], + 'ldapname': 'msTAPI-RtPerson', + 'attributes': [ + 'ms-TAPI-Ip-Address', + 'ms-TAPI-Unique-Identifier' + ] + }, + 'Class-Schema': { + 'classes': [], + 'ldapname': 'classSchema', + 'attributes': [ + 'Auxiliary-Class', + 'Class-Display-Name', + 'Common-Name', + 'Default-Hiding-Value', + 'Default-Object-Category', + 'Default-Security-Descriptor', + 'Governs-ID', + 'Is-Defunct', + 'LDAP-Display-Name', + 'May-Contain', + 'Must-Contain', + 'Object-Class-Category', + 'Poss-Superiors', + 'RDN-Att-ID', + 'Schema-Flags-Ex', + 'Schema-ID-GUID', + 'Sub-Class-Of', + 'System-Auxiliary-Class', + 'System-May-Contain', + 'System-Must-Contain', + 'System-Only', + 'System-Poss-Superiors', + 'ms-DS-IntId', + 'ms-ds-Schema-Extensions' + ] + }, + 'Intellimirror-SCP': { + 'classes': [], + 'ldapname': 'intellimirrorSCP', + 'attributes': [ + 'Netboot-Machine-File-Path', + 'netboot-Allow-New-Clients', + 'netboot-Answer-Only-Valid-Clients', + 'netboot-Answer-Requests', + 'netboot-Current-Client-Count', + 'netboot-IntelliMirror-OSes', + 'netboot-Limit-Clients', + 'netboot-Locally-Installed-OSes', + 'netboot-Max-Clients', + 'netboot-New-Machine-Naming-Policy', + 'netboot-New-Machine-OU', + 'netboot-Server', + 'netboot-Tools' + ] + }, + 'DHCP-Class': { + 'classes': [], + 'ldapname': 'dHCPClass', + 'attributes': [ + 'Mscope-Id', + 'Network-Address', + 'Option-Description', + 'Options-Location', + 'Super-Scope-Description', + 'Super-Scopes', + 'dhcp-Classes', + 'dhcp-Flags', + 'dhcp-Identification', + 'dhcp-Mask', + 'dhcp-MaxKey', + 'dhcp-Obj-Description', + 'dhcp-Obj-Name', + 'dhcp-Options', + 'dhcp-Properties', + 'dhcp-Ranges', + 'dhcp-Reservations', + 'dhcp-Servers', + 'dhcp-Sites', + 'dhcp-State', + 'dhcp-Subnets', + 'dhcp-Type', + 'dhcp-Unique-Key', + 'dhcp-Update-Time' + ] + }, + 'groupOfUniqueNames': { + 'classes': [], + 'ldapname': 'groupOfUniqueNames', + 'attributes': [ + 'Business-Category', + 'Common-Name', + 'Description', + 'Organization-Name', + 'Organizational-Unit-Name', + 'Owner', + 'See-Also', + 'uniqueMember' + ] + }, + 'msSFU-30-Network-User': { + 'classes': [], + 'ldapname': 'msSFU30NetworkUser', + 'attributes': [ + 'msSFU-30-Key-Values', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Link-Track-OMT-Entry': { + 'classes': [], + 'ldapname': 'linkTrackOMTEntry', + 'attributes': [ + 'Birth-Location', + 'Current-Location', + 'OMT-Guid', + 'OMT-Indx-Guid', + 'Time-Refresh' + ] + }, + 'Site-Link-Bridge': { + 'classes': [], + 'ldapname': 'siteLinkBridge', + 'attributes': [ + 'Site-Link-List' + ] + }, + 'Certification-Authority': { + 'classes': [], + 'ldapname': 'certificationAuthority', + 'attributes': [ + 'Authority-Revocation-List', + 'CA-Certificate', + 'CA-Certificate-DN', + 'CA-Connect', + 'CA-Usages', + 'CA-WEB-URL', + 'CRL-Object', + 'Certificate-Revocation-List', + 'Certificate-Templates', + 'Common-Name', + 'Cross-Certificate-Pair', + 'Current-Parent-CA', + 'DNS-Host-Name', + 'Delta-Revocation-List', + 'Domain-ID', + 'Domain-Policy-Object', + 'Enrollment-Providers', + 'Parent-CA', + 'Parent-CA-Certificate-Chain', + 'Pending-CA-Certificates', + 'Pending-Parent-CA', + 'Previous-CA-Certificates', + 'Previous-Parent-CA', + 'Search-Guide', + 'Signature-Algorithms', + 'Supported-Application-Context', + 'Teletex-Terminal-Identifier' + ] + }, + 'Dfs-Configuration': { + 'classes': [], + 'ldapname': 'dfsConfiguration', + 'attributes': [] + }, + 'Link-Track-Vol-Entry': { + 'classes': [], + 'ldapname': 'linkTrackVolEntry', + 'attributes': [ + 'Curr-Machine-Id', + 'Link-Track-Secret', + 'Object-Count', + 'Seq-Notification', + 'Time-Refresh', + 'Time-Vol-Change', + 'Vol-Table-GUID', + 'Vol-Table-Idx-GUID' + ] + }, + 'NTDS-DSA': { + 'classes': [], + 'ldapname': 'nTDSDSA', + 'attributes': [ + 'DMD-Location', + 'FRS-Root-Path', + 'Has-Master-NCs', + 'Has-Partial-Replica-NCs', + 'Invocation-Id', + 'Last-Backup-Restoration-Time', + 'Managed-By', + 'Network-Address', + 'Options', + 'Query-Policy-Object', + 'Retired-Repl-DSA-Signatures', + 'Server-Reference', + 'ms-DS-Behavior-Version', + 'ms-DS-Enabled-Feature', + 'ms-DS-Has-Domain-NCs', + 'ms-DS-Has-Full-Replica-NCs', + 'ms-DS-Has-Instantiated-NCs', + 'ms-DS-Has-Master-NCs', + 'ms-DS-Is-User-Cachable-At-Rodc', + 'ms-DS-Never-Reveal-Group', + 'ms-DS-Port-LDAP', + 'ms-DS-Port-SSL', + 'ms-DS-ReplicationEpoch', + 'ms-DS-Retired-Repl-NC-Signatures', + 'ms-DS-Reveal-OnDemand-Group', + 'ms-DS-Revealed-Users', + 'ms-DS-Service-Account', + 'ms-DS-Service-Account-DNS-Domain', + 'ms-DS-SiteName', + 'ms-DS-isGC', + 'ms-DS-isRODC' + ] + }, + 'ms-Authz-Central-Access-Policy': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessPolicy', + 'attributes': [ + 'ms-Authz-Central-Access-Policy-ID', + 'ms-Authz-Member-Rules-In-Central-Access-Policy' + ] + }, + 'oncRpc': { + 'classes': [], + 'ldapname': 'oncRpc', + 'attributes': [ + 'Common-Name', + 'Description', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName', + 'oncRpcNumber' + ] + }, + 'ms-DS-Quota-Control': { + 'classes': [], + 'ldapname': 'msDS-QuotaControl', + 'attributes': [ + 'Common-Name', + 'ms-DS-Quota-Amount', + 'ms-DS-Quota-Trustee' + ] + }, + 'Rpc-Container': { + 'classes': [], + 'ldapname': 'rpcContainer', + 'attributes': [ + 'Name-Service-Flags' + ] + }, + 'ms-DS-App-Configuration': { + 'classes': [], + 'ldapname': 'msDS-App-Configuration', + 'attributes': [ + 'Keywords', + 'Managed-By', + 'Owner', + 'ms-DS-Byte-Array', + 'ms-DS-Date-Time', + 'ms-DS-Integer', + 'ms-DS-Object-Reference' + ] + }, + 'DMD': { + 'classes': [], + 'ldapname': 'dMD', + 'attributes': [ + 'Common-Name', + 'DMD-Name', + 'Prefix-Map', + 'Schema-Info', + 'Schema-Update', + 'ms-DS-IntId', + 'ms-DS-USN-Last-Sync-Success', + 'ms-ds-Schema-Extensions' + ] + }, + 'ms-DS-Claims-Transformation-Policy-Type': { + 'classes': [], + 'ldapname': 'msDS-ClaimsTransformationPolicyType', + 'attributes': [ + 'ms-DS-Transformation-Rules', + 'ms-DS-Transformation-Rules-Compiled' + ] + }, + 'ms-Kds-Prov-ServerConfiguration': { + 'classes': [], + 'ldapname': 'msKds-ProvServerConfiguration', + 'attributes': [ + 'ms-Kds-KDF-AlgorithmID', + 'ms-Kds-KDF-Param', + 'ms-Kds-PrivateKey-Length', + 'ms-Kds-PublicKey-Length', + 'ms-Kds-SecretAgreement-AlgorithmID', + 'ms-Kds-SecretAgreement-Param', + 'ms-Kds-Version' + ] + }, + 'Subnet': { + 'classes': [], + 'ldapname': 'subnet', + 'attributes': [ + 'Location', + 'Physical-Location-Object', + 'Site-Object' + ] + }, + 'Group-Policy-Container': { + 'classes': [], + 'ldapname': 'groupPolicyContainer', + 'attributes': [ + 'Flags', + 'GPC-File-Sys-Path', + 'GPC-Functionality-Version', + 'GPC-Machine-Extension-Names', + 'GPC-User-Extension-Names', + 'GPC-WQL-Filter', + 'Version-Number', + 'GPC-Linked-OU' + ] + }, + 'Container': { + 'classes': [], + 'ldapname': 'container', + 'attributes': [ + 'Common-Name', + 'Default-Class-Store', + 'Organizational-Unit', + 'Schema-Version', + 'ms-DS-Object-Reference' + ] + }, + 'ms-PKI-Enterprise-Oid': { + 'classes': [], + 'ldapname': 'msPKI-Enterprise-Oid', + 'attributes': [ + 'Container', + 'ms-DS-OIDToGroup-Link', + 'ms-PKI-Cert-Template-OID', + 'ms-PKI-OID-Attribute', + 'ms-PKI-OID-CPS', + 'ms-PKI-OID-LocalizedName', + 'ms-PKI-OID-User-Notice' + ] + }, + 'msSFU-30-NIS-Map-Config': { + 'classes': [], + 'ldapname': 'msSFU30NISMapConfig', + 'attributes': [ + 'msSFU-30-Field-Separator', + 'msSFU-30-Intra-Field-Separator', + 'msSFU-30-Key-Attributes', + 'msSFU-30-Map-Filter', + 'msSFU-30-NSMAP-Field-Position', + 'msSFU-30-Result-Attributes', + 'msSFU-30-Search-Attributes' + ] + }, + 'Class-Store': { + 'classes': [], + 'ldapname': 'classStore', + 'attributes': [ + 'App-Schema-Version', + 'Container', + 'Last-Update-Sequence', + 'Next-Level-Store', + 'Version-Number' + ] + }, + 'MS-SQL-OLAPDatabase': { + 'classes': [], + 'ldapname': 'mS-SQL-OLAPDatabase', + 'attributes': [ + 'MS-SQL-Applications', + 'MS-SQL-ConnectionURL', + 'MS-SQL-Contact', + 'MS-SQL-Description', + 'MS-SQL-InformationURL', + 'MS-SQL-Keywords', + 'MS-SQL-LastBackupDate', + 'MS-SQL-LastUpdatedDate', + 'MS-SQL-Name', + 'MS-SQL-PublicationURL', + 'MS-SQL-Size', + 'MS-SQL-Status', + 'MS-SQL-Type' + ] + }, + 'Lost-And-Found': { + 'classes': [], + 'ldapname': 'lostAndFound', + 'attributes': [ + 'Move-Tree-State' + ] + }, + 'Remote-Mail-Recipient': { + 'classes': [ + 'Mail-Recipient' + ], + 'ldapname': 'remoteMailRecipient', + 'attributes': [ + 'Managed-By', + 'Remote-Source', + 'Remote-Source-Type' + ] + }, + 'Builtin-Domain': { + 'classes': [ + 'Sam-Domain-Base' + ], + 'ldapname': 'builtinDomain', + 'attributes': [] + }, + 'ms-DS-Resource-Property-List': { + 'classes': [], + 'ldapname': 'msDS-ResourcePropertyList', + 'attributes': [ + 'ms-DS-Members-Of-Resource-Property-List' + ] + }, + 'ipService': { + 'classes': [], + 'ldapname': 'ipService', + 'attributes': [ + 'Common-Name', + 'Description', + 'ipServicePort', + 'ipServiceProtocol', + 'msSFU-30-Aliases', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'room': { + 'classes': [], + 'ldapname': 'room', + 'attributes': [ + 'Common-Name', + 'Description', + 'Location', + 'See-Also', + 'Telephone-Number', + 'roomNumber' + ] + }, + 'shadowAccount': { + 'classes': [], + 'ldapname': 'shadowAccount', + 'attributes': [ + 'Description', + 'User-Password', + 'shadowExpire', + 'shadowFlag', + 'shadowInactive', + 'shadowLastChange', + 'shadowMax', + 'shadowMin', + 'shadowWarning', + 'uid' + ] + }, + 'Service-Class': { + 'classes': [], + 'ldapname': 'serviceClass', + 'attributes': [ + 'Display-Name', + 'Service-Class-ID', + 'Service-Class-Info' + ] + }, + 'NTDS-DSA-RO': { + 'classes': [], + 'ldapname': 'nTDSDSARO', + 'attributes': [] + }, + 'NTFRS-Member': { + 'classes': [], + 'ldapname': 'nTFRSMember', + 'attributes': [ + 'FRS-Control-Data-Creation', + 'FRS-Control-Inbound-Backlog', + 'FRS-Control-Outbound-Backlog', + 'FRS-Extensions', + 'FRS-Flags', + 'FRS-Partner-Auth-Level', + 'FRS-Root-Security', + 'FRS-Service-Command', + 'FRS-Update-Timeout', + 'Frs-Computer-Reference', + 'Server-Reference' + ] + }, + 'Site': { + 'classes': [], + 'ldapname': 'site', + 'attributes': [ + 'GP-Link', + 'GP-Options', + 'Location', + 'MSMQ-Interval1', + 'MSMQ-Interval2', + 'MSMQ-Nt4-Stub', + 'MSMQ-Site-Foreign', + 'MSMQ-Site-ID', + 'Managed-By', + 'Notification-List', + 'ms-DS-BridgeHead-Servers-Used' + ] + }, + 'Cross-Ref': { + 'classes': [], + 'ldapname': 'crossRef', + 'attributes': [ + 'Common-Name', + 'Dns-Root', + 'Enabled', + 'NC-Name', + 'NETBIOS-Name', + 'NT-Mixed-Domain', + 'Root-Trust', + 'Superior-DNS-Root', + 'Trust-Parent', + 'ms-DS-Behavior-Version', + 'ms-DS-DnsRootAlias', + 'ms-DS-NC-RO-Replica-Locations', + 'ms-DS-NC-Replica-Locations', + 'ms-DS-Replication-Notify-First-DSA-Delay', + 'ms-DS-Replication-Notify-Subsequent-DSA-Delay', + 'ms-DS-SD-Reference-Domain' + ] + }, + 'ms-DFS-Link-v2': { + 'classes': [], + 'ldapname': 'msDFS-Linkv2', + 'attributes': [ + 'ms-DFS-Comment-v2', + 'ms-DFS-Generation-GUID-v2', + 'ms-DFS-Last-Modified-v2', + 'ms-DFS-Link-Identity-GUID-v2', + 'ms-DFS-Link-Path-v2', + 'ms-DFS-Link-Security-Descriptor-v2', + 'ms-DFS-Namespace-Identity-GUID-v2', + 'ms-DFS-Properties-v2', + 'ms-DFS-Short-Name-Link-Path-v2', + 'ms-DFS-Target-List-v2', + 'ms-DFS-Ttl-v2' + ] + }, + 'ms-DS-Bindable-Object': { + 'classes': [], + 'ldapname': 'msDS-BindableObject', + 'attributes': [ + 'Account-Expires', + 'Bad-Password-Time', + 'Bad-Pwd-Count', + 'Last-Logon-Timestamp', + 'Lockout-Time', + 'Nt-Pwd-History', + 'Pwd-Last-Set', + 'Unicode-Pwd', + 'ms-DS-User-Account-Auto-Locked', + 'ms-DS-User-Account-Control-Computed', + 'ms-DS-User-Account-Disabled', + 'ms-DS-User-Dont-Expire-Password', + 'ms-DS-User-Encrypted-Text-Password-Allowed', + 'ms-DS-User-Password-Expired', + 'ms-DS-User-Password-Not-Required' + ] + }, + 'File-Link-Tracking': { + 'classes': [], + 'ldapname': 'fileLinkTracking', + 'attributes': [] + }, + 'Class-Registration': { + 'classes': [], + 'ldapname': 'classRegistration', + 'attributes': [ + 'COM-CLSID', + 'COM-InterfaceID', + 'COM-Other-Prog-Id', + 'COM-ProgID', + 'COM-Treat-As-Class-Id', + 'Implemented-Categories', + 'Managed-By', + 'Required-Categories' + ] + }, + 'Configuration': { + 'classes': [], + 'ldapname': 'configuration', + 'attributes': [ + 'Common-Name', + 'GP-Link', + 'GP-Options', + 'ms-DS-Repl-Authentication-Mode', + 'ms-DS-USN-Last-Sync-Success' + ] + }, + 'ms-SPP-Activation-Objects-Container': { + 'classes': [], + 'ldapname': 'msSPP-ActivationObjectsContainer', + 'attributes': [] + }, + 'Organization': { + 'classes': [], + 'ldapname': 'organization', + 'attributes': [ + 'Business-Category', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Locality-Name', + 'Organization-Name', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'Search-Guide', + 'See-Also', + 'State-Or-Province-Name', + 'Street-Address', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'User-Password', + 'X121-Address' + ] + }, + 'Trusted-Domain': { + 'classes': [], + 'ldapname': 'trustedDomain', + 'attributes': [ + 'Additional-Trusted-Service-Names', + 'Domain-Cross-Ref', + 'Domain-Identifier', + 'Flat-Name', + 'Initial-Auth-Incoming', + 'Initial-Auth-Outgoing', + 'MS-DS-Creator-SID', + 'Security-Identifier', + 'Trust-Attributes', + 'Trust-Auth-Incoming', + 'Trust-Auth-Outgoing', + 'Trust-Direction', + 'Trust-Partner', + 'Trust-Posix-Offset', + 'Trust-Type', + 'ms-DS-Egress-Claims-Transformation-Policy', + 'ms-DS-Ingress-Claims-Transformation-Policy', + 'ms-DS-Supported-Encryption-Types', + 'ms-DS-Trust-Forest-Trust-Info' + ] + }, + 'ms-Imaging-PostScanProcess': { + 'classes': [], + 'ldapname': 'msImaging-PostScanProcess', + 'attributes': [ + 'Display-Name', + 'Server-Name', + 'ms-Imaging-PSP-Identifier', + 'ms-Imaging-PSP-String' + ] + }, + 'MSMQ-Queue': { + 'classes': [], + 'ldapname': 'mSMQQueue', + 'attributes': [ + 'MSMQ-Authenticate', + 'MSMQ-Base-Priority', + 'MSMQ-Journal', + 'MSMQ-Label', + 'MSMQ-Label-Ex', + 'MSMQ-Multicast-Address', + 'MSMQ-Owner-ID', + 'MSMQ-Privacy-Level', + 'MSMQ-Queue-Journal-Quota', + 'MSMQ-Queue-Name-Ext', + 'MSMQ-Queue-Quota', + 'MSMQ-Queue-Type', + 'MSMQ-Secured-Source', + 'MSMQ-Transactional' + ] + }, + 'Dns-Node': { + 'classes': [], + 'ldapname': 'dnsNode', + 'attributes': [ + 'DNS-Property', + 'DNS-Tombstoned', + 'Dns-Record', + 'Domain-Component' + ] + }, + 'ms-DS-Claim-Type': { + 'classes': [], + 'ldapname': 'msDS-ClaimType', + 'attributes': [ + 'ms-DS-Claim-Attribute-Source', + 'ms-DS-Claim-Is-Single-Valued', + 'ms-DS-Claim-Is-Value-Space-Restricted', + 'ms-DS-Claim-Source', + 'ms-DS-Claim-Source-Type', + 'ms-DS-Claim-Type-Applies-To-Class', + 'ms-DS-Claim-Value-Type' + ] + }, + 'ms-DFSR-LocalSettings': { + 'classes': [], + 'ldapname': 'msDFSR-LocalSettings', + 'attributes': [ + 'ms-DFSR-CommonStagingPath', + 'ms-DFSR-CommonStagingSizeInMb', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2', + 'ms-DFSR-StagingCleanupTriggerInPercent', + 'ms-DFSR-Version' + ] + }, + 'ms-Authz-Central-Access-Rules': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessRules', + 'attributes': [] + }, + 'MSMQ-Group': { + 'classes': [], + 'ldapname': 'msMQ-Group', + 'attributes': [ + 'Member' + ] + }, + 'ms-DS-Password-Settings': { + 'classes': [], + 'ldapname': 'msDS-PasswordSettings', + 'attributes': [ + 'ms-DS-Lockout-Duration', + 'ms-DS-Lockout-Observation-Window', + 'ms-DS-Lockout-Threshold', + 'ms-DS-Maximum-Password-Age', + 'ms-DS-Minimum-Password-Age', + 'ms-DS-Minimum-Password-Length', + 'ms-DS-PSO-Applies-To', + 'ms-DS-Password-Complexity-Enabled', + 'ms-DS-Password-History-Length', + 'ms-DS-Password-Reversible-Encryption-Enabled', + 'ms-DS-Password-Settings-Precedence' + ] + }, + 'ms-DFSR-Member': { + 'classes': [], + 'ldapname': 'msDFSR-Member', + 'attributes': [ + 'Server-Reference', + 'ms-DFSR-ComputerReference', + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Keywords', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'rpc-Profile': { + 'classes': [], + 'ldapname': 'rpcProfile', + 'attributes': [] + }, + 'ms-Authz-Central-Access-Rule': { + 'classes': [], + 'ldapname': 'msAuthz-CentralAccessRule', + 'attributes': [ + 'Enabled', + 'ms-Authz-Effective-Security-Policy', + 'ms-Authz-Last-Effective-Security-Policy', + 'ms-Authz-Proposed-Security-Policy', + 'ms-Authz-Resource-Condition' + ] + }, + 'Link-Track-Volume-Table': { + 'classes': [], + 'ldapname': 'linkTrackVolumeTable', + 'attributes': [] + }, + 'ms-DS-Optional-Feature': { + 'classes': [], + 'ldapname': 'msDS-OptionalFeature', + 'attributes': [ + 'ms-DS-Optional-Feature-Flags', + 'ms-DS-Optional-Feature-GUID', + 'ms-DS-Required-Domain-Behavior-Version', + 'ms-DS-Required-Forest-Behavior-Version' + ] + }, + 'User': { + 'classes': [ + 'Mail-Recipient', + 'Security-Principal' + ], + 'ldapname': 'user', + 'attributes': [ + 'ACS-Policy-Name', + 'Account-Expires', + 'Address-Home', + 'Admin-Count', + 'Bad-Password-Time', + 'Bad-Pwd-Count', + 'Business-Category', + 'Code-Page', + 'Control-Access-Rights', + 'DBCS-Pwd', + 'Default-Class-Store', + 'Desktop-Profile', + 'Display-Name', + 'Dynamic-LDAP-Server', + 'E-mail-Addresses', + 'Employee-Number', + 'Employee-Type', + 'Given-Name', + 'Group-Membership-SAM', + 'Group-Priority', + 'Groups-to-Ignore', + 'Home-Directory', + 'Home-Drive', + 'Initials', + 'Last-Logoff', + 'Last-Logon', + 'Last-Logon-Timestamp', + 'Lm-Pwd-History', + 'Locale-ID', + 'Lockout-Time', + 'Logon-Count', + 'Logon-Hours', + 'Logon-Workstation', + 'MS-DRM-Identity-Certificate', + 'MS-DS-Creator-SID', + 'MS-TS-ExpireDate', + 'MS-TS-ExpireDate2', + 'MS-TS-ExpireDate3', + 'MS-TS-ExpireDate4', + 'MS-TS-LicenseVersion', + 'MS-TS-LicenseVersion2', + 'MS-TS-LicenseVersion3', + 'MS-TS-LicenseVersion4', + 'MS-TS-ManagingLS', + 'MS-TS-ManagingLS2', + 'MS-TS-ManagingLS3', + 'MS-TS-ManagingLS4', + 'MS-TS-Property01', + 'MS-TS-Property02', + 'MS-TSLS-Property01', + 'MS-TSLS-Property02', + 'MSMQ-Digests', + 'MSMQ-Digests-Mig', + 'MSMQ-Sign-Certificates', + 'MSMQ-Sign-Certificates-Mig', + 'Manager', + 'Max-Storage', + 'Network-Address', + 'Nt-Pwd-History', + 'Operator-Count', + 'Organization-Name', + 'Other-Login-Workstations', + 'Phone-Home-Primary', + 'Phone-Mobile-Primary', + 'Phone-Pager-Primary', + 'Preferred-OU', + 'Primary-Group-ID', + 'Profile-Path', + 'Pwd-Last-Set', + 'Script-Path', + 'Service-Principal-Name', + 'Terminal-Server', + 'Unicode-Pwd', + 'User-Account-Control', + 'User-Parameters', + 'User-Principal-Name', + 'User-SMIME-Certificate', + 'User-Shared-Folder', + 'User-Shared-Folder-Other', + 'User-Workstations', + 'X509-Cert', + 'audio', + 'carLicense', + 'departmentNumber', + 'jpegPhoto', + 'labeledURI', + 'ms-COM-UserPartitionSetLink', + 'ms-DS-AuthenticatedAt-DC', + 'ms-DS-Cached-Membership', + 'ms-DS-Cached-Membership-Time-Stamp', + 'ms-DS-Failed-Interactive-Logon-Count', + 'ms-DS-Failed-Interactive-Logon-Count-At-Last-Successful-Logon', + 'ms-DS-Last-Failed-Interactive-Logon-Time', + 'ms-DS-Last-Successful-Interactive-Logon-Time', + 'ms-DS-Primary-Computer', + 'ms-DS-Resultant-PSO', + 'ms-DS-Secondary-KrbTgt-Number', + 'ms-DS-Site-Affinity', + 'ms-DS-Source-Object-DN', + 'ms-DS-Supported-Encryption-Types', + 'ms-DS-User-Account-Control-Computed', + 'ms-DS-User-Password-Expiry-Time-Computed', + 'ms-IIS-FTP-Dir', + 'ms-IIS-FTP-Root', + 'ms-PKI-AccountCredentials', + 'ms-PKI-Credential-Roaming-Tokens', + 'ms-PKI-DPAPIMasterKeys', + 'ms-PKI-RoamingTimeStamp', + 'ms-RADIUS-FramedInterfaceId', + 'ms-RADIUS-FramedIpv6Prefix', + 'ms-RADIUS-FramedIpv6Route', + 'ms-RADIUS-SavedFramedInterfaceId', + 'ms-RADIUS-SavedFramedIpv6Prefix', + 'ms-RADIUS-SavedFramedIpv6Route', + 'ms-TS-Allow-Logon', + 'ms-TS-Broken-Connection-Action', + 'ms-TS-Connect-Client-Drives', + 'ms-TS-Connect-Printer-Drives', + 'ms-TS-Default-To-Main-Printer', + 'ms-TS-Home-Directory', + 'ms-TS-Home-Drive', + 'ms-TS-Initial-Program', + 'ms-TS-Max-Connection-Time', + 'ms-TS-Max-Disconnection-Time', + 'ms-TS-Max-Idle-Time', + 'ms-TS-Primary-Desktop', + 'ms-TS-Profile-Path', + 'ms-TS-Reconnection-Action', + 'ms-TS-Remote-Control', + 'ms-TS-Secondary-Desktops', + 'ms-TS-Work-Directory', + 'msNPAllowDialin', + 'msNPCallingStationID', + 'msNPSavedCallingStationID', + 'msRADIUSCallbackNumber', + 'msRADIUSFramedIPAddress', + 'msRADIUSFramedRoute', + 'msRADIUSServiceType', + 'msRASSavedCallbackNumber', + 'msRASSavedFramedIPAddress', + 'msRASSavedFramedRoute', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'photo', + 'preferredLanguage', + 'roomNumber', + 'secretary', + 'uid', + 'userPKCS12', + 'x500uniqueIdentifier' + ] + }, + 'ms-PKI-Private-Key-Recovery-Agent': { + 'classes': [], + 'ldapname': 'msPKI-PrivateKeyRecoveryAgent', + 'attributes': [ + 'X509-Cert' + ] + }, + 'Sites-Container': { + 'classes': [], + 'ldapname': 'sitesContainer', + 'attributes': [] + }, + 'posixAccount': { + 'classes': [], + 'ldapname': 'posixAccount', + 'attributes': [ + 'Common-Name', + 'Description', + 'Home-Directory', + 'User-Password', + 'gecos', + 'gidNumber', + 'loginShell', + 'uid', + 'uidNumber', + 'unixHomeDirectory', + 'unixUserPassword' + ] + }, + 'SubSchema': { + 'classes': [], + 'ldapname': 'subSchema', + 'attributes': [ + 'Attribute-Types', + 'DIT-Content-Rules', + 'Extended-Attribute-Info', + 'Extended-Class-Info', + 'Modify-Time-Stamp', + 'Object-Classes' + ] + }, + 'Sam-Domain-Base': { + 'classes': [], + 'ldapname': 'samDomainBase', + 'attributes': [ + 'Creation-Time', + 'Domain-Replica', + 'Force-Logoff', + 'Lock-Out-Observation-Window', + 'Lockout-Duration', + 'Lockout-Threshold', + 'Max-Pwd-Age', + 'Min-Pwd-Age', + 'Min-Pwd-Length', + 'Modified-Count', + 'Modified-Count-At-Last-Prom', + 'NT-Security-Descriptor', + 'Next-Rid', + 'OEM-Information', + 'Object-Sid', + 'Pwd-History-Length', + 'Pwd-Properties', + 'Revision', + 'Server-Role', + 'Server-State', + 'UAS-Compat' + ] + }, + 'Ipsec-Base': { + 'classes': [], + 'ldapname': 'ipsecBase', + 'attributes': [ + 'Ipsec-Data', + 'Ipsec-Data-Type', + 'Ipsec-ID', + 'Ipsec-Name', + 'Ipsec-Owners-Reference' + ] + }, + 'ms-TPM-Information-Objects-Container': { + 'classes': [], + 'ldapname': 'msTPM-InformationObjectsContainer', + 'attributes': [ + 'Common-Name' + ] + }, + 'ms-WMI-StringSetParam': { + 'classes': [], + 'ldapname': 'msWMI-StringSetParam', + 'attributes': [ + 'ms-WMI-stringDefault', + 'ms-WMI-stringValidValues' + ] + }, + 'ms-PKI-Key-Recovery-Agent': { + 'classes': [], + 'ldapname': 'msPKI-Key-Recovery-Agent', + 'attributes': [] + }, + 'ms-DS-Az-Task': { + 'classes': [], + 'ldapname': 'msDS-AzTask', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Biz-Rule', + 'ms-DS-Az-Biz-Rule-Language', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Last-Imported-Biz-Rule-Path', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Task-Is-Role-Definition', + 'ms-DS-Operations-For-Az-Task', + 'ms-DS-Tasks-For-Az-Task' + ] + }, + 'ms-DFSR-GlobalSettings': { + 'classes': [], + 'ldapname': 'msDFSR-GlobalSettings', + 'attributes': [ + 'ms-DFSR-Extension', + 'ms-DFSR-Flags', + 'ms-DFSR-Options', + 'ms-DFSR-Options2' + ] + }, + 'NTDS-Service': { + 'classes': [], + 'ldapname': 'nTDSService', + 'attributes': [ + 'DS-Heuristics', + 'Garbage-Coll-Period', + 'Repl-Topology-Stay-Of-Execution', + 'SPN-Mappings', + 'Tombstone-Lifetime', + 'ms-DS-Deleted-Object-Lifetime', + 'ms-DS-Other-Settings' + ] + }, + 'Address-Template': { + 'classes': [], + 'ldapname': 'addressTemplate', + 'attributes': [ + 'Address-Syntax', + 'Address-Type', + 'Display-Name', + 'Per-Msg-Dialog-Display-Table', + 'Per-Recip-Dialog-Display-Table', + 'Proxy-Generation-Enabled' + ] + }, + 'ms-Exch-Configuration-Container': { + 'classes': [], + 'ldapname': 'msExchConfigurationContainer', + 'attributes': [ + 'Address-Book-Roots', + 'Address-Book-Roots2', + 'Global-Address-List', + 'Global-Address-List2', + 'Template-Roots', + 'Template-Roots2' + ] + }, + 'nisNetgroup': { + 'classes': [], + 'ldapname': 'nisNetgroup', + 'attributes': [ + 'Common-Name', + 'Description', + 'memberNisNetgroup', + 'msSFU-30-Name', + 'msSFU-30-Netgroup-Host-At-Domain', + 'msSFU-30-Netgroup-User-At-Domain', + 'msSFU-30-Nis-Domain', + 'nisMapName', + 'nisNetgroupTriple' + ] + }, + 'ms-DS-Password-Settings-Container': { + 'classes': [], + 'ldapname': 'msDS-PasswordSettingsContainer', + 'attributes': [] + }, + 'rFC822LocalPart': { + 'classes': [], + 'ldapname': 'rFC822LocalPart', + 'attributes': [ + 'Common-Name', + 'Description', + 'Destination-Indicator', + 'Facsimile-Telephone-Number', + 'International-ISDN-Number', + 'Physical-Delivery-Office-Name', + 'Post-Office-Box', + 'Postal-Address', + 'Postal-Code', + 'Preferred-Delivery-Method', + 'Registered-Address', + 'See-Also', + 'Street-Address', + 'Surname', + 'Telephone-Number', + 'Teletex-Terminal-Identifier', + 'Telex-Number', + 'X121-Address' + ] + }, + 'ms-DS-Claim-Types': { + 'classes': [], + 'ldapname': 'msDS-ClaimTypes', + 'attributes': [] + }, + 'Remote-Storage-Service-Point': { + 'classes': [], + 'ldapname': 'remoteStorageServicePoint', + 'attributes': [ + 'Remote-Storage-GUID' + ] + }, + 'Sam-Domain': { + 'classes': [ + 'Sam-Domain-Base' + ], + 'ldapname': 'samDomain', + 'attributes': [ + 'Auditing-Policy', + 'Builtin-Creation-Time', + 'Builtin-Modified-Count', + 'CA-Certificate', + 'Control-Access-Rights', + 'Creation-Time', + 'Default-Local-Policy-Object', + 'Description', + 'Desktop-Profile', + 'Domain-Policy-Object', + 'EFSPolicy', + 'GP-Link', + 'GP-Options', + 'LSA-Creation-Time', + 'LSA-Modified-Count', + 'Lock-Out-Observation-Window', + 'Lockout-Duration', + 'Lockout-Threshold', + 'MS-DS-All-Users-Trust-Quota', + 'MS-DS-Machine-Account-Quota', + 'MS-DS-Per-User-Trust-Quota', + 'MS-DS-Per-User-Trust-Tombstones-Quota', + 'Max-Pwd-Age', + 'Min-Pwd-Age', + 'Min-Pwd-Length', + 'Modified-Count-At-Last-Prom', + 'NETBIOS-Name', + 'NT-Mixed-Domain', + 'Next-Rid', + 'Pek-Key-Change-Interval', + 'Pek-List', + 'Private-Key', + 'Pwd-History-Length', + 'Pwd-Properties', + 'RID-Manager-Reference', + 'Replica-Source', + 'Tree-Name', + 'ms-DS-Logon-Time-Sync-Interval' + ] + }, + 'Licensing-Site-Settings': { + 'classes': [], + 'ldapname': 'licensingSiteSettings', + 'attributes': [ + 'Site-Server' + ] + }, + 'NTFRS-Subscriptions': { + 'classes': [], + 'ldapname': 'nTFRSSubscriptions', + 'attributes': [ + 'Computer', + 'FRS-Extensions', + 'FRS-Version', + 'FRS-Working-Path' + ] + }, + 'ms-DS-Az-Admin-Manager': { + 'classes': [], + 'ldapname': 'msDS-AzAdminManager', + 'attributes': [ + 'Description', + 'ms-DS-Az-Application-Data', + 'ms-DS-Az-Domain-Timeout', + 'ms-DS-Az-Generate-Audits', + 'ms-DS-Az-Generic-Data', + 'ms-DS-Az-Major-Version', + 'ms-DS-Az-Minor-Version', + 'ms-DS-Az-Object-Guid', + 'ms-DS-Az-Script-Engine-Cache-Max', + 'ms-DS-Az-Script-Timeout' + ] + }, + 'ACS-Policy': { + 'classes': [], + 'ldapname': 'aCSPolicy', + 'attributes': [ + 'ACS-Aggregate-Token-Rate-Per-User', + 'ACS-Direction', + 'ACS-Identity-Name', + 'ACS-Max-Aggregate-Peak-Rate-Per-User', + 'ACS-Max-Duration-Per-Flow', + 'ACS-Max-Peak-Bandwidth-Per-Flow', + 'ACS-Max-Token-Bucket-Per-Flow', + 'ACS-Max-Token-Rate-Per-Flow', + 'ACS-Maximum-SDU-Size', + 'ACS-Minimum-Delay-Variation', + 'ACS-Minimum-Latency', + 'ACS-Minimum-Policed-Size', + 'ACS-Permission-Bits', + 'ACS-Priority', + 'ACS-Service-Type', + 'ACS-Time-Of-Day', + 'ACS-Total-No-Of-Flows' + ] + }, + 'Category-Registration': { + 'classes': [], + 'ldapname': 'categoryRegistration', + 'attributes': [ + 'Category-Id', + 'Locale-ID', + 'Localized-Description', + 'Managed-By' + ] + }, + 'Query-Policy': { + 'classes': [], + 'ldapname': 'queryPolicy', + 'attributes': [ + 'LDAP-Admin-Limits', + 'LDAP-IPDeny-List' + ] + }, + 'domainRelatedObject': { + 'classes': [], + 'ldapname': 'domainRelatedObject', + 'attributes': [ + 'associatedDomain' + ] + }, + 'RRAS-Administration-Dictionary': { + 'classes': [], + 'ldapname': 'rRASAdministrationDictionary', + 'attributes': [ + 'ms-RRAS-Vendor-Attribute-Entry' + ] + }, + 'ms-DFS-Namespace-Anchor': { + 'classes': [], + 'ldapname': 'msDFS-NamespaceAnchor', + 'attributes': [ + 'ms-DFS-Schema-Major-Version' + ] + }, + 'ms-WMI-RealRangeParam': { + 'classes': [], + 'ldapname': 'msWMI-RealRangeParam', + 'attributes': [ + 'ms-WMI-int8Default', + 'ms-WMI-int8Max', + 'ms-WMI-int8Min' + ] + }, + 'Address-Book-Container': { + 'classes': [], + 'ldapname': 'addressBookContainer', + 'attributes': [ + 'Configuration', + 'Display-Name', + 'Purported-Search' + ] + }, + 'ms-ieee-80211-Policy': { + 'classes': [], + 'ldapname': 'msieee80211-Policy', + 'attributes': [ + 'ms-ieee-80211-Data', + 'ms-ieee-80211-Data-Type', + 'ms-ieee-80211-ID' + ] + }, + 'Dns-Zone': { + 'classes': [], + 'ldapname': 'dnsZone', + 'attributes': [ + 'DNS-Property', + 'Dns-Allow-Dynamic', + 'Dns-Allow-XFR', + 'Dns-Notify-Secondaries', + 'Dns-Secure-Secondaries', + 'Domain-Component', + 'Managed-By', + 'ms-DNS-DNSKEY-Record-Set-TTL', + 'ms-DNS-DNSKEY-Records', + 'ms-DNS-DS-Record-Algorithms', + 'ms-DNS-DS-Record-Set-TTL', + 'ms-DNS-Is-Signed', + 'ms-DNS-Maintain-Trust-Anchor', + 'ms-DNS-NSEC3-Current-Salt', + 'ms-DNS-NSEC3-Hash-Algorithm', + 'ms-DNS-NSEC3-Iterations', + 'ms-DNS-NSEC3-OptOut', + 'ms-DNS-NSEC3-Random-Salt-Length', + 'ms-DNS-NSEC3-User-Salt', + 'ms-DNS-Parent-Has-Secure-Delegation', + 'ms-DNS-Propagation-Time', + 'ms-DNS-RFC5011-Key-Rollovers', + 'ms-DNS-Secure-Delegation-Polling-Period', + 'ms-DNS-Sign-With-NSEC3', + 'ms-DNS-Signature-Inception-Offset', + 'ms-DNS-Signing-Key-Descriptors', + 'ms-DNS-Signing-Keys' + ] + }, + 'RID-Manager': { + 'classes': [], + 'ldapname': 'rIDManager', + 'attributes': [ + 'RID-Available-Pool' + ] + }, + 'ms-WMI-ObjectEncoding': { + 'classes': [], + 'ldapname': 'msWMI-ObjectEncoding', + 'attributes': [ + 'ms-WMI-Class', + 'ms-WMI-Genus', + 'ms-WMI-ID', + 'ms-WMI-Parm1', + 'ms-WMI-Parm2', + 'ms-WMI-Parm3', + 'ms-WMI-Parm4', + 'ms-WMI-ScopeGuid', + 'ms-WMI-TargetObject', + 'ms-WMI-intFlags1', + 'ms-WMI-intFlags2', + 'ms-WMI-intFlags3', + 'ms-WMI-intFlags4' + ] + }, + 'account': { + 'classes': [], + 'ldapname': 'account', + 'attributes': [ + 'Description', + 'Locality-Name', + 'Organization-Name', + 'Organizational-Unit-Name', + 'See-Also', + 'host', + 'uid' + ] + }, + 'ACS-Subnet': { + 'classes': [], + 'ldapname': 'aCSSubnet', + 'attributes': [ + 'ACS-Allocable-RSVP-Bandwidth', + 'ACS-Cache-Timeout', + 'ACS-DSBM-DeadTime', + 'ACS-DSBM-Priority', + 'ACS-DSBM-Refresh', + 'ACS-Enable-ACS-Service', + 'ACS-Enable-RSVP-Accounting', + 'ACS-Enable-RSVP-Message-Logging', + 'ACS-Event-Log-Level', + 'ACS-Max-Duration-Per-Flow', + 'ACS-Max-No-Of-Account-Files', + 'ACS-Max-No-Of-Log-Files', + 'ACS-Max-Peak-Bandwidth', + 'ACS-Max-Peak-Bandwidth-Per-Flow', + 'ACS-Max-Size-Of-RSVP-Account-File', + 'ACS-Max-Size-Of-RSVP-Log-File', + 'ACS-Max-Token-Rate-Per-Flow', + 'ACS-Non-Reserved-Max-SDU-Size', + 'ACS-Non-Reserved-Min-Policed-Size', + 'ACS-Non-Reserved-Peak-Rate', + 'ACS-Non-Reserved-Token-Size', + 'ACS-Non-Reserved-Tx-Limit', + 'ACS-Non-Reserved-Tx-Size', + 'ACS-RSVP-Account-Files-Location', + 'ACS-RSVP-Log-Files-Location', + 'ACS-Server-List' + ] + }, + 'Service-Instance': { + 'classes': [], + 'ldapname': 'serviceInstance', + 'attributes': [ + 'Display-Name', + 'Service-Class-ID', + 'Service-Instance-Version', + 'Winsock-Addresses' + ] + }, + 'msSFU-30-Net-Id': { + 'classes': [], + 'ldapname': 'msSFU30NetId', + 'attributes': [ + 'msSFU-30-Key-Values', + 'msSFU-30-Name', + 'msSFU-30-Nis-Domain', + 'nisMapName' + ] + }, + 'Inter-Site-Transport-Container': { + 'classes': [], + 'ldapname': 'interSiteTransportContainer', + 'attributes': [] + }, + 'Ipsec-Policy': { + 'classes': [], + 'ldapname': 'ipsecPolicy', + 'attributes': [ + 'Ipsec-ISAKMP-Reference', + 'Ipsec-NFA-Reference' + ] + }, + 'Meeting': { + 'classes': [], + 'ldapname': 'meeting', + 'attributes': [ + 'meetingAdvertiseScope', + 'meetingApplication', + 'meetingBandwidth', + 'meetingBlob', + 'meetingContactInfo', + 'meetingDescription', + 'meetingEndTime', + 'meetingID', + 'meetingIP', + 'meetingIsEncrypted', + 'meetingKeyword', + 'meetingLanguage', + 'meetingLocation', + 'meetingMaxParticipants', + 'meetingName', + 'meetingOriginator', + 'meetingOwner', + 'meetingProtocol', + 'meetingRating', + 'meetingRecurrence', + 'meetingScope', + 'meetingStartTime', + 'meetingType', + 'meetingURL' + ] + }, + 'nisMap': { + 'classes': [], + 'ldapname': 'nisMap', + 'attributes': [ + 'Common-Name', + 'Description', + 'nisMapName' + ] + } + }, + + + /** + * Knowledge for the Active Directory Schema - LDAP Mapping + * + * See http://msdn.microsoft.com/en-us/library/windows/desktop/ms680938%28v=vs.85%29.aspx + * + * Each class in LDAP has two names - an LDAP-Class-Name and a CN. This mapping converts + * from the LDAP-Class-Name to the CN. The adSchemaClasses mapping converts the other + * way. + * + * The content is generated by get-ad-classes.pl from the MSDN website + */ + adLDAPClasses: { + 'aCSPolicy': 'ACS-Policy', + 'aCSResourceLimits': 'ACS-Resource-Limits', + 'aCSSubnet': 'ACS-Subnet', + 'account': 'account', + 'addressBookContainer': 'Address-Book-Container', + 'addressTemplate': 'Address-Template', + 'applicationEntity': 'Application-Entity', + 'applicationProcess': 'Application-Process', + 'applicationSettings': 'Application-Settings', + 'applicationSiteSettings': 'Application-Site-Settings', + 'applicationVersion': 'Application-Version', + 'attributeSchema': 'Attribute-Schema', + 'bootableDevice': 'bootableDevice', + 'builtinDomain': 'Builtin-Domain', + 'cRLDistributionPoint': 'CRL-Distribution-Point', + 'categoryRegistration': 'Category-Registration', + 'certificationAuthority': 'Certification-Authority', + 'classRegistration': 'Class-Registration', + 'classSchema': 'Class-Schema', + 'classStore': 'Class-Store', + 'comConnectionPoint': 'Com-Connection-Point', + 'computer': 'Computer', + 'configuration': 'Configuration', + 'connectionPoint': 'Connection-Point', + 'contact': 'Contact', + 'container': 'Container', + 'controlAccessRight': 'Control-Access-Right', + 'country': 'Country', + 'crossRef': 'Cross-Ref', + 'crossRefContainer': 'Cross-Ref-Container', + 'dHCPClass': 'DHCP-Class', + 'dMD': 'DMD', + 'dSA': 'DSA', + 'dSUISettings': 'DS-UI-Settings', + 'device': 'Device', + 'dfsConfiguration': 'Dfs-Configuration', + 'displaySpecifier': 'Display-Specifier', + 'displayTemplate': 'Display-Template', + 'dnsNode': 'Dns-Node', + 'dnsZone': 'Dns-Zone', + 'document': 'document', + 'documentSeries': 'documentSeries', + 'domain': 'Domain', + 'domainDNS': 'Domain-DNS', + 'domainPolicy': 'Domain-Policy', + 'domainRelatedObject': 'domainRelatedObject', + 'dynamicObject': 'Dynamic-Object', + 'fTDfs': 'FT-Dfs', + 'fileLinkTracking': 'File-Link-Tracking', + 'fileLinkTrackingEntry': 'File-Link-Tracking-Entry', + 'foreignSecurityPrincipal': 'Foreign-Security-Principal', + 'friendlyCountry': 'friendlyCountry', + 'group': 'Group', + 'groupOfNames': 'Group-Of-Names', + 'groupOfUniqueNames': 'groupOfUniqueNames', + 'groupPolicyContainer': 'Group-Policy-Container', + 'ieee802Device': 'ieee802Device', + 'indexServerCatalog': 'Index-Server-Catalog', + 'inetOrgPerson': 'inetOrgPerson', + 'infrastructureUpdate': 'Infrastructure-Update', + 'intellimirrorGroup': 'Intellimirror-Group', + 'intellimirrorSCP': 'Intellimirror-SCP', + 'interSiteTransport': 'Inter-Site-Transport', + 'interSiteTransportContainer': 'Inter-Site-Transport-Container', + 'ipHost': 'ipHost', + 'ipNetwork': 'ipNetwork', + 'ipProtocol': 'ipProtocol', + 'ipService': 'ipService', + 'ipsecBase': 'Ipsec-Base', + 'ipsecFilter': 'Ipsec-Filter', + 'ipsecISAKMPPolicy': 'Ipsec-ISAKMP-Policy', + 'ipsecNFA': 'Ipsec-NFA', + 'ipsecNegotiationPolicy': 'Ipsec-Negotiation-Policy', + 'ipsecPolicy': 'Ipsec-Policy', + 'leaf': 'Leaf', + 'licensingSiteSettings': 'Licensing-Site-Settings', + 'linkTrackOMTEntry': 'Link-Track-OMT-Entry', + 'linkTrackObjectMoveTable': 'Link-Track-Object-Move-Table', + 'linkTrackVolEntry': 'Link-Track-Vol-Entry', + 'linkTrackVolumeTable': 'Link-Track-Volume-Table', + 'locality': 'Locality', + 'lostAndFound': 'Lost-And-Found', + 'mS-SQL-OLAPCube': 'MS-SQL-OLAPCube', + 'mS-SQL-OLAPDatabase': 'MS-SQL-OLAPDatabase', + 'mS-SQL-OLAPServer': 'MS-SQL-OLAPServer', + 'mS-SQL-SQLDatabase': 'MS-SQL-SQLDatabase', + 'mS-SQL-SQLPublication': 'MS-SQL-SQLPublication', + 'mS-SQL-SQLRepository': 'MS-SQL-SQLRepository', + 'mS-SQL-SQLServer': 'MS-SQL-SQLServer', + 'mSMQConfiguration': 'MSMQ-Configuration', + 'mSMQEnterpriseSettings': 'MSMQ-Enterprise-Settings', + 'mSMQMigratedUser': 'MSMQ-Migrated-User', + 'mSMQQueue': 'MSMQ-Queue', + 'mSMQSettings': 'MSMQ-Settings', + 'mSMQSiteLink': 'MSMQ-Site-Link', + 'mailRecipient': 'Mail-Recipient', + 'meeting': 'Meeting', + 'ms-net-ieee-80211-GroupPolicy': 'ms-net-ieee-80211-GroupPolicy', + 'ms-net-ieee-8023-GroupPolicy': 'ms-net-ieee-8023-GroupPolicy', + 'msAuthz-CentralAccessPolicies': 'ms-Authz-Central-Access-Policies', + 'msAuthz-CentralAccessPolicy': 'ms-Authz-Central-Access-Policy', + 'msAuthz-CentralAccessRule': 'ms-Authz-Central-Access-Rule', + 'msAuthz-CentralAccessRules': 'ms-Authz-Central-Access-Rules', + 'msCOM-Partition': 'ms-COM-Partition', + 'msCOM-PartitionSet': 'ms-COM-PartitionSet', + 'msDFS-DeletedLinkv2': 'ms-DFS-Deleted-Link-v2', + 'msDFS-Linkv2': 'ms-DFS-Link-v2', + 'msDFS-NamespaceAnchor': 'ms-DFS-Namespace-Anchor', + 'msDFS-Namespacev2': 'ms-DFS-Namespace-v2', + 'msDFSR-Connection': 'ms-DFSR-Connection', + 'msDFSR-Content': 'ms-DFSR-Content', + 'msDFSR-ContentSet': 'ms-DFSR-ContentSet', + 'msDFSR-GlobalSettings': 'ms-DFSR-GlobalSettings', + 'msDFSR-LocalSettings': 'ms-DFSR-LocalSettings', + 'msDFSR-Member': 'ms-DFSR-Member', + 'msDFSR-ReplicationGroup': 'ms-DFSR-ReplicationGroup', + 'msDFSR-Subscriber': 'ms-DFSR-Subscriber', + 'msDFSR-Subscription': 'ms-DFSR-Subscription', + 'msDFSR-Topology': 'ms-DFSR-Topology', + 'msDNS-ServerSettings': 'ms-DNS-Server-Settings', + 'msDS-App-Configuration': 'ms-DS-App-Configuration', + 'msDS-AppData': 'ms-DS-App-Data', + 'msDS-AzAdminManager': 'ms-DS-Az-Admin-Manager', + 'msDS-AzApplication': 'ms-DS-Az-Application', + 'msDS-AzOperation': 'ms-DS-Az-Operation', + 'msDS-AzRole': 'ms-DS-Az-Role', + 'msDS-AzScope': 'ms-DS-Az-Scope', + 'msDS-AzTask': 'ms-DS-Az-Task', + 'msDS-BindProxy': 'ms-DS-Bind-Proxy', + 'msDS-BindableObject': 'ms-DS-Bindable-Object', + 'msDS-ClaimType': 'ms-DS-Claim-Type', + 'msDS-ClaimTypePropertyBase': 'ms-DS-Claim-Type-Property-Base', + 'msDS-ClaimTypes': 'ms-DS-Claim-Types', + 'msDS-ClaimsTransformationPolicies': 'ms-DS-Claims-Transformation-Policies', + 'msDS-ClaimsTransformationPolicyType': 'ms-DS-Claims-Transformation-Policy-Type', + 'msDS-GroupManagedServiceAccount': 'ms-DS-Group-Managed-Service-Account', + 'msDS-ManagedServiceAccount': 'ms-DS-Managed-Service-Account', + 'msDS-OptionalFeature': 'ms-DS-Optional-Feature', + 'msDS-PasswordSettings': 'ms-DS-Password-Settings', + 'msDS-PasswordSettingsContainer': 'ms-DS-Password-Settings-Container', + 'msDS-QuotaContainer': 'ms-DS-Quota-Container', + 'msDS-QuotaControl': 'ms-DS-Quota-Control', + 'msDS-ResourceProperties': 'ms-DS-Resource-Properties', + 'msDS-ResourceProperty': 'ms-DS-Resource-Property', + 'msDS-ResourcePropertyList': 'ms-DS-Resource-Property-List', + 'msDS-ServiceConnectionPointPublicationService': 'ms-DS-Service-Connection-Point-Publication-Service', + 'msDS-ValueType': 'ms-DS-Value-Type', + 'msExchConfigurationContainer': 'ms-Exch-Configuration-Container', + 'msFVE-RecoveryInformation': 'ms-FVE-RecoveryInformation', + 'msImaging-PSPs': 'ms-Imaging-PSPs', + 'msImaging-PostScanProcess': 'ms-Imaging-PostScanProcess', + 'msKds-ProvRootKey': 'ms-Kds-Prov-RootKey', + 'msKds-ProvServerConfiguration': 'ms-Kds-Prov-ServerConfiguration', + 'msMQ-Custom-Recipient': 'MSMQ-Custom-Recipient', + 'msMQ-Group': 'MSMQ-Group', + 'msPKI-Enterprise-Oid': 'ms-PKI-Enterprise-Oid', + 'msPKI-Key-Recovery-Agent': 'ms-PKI-Key-Recovery-Agent', + 'msPKI-PrivateKeyRecoveryAgent': 'ms-PKI-Private-Key-Recovery-Agent', + 'msPrint-ConnectionPolicy': 'ms-Print-ConnectionPolicy', + 'msSFU30DomainInfo': 'msSFU-30-Domain-Info', + 'msSFU30MailAliases': 'msSFU-30-Mail-Aliases', + 'msSFU30NISMapConfig': 'msSFU-30-NIS-Map-Config', + 'msSFU30NetId': 'msSFU-30-Net-Id', + 'msSFU30NetworkUser': 'msSFU-30-Network-User', + 'msSPP-ActivationObject': 'ms-SPP-Activation-Object', + 'msSPP-ActivationObjectsContainer': 'ms-SPP-Activation-Objects-Container', + 'msTAPI-RtConference': 'ms-TAPI-Rt-Conference', + 'msTAPI-RtPerson': 'ms-TAPI-Rt-Person', + 'msTPM-InformationObject': 'ms-TPM-Information-Object', + 'msTPM-InformationObjectsContainer': 'ms-TPM-Information-Objects-Container', + 'msWMI-IntRangeParam': 'ms-WMI-IntRangeParam', + 'msWMI-IntSetParam': 'ms-WMI-IntSetParam', + 'msWMI-MergeablePolicyTemplate': 'ms-WMI-MergeablePolicyTemplate', + 'msWMI-ObjectEncoding': 'ms-WMI-ObjectEncoding', + 'msWMI-PolicyTemplate': 'ms-WMI-PolicyTemplate', + 'msWMI-PolicyType': 'ms-WMI-PolicyType', + 'msWMI-RangeParam': 'ms-WMI-RangeParam', + 'msWMI-RealRangeParam': 'ms-WMI-RealRangeParam', + 'msWMI-Rule': 'ms-WMI-Rule', + 'msWMI-ShadowObject': 'ms-WMI-ShadowObject', + 'msWMI-SimplePolicyTemplate': 'ms-WMI-SimplePolicyTemplate', + 'msWMI-Som': 'ms-WMI-Som', + 'msWMI-StringSetParam': 'ms-WMI-StringSetParam', + 'msWMI-UintRangeParam': 'ms-WMI-UintRangeParam', + 'msWMI-UintSetParam': 'ms-WMI-UintSetParam', + 'msWMI-UnknownRangeParam': 'ms-WMI-UnknownRangeParam', + 'msWMI-WMIGPO': 'ms-WMI-WMIGPO', + 'msieee80211-Policy': 'ms-ieee-80211-Policy', + 'nTDSConnection': 'NTDS-Connection', + 'nTDSDSA': 'NTDS-DSA', + 'nTDSDSARO': 'NTDS-DSA-RO', + 'nTDSService': 'NTDS-Service', + 'nTDSSiteSettings': 'NTDS-Site-Settings', + 'nTFRSMember': 'NTFRS-Member', + 'nTFRSReplicaSet': 'NTFRS-Replica-Set', + 'nTFRSSettings': 'NTFRS-Settings', + 'nTFRSSubscriber': 'NTFRS-Subscriber', + 'nTFRSSubscriptions': 'NTFRS-Subscriptions', + 'nisMap': 'nisMap', + 'nisNetgroup': 'nisNetgroup', + 'nisObject': 'nisObject', + 'oncRpc': 'oncRpc', + 'organization': 'Organization', + 'organizationalPerson': 'Organizational-Person', + 'organizationalRole': 'Organizational-Role', + 'organizationalUnit': 'Organizational-Unit', + 'pKICertificateTemplate': 'PKI-Certificate-Template', + 'pKIEnrollmentService': 'PKI-Enrollment-Service', + 'packageRegistration': 'Package-Registration', + 'person': 'Person', + 'physicalLocation': 'Physical-Location', + 'posixAccount': 'posixAccount', + 'posixGroup': 'posixGroup', + 'printQueue': 'Print-Queue', + 'queryPolicy': 'Query-Policy', + 'rFC822LocalPart': 'rFC822LocalPart', + 'rIDManager': 'RID-Manager', + 'rIDSet': 'RID-Set', + 'rRASAdministrationConnectionPoint': 'RRAS-Administration-Connection-Point', + 'rRASAdministrationDictionary': 'RRAS-Administration-Dictionary', + 'remoteMailRecipient': 'Remote-Mail-Recipient', + 'remoteStorageServicePoint': 'Remote-Storage-Service-Point', + 'residentialPerson': 'Residential-Person', + 'room': 'room', + 'rpcContainer': 'Rpc-Container', + 'rpcEntry': 'rpc-Entry', + 'rpcGroup': 'rpc-Group', + 'rpcProfile': 'rpc-Profile', + 'rpcProfileElement': 'rpc-Profile-Element', + 'rpcServer': 'rpc-Server', + 'rpcServerElement': 'rpc-Server-Element', + 'samDomain': 'Sam-Domain', + 'samDomainBase': 'Sam-Domain-Base', + 'samServer': 'Sam-Server', + 'secret': 'Secret', + 'securityObject': 'Security-Object', + 'securityPrincipal': 'Security-Principal', + 'server': 'Server', + 'serversContainer': 'Servers-Container', + 'serviceAdministrationPoint': 'Service-Administration-Point', + 'serviceClass': 'Service-Class', + 'serviceConnectionPoint': 'Service-Connection-Point', + 'serviceInstance': 'Service-Instance', + 'shadowAccount': 'shadowAccount', + 'simpleSecurityObject': 'simpleSecurityObject', + 'site': 'Site', + 'siteLink': 'Site-Link', + 'siteLinkBridge': 'Site-Link-Bridge', + 'sitesContainer': 'Sites-Container', + 'storage': 'Storage', + 'subSchema': 'SubSchema', + 'subnet': 'Subnet', + 'subnetContainer': 'Subnet-Container', + 'top': 'Top', + 'trustedDomain': 'Trusted-Domain', + 'typeLibrary': 'Type-Library', + 'user': 'User', + 'volume': 'Volume' + } + + + }); + return LDAPRecordView; +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/contrib/text.js b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/contrib/text.js new file mode 100644 index 00000000..a7fb5a6e --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/contrib/text.js @@ -0,0 +1,385 @@ +/** + * @license RequireJS text 2.0.10 Copyright (c) 2010-2012, The Dojo Foundation All Rights Reserved. + * Available via the MIT or new BSD license. + * see: http://github.com/requirejs/text for details + */ +/*jslint regexp: true */ +/*global require, XMLHttpRequest, ActiveXObject, + define, window, process, Packages, + java, location, Components, FileUtils */ + +define(['module'], function (module) { + 'use strict'; + + var text, fs, Cc, Ci, xpcIsWindows, + progIds = ['Msxml2.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.4.0'], + xmlRegExp = /^\s*<\?xml(\s)+version=[\'\"](\d)*.(\d)*[\'\"](\s)*\?>/im, + bodyRegExp = /]*>\s*([\s\S]+)\s*<\/body>/im, + hasLocation = typeof location !== 'undefined' && location.href, + defaultProtocol = hasLocation && location.protocol && location.protocol.replace(/\:/, ''), + defaultHostName = hasLocation && location.hostname, + defaultPort = hasLocation && (location.port || undefined), + buildMap = {}, + masterConfig = (module.config && module.config()) || {}; + + text = { + version: '2.0.10', + + strip: function (content) { + //Strips declarations so that external SVG and XML + //documents can be added to a document without worry. Also, if the string + //is an HTML document, only the part inside the body tag is returned. + if (content) { + content = content.replace(xmlRegExp, ""); + var matches = content.match(bodyRegExp); + if (matches) { + content = matches[1]; + } + } else { + content = ""; + } + return content; + }, + + jsEscape: function (content) { + return content.replace(/(['\\])/g, '\\$1') + .replace(/[\f]/g, "\\f") + .replace(/[\b]/g, "\\b") + .replace(/[\n]/g, "\\n") + .replace(/[\t]/g, "\\t") + .replace(/[\r]/g, "\\r") + .replace(/[\u2028]/g, "\\u2028") + .replace(/[\u2029]/g, "\\u2029"); + }, + + createXhr: masterConfig.createXhr || function () { + var xhr, i, progId; + if (typeof XMLHttpRequest !== "undefined") { + return new XMLHttpRequest(); + } else if (typeof ActiveXObject !== "undefined") { + for (i = 0; i < 3; i += 1) { + progId = progIds[i]; + try { + xhr = new ActiveXObject(progId); + } catch (e) {} + + if (xhr) { + progIds = [progId]; // so faster next time + break; + } + } + } + + return xhr; + }, + + /** + * Parses a resource name into its component parts. Resource names + * look like: module/name.ext!strip, where the !strip part is + * optional. + * @param {String} name the resource name + * @returns {Object} with properties "moduleName", "ext" and "strip" + * where strip is a boolean. + */ + parseName: function (name) { + var modName, ext, temp, + strip = false, + index = name.indexOf("."), + isRelative = name.indexOf('./') === 0 || + name.indexOf('../') === 0; + + if (index !== -1 && (!isRelative || index > 1)) { + modName = name.substring(0, index); + ext = name.substring(index + 1, name.length); + } else { + modName = name; + } + + temp = ext || modName; + index = temp.indexOf("!"); + if (index !== -1) { + //Pull off the strip arg. + strip = temp.substring(index + 1) === "strip"; + temp = temp.substring(0, index); + if (ext) { + ext = temp; + } else { + modName = temp; + } + } + + return { + moduleName: modName, + ext: ext, + strip: strip + }; + }, + + xdRegExp: /^((\w+)\:)?\/\/([^\/\\]+)/, + + /** + * Is an URL on another domain. Only works for browser use, returns + * false in non-browser environments. Only used to know if an + * optimized .js version of a text resource should be loaded + * instead. + * @param {String} url + * @returns Boolean + */ + useXhr: function (url, protocol, hostname, port) { + var uProtocol, uHostName, uPort, + match = text.xdRegExp.exec(url); + if (!match) { + return true; + } + uProtocol = match[2]; + uHostName = match[3]; + + uHostName = uHostName.split(':'); + uPort = uHostName[1]; + uHostName = uHostName[0]; + + return (!uProtocol || uProtocol === protocol) && + (!uHostName || uHostName.toLowerCase() === hostname.toLowerCase()) && + ((!uPort && !uHostName) || uPort === port); + }, + + finishLoad: function (name, strip, content, onLoad) { + content = strip ? text.strip(content) : content; + if (masterConfig.isBuild) { + buildMap[name] = content; + } + onLoad(content); + }, + + load: function (name, req, onLoad, config) { + //Name has format: some.module.filext!strip + //The strip part is optional. + //if strip is present, then that means only get the string contents + //inside a body tag in an HTML string. For XML/SVG content it means + //removing the declarations so the content can be inserted + //into the current doc without problems. + + // Do not bother with the work if a build and text will + // not be inlined. + if (config.isBuild && !config.inlineText) { + onLoad(); + return; + } + + masterConfig.isBuild = config.isBuild; + + var parsed = text.parseName(name), + nonStripName = parsed.moduleName + + (parsed.ext ? '.' + parsed.ext : ''), + url = req.toUrl(nonStripName), + useXhr = (masterConfig.useXhr) || + text.useXhr; + + // Do not load if it is an empty: url + if (url.indexOf('empty:') === 0) { + onLoad(); + return; + } + + //Load the text. Use XHR if possible and in a browser. + if (!hasLocation || useXhr(url, defaultProtocol, defaultHostName, defaultPort)) { + text.get(url, function (content) { + text.finishLoad(name, parsed.strip, content, onLoad); + }, function (err) { + if (onLoad.error) { + onLoad.error(err); + } + }); + } else { + //Need to fetch the resource across domains. Assume + //the resource has been optimized into a JS module. Fetch + //by the module name + extension, but do not include the + //!strip part to avoid file system issues. + req([nonStripName], function (content) { + text.finishLoad(parsed.moduleName + '.' + parsed.ext, + parsed.strip, content, onLoad); + }); + } + }, + + write: function (pluginName, moduleName, write, config) { + if (buildMap.hasOwnProperty(moduleName)) { + var content = text.jsEscape(buildMap[moduleName]); + write.asModule(pluginName + "!" + moduleName, + "define(function () { return '" + + content + + "';});\n"); + } + }, + + writeFile: function (pluginName, moduleName, req, write, config) { + var parsed = text.parseName(moduleName), + extPart = parsed.ext ? '.' + parsed.ext : '', + nonStripName = parsed.moduleName + extPart, + //Use a '.js' file name so that it indicates it is a + //script that can be loaded across domains. + fileName = req.toUrl(parsed.moduleName + extPart) + '.js'; + + //Leverage own load() method to load plugin value, but only + //write out values that do not have the strip argument, + //to avoid any potential issues with ! in file names. + text.load(nonStripName, req, function (value) { + //Use own write() method to construct full module value. + //But need to create shell that translates writeFile's + //write() to the right interface. + var textWrite = function (contents) { + return write(fileName, contents); + }; + textWrite.asModule = function (moduleName, contents) { + return write.asModule(moduleName, fileName, contents); + }; + + text.write(pluginName, nonStripName, textWrite, config); + }, config); + } + }; + + if (masterConfig.env === 'node' || (!masterConfig.env && + typeof process !== "undefined" && + process.versions && + !!process.versions.node && + !process.versions['node-webkit'])) { + //Using special require.nodeRequire, something added by r.js. + fs = require.nodeRequire('fs'); + + text.get = function (url, callback, errback) { + try { + var file = fs.readFileSync(url, 'utf8'); + //Remove BOM (Byte Mark Order) from utf8 files if it is there. + if (file.indexOf('\uFEFF') === 0) { + file = file.substring(1); + } + callback(file); + } catch (e) { + errback(e); + } + }; + } else if (masterConfig.env === 'xhr' || (!masterConfig.env && + text.createXhr())) { + text.get = function (url, callback, errback, headers) { + var xhr = text.createXhr(), header; + xhr.open('GET', url, true); + + //Allow plugins direct access to xhr headers + if (headers) { + for (header in headers) { + if (headers.hasOwnProperty(header)) { + xhr.setRequestHeader(header.toLowerCase(), headers[header]); + } + } + } + + //Allow overrides specified in config + if (masterConfig.onXhr) { + masterConfig.onXhr(xhr, url); + } + + xhr.onreadystatechange = function (evt) { + var status, err; + //Do not explicitly handle errors, those should be + //visible via console output in the browser. + if (xhr.readyState === 4) { + status = xhr.status; + if (status > 399 && status < 600) { + //An http 4xx or 5xx error. Signal an error. + err = new Error(url + ' HTTP status: ' + status); + err.xhr = xhr; + errback(err); + } else { + callback(xhr.responseText); + } + + if (masterConfig.onXhrComplete) { + masterConfig.onXhrComplete(xhr, url); + } + } + }; + xhr.send(null); + }; + } else if (masterConfig.env === 'rhino' || (!masterConfig.env && + typeof Packages !== 'undefined' && typeof java !== 'undefined')) { + //Why Java, why is this so awkward? + text.get = function (url, callback) { + var stringBuffer, line, + encoding = "utf-8", + file = new java.io.File(url), + lineSeparator = java.lang.System.getProperty("line.separator"), + input = new java.io.BufferedReader(new java.io.InputStreamReader(new java.io.FileInputStream(file), encoding)), + content = ''; + try { + stringBuffer = new java.lang.StringBuffer(); + line = input.readLine(); + + // Byte Order Mark (BOM) - The Unicode Standard, version 3.0, page 324 + // http://www.unicode.org/faq/utf_bom.html + + // Note that when we use utf-8, the BOM should appear as "EF BB BF", but it doesn't due to this bug in the JDK: + // http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4508058 + if (line && line.length() && line.charAt(0) === 0xfeff) { + // Eat the BOM, since we've already found the encoding on this file, + // and we plan to concatenating this buffer with others; the BOM should + // only appear at the top of a file. + line = line.substring(1); + } + + if (line !== null) { + stringBuffer.append(line); + } + + while ((line = input.readLine()) !== null) { + stringBuffer.append(lineSeparator); + stringBuffer.append(line); + } + //Make sure we return a JavaScript string and not a Java string. + content = String(stringBuffer.toString()); //String + } finally { + input.close(); + } + callback(content); + }; + } else if (masterConfig.env === 'xpconnect' || (!masterConfig.env && + typeof Components !== 'undefined' && Components.classes && + Components.interfaces)) { + //Avert your gaze! + Cc = Components.classes, + Ci = Components.interfaces; + Components.utils['import']('resource://gre/modules/FileUtils.jsm'); + xpcIsWindows = ('@mozilla.org/windows-registry-key;1' in Cc); + + text.get = function (url, callback) { + var inStream, convertStream, fileObj, + readData = {}; + + if (xpcIsWindows) { + url = url.replace(/\//g, '\\'); + } + + fileObj = new FileUtils.File(url); + + //XPCOM, you so crazy + try { + inStream = Cc['@mozilla.org/network/file-input-stream;1'] + .createInstance(Ci.nsIFileInputStream); + inStream.init(fileObj, 1, 0, false); + + convertStream = Cc['@mozilla.org/intl/converter-input-stream;1'] + .createInstance(Ci.nsIConverterInputStream); + convertStream.init(inStream, "utf-8", inStream.available(), + Ci.nsIConverterInputStream.DEFAULT_REPLACEMENT_CHARACTER); + + convertStream.readString(inStream.available(), readData); + convertStream.close(); + inStream.close(); + callback(readData.value); + } catch (e) { + throw new Error((fileObj && fileObj.path || '') + ': ' + e); + } + }; + } + return text; +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/custom.css b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/custom.css new file mode 100644 index 00000000..8d73fa30 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/js/ms_windows_ad_objects/custom.css @@ -0,0 +1,61 @@ +ul.windows-footer { + margin:0; +} + +ul.windows-footer li { + display:block; +} + +.clearfix { + clear:both; +} + +.lister { + float:left; + width:298px; +} + +.lister li { + word-break: break-word; +} + +.dashboard-cell.span-full { + width: 100%; +} + +.dashboard-cell.span-half { + width: 50%; +} + +/* Added for beta feedback and idea buttons */ +.dashboard-element.help, +.dashboard-element.feedback { +display: inline-block; +float: left; +width: 100% !important; +font-size: 14px; +line-height: 24px; +min-height: 150px; +} + +.dashboard-element.feedback .panel-head h1 { + padding-top: 30px; +} + +.dashboard-element.feedback a.btn { +margin-top: 8px; +} + +.dashboard-panel.feedback:after { +background-color: whiteSmoke; +border: 1px solid #CCC; +border-radius: 2px 0 2px 0; +color: #9DA0A4; +content: "Beta Testers"; +font-size: 12px; +font-weight: bold; +left: -1px; +padding: 3px 7px; +position: absolute; +top: -1px; +} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/loader_green_on_grey.gif b/deployment-apps/ms_windows_ad_objects/appserver/static/loader_green_on_grey.gif new file mode 100644 index 00000000..37f95c97 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/loader_green_on_grey.gif differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/lookup_field_lists.csv b/deployment-apps/ms_windows_ad_objects/appserver/static/lookup_field_lists.csv new file mode 100644 index 00000000..f21b6b26 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/lookup_field_lists.csv @@ -0,0 +1,70 @@ +AD_User_LDAP_list-base_in,AD_User_LDAP_list-base_out,AD_Groups_LDAP_list-base_in,AD_Groups_LDAP_list-base_out,AD_Computer_LDAP_list-base_in,AD_Computer_LDAP_list-base_out,AD_OU_LDAP_list-base_in,AD_OU_LDAP_list-base_out,AD_GroupPolicies_LDAP_list-base_in,AD_GroupPolicies_LDAP_list-base_out +cn,cn,cn,cn,cn,cn,cn,cn,cn,cn +OU,OU,OU,OU,OU,OU,dSCorePropagationData,dSCorePropagationData,dSCorePropagationData,dSCorePropagationData +accountExpires,accountExpires,adminCount,adminCount,accountExpires,accountExpires,description,description,displayName,displayName +adminCount,adminCount,dSCorePropagationData,dSCorePropagationData,badPasswordTime,badPasswordTime,displayName,displayName,distinguishedName,distinguishedName +badPasswordTime,badPasswordTime,dcName,dcName,badPwdCount,badPwdCount,distinguishedName,distinguishedName,dn,dn +badPwdCount,badPwdCount,description,description,codePage,codePage,gPLink,gPLink,flags,flags +codePage,codePage,displayName,displayName,countryCode,countryCode,gpo,gpo,guid_lookup,guid_lookup +countryCode,countryCode,distinguishedName,distinguishedName,dcName,dcName,guid_lookup,guid_lookup,gPCFileSysPath,gPCFileSysPath +dcName,dcName,groupType,groupType,dNSHostName,dNSHostName,host,host,gPCFunctionalityVersion,gPCFunctionalityVersion +dSCorePropagationData,dSCorePropagationData,groupType_Name,groupType_Name,dSCorePropagationData,dSCorePropagationData,instanceType,instanceType,gPCMachineExtensionNames,gPCMachineExtensionNames +department,department,guid_lookup,guid_lookup,description,description,isCriticalSystemObject,isCriticalSystemObject,host,host +description,description,instanceType,instanceType,displayName,displayName,isDeleted,isDeleted,instanceType,instanceType +displayName,displayName,isCriticalSystemObject,isCriticalSystemObject,distinguishedName,distinguishedName,isRecycled,isRecycled,isCriticalSystemObject,isCriticalSystemObject +distinguishedName,distinguishedName,isDeleted,isDeleted,instanceType,instanceType,lastKnownParent,lastKnownParent,name,name +givenName,givenName,isRecycled,isRecycled,isCriticalSystemObject,isCriticalSystemObject,managedBy,managedBy,objectCategory,objectCategory +guid_lookup,guid_lookup,lastKnownParent,lastKnownParent,isDeleted,isDeleted,name,name,objectClass,objectClass +initials,initials,managedBy,managedBy,isRecycled,isRecycled,objectCategory,objectCategory,objectGUID,objectGUID +instanceType,instanceType,member,member,lastKnownParent,lastKnownParent,objectClass,objectClass,showInAdvancedViewOnly,showInAdvancedViewOnly +isCriticalSystemObject,isCriticalSystemObject,memberOf,memberOf,lastLogon,lastLogon,objectGUID,objectGUID,systemFlags,systemFlags +isDeleted,isDeleted,membercount,membercount,lastLogonTimestamp,lastLogonTimestamp,ou,ou,uSNChanged,uSNChanged +isRecycled,isRecycled,name,name,localPolicyFlags,localPolicyFlags,revision,revision,uSNCreated,uSNCreated +lastKnownParent,lastKnownParent,objectCategory,objectCategory,logonCount,logonCount,showInAdvancedViewOnly,showInAdvancedViewOnly,versionNumber,versionNumber +lastLogon,lastLogon,objectClass,objectClass,managedBy,managedBy,systemFlags,systemFlags,whenChanged,whenChanged +lastLogonTimestamp,lastLogonTimestamp,objectGUID,objectGUID,memberOf,memberOf,uSNChanged,uSNChanged,whenCreated,whenCreated +lockoutTime,lockoutTime,objectSid,objectSid,msDFSR-ComputerReferenceBL,msDFSR-ComputerReferenceBL,uSNCreated,uSNCreated,lastKnownParent,lastKnownParent +logonCount,logonCount,primaryGroupToken,primaryGroupToken,msDS-SupportedEncryptionTypes,msDS-SupportedEncryptionTypes,versionNumber,versionNumber,isRecycled,isRecycled +logonHours,logonHours,sAMAccountName,sAMAccountName,name,name,whenChanged,whenChanged,isDeleted,isDeleted +managedBy,managedBy,sAMAccountType,sAMAccountType,objectCategory,objectCategory,whenCreated,whenCreated,DomainDNSName,DomainDNSName +memberOf,memberOf,sid_lookup,sid_lookup,objectClass,objectClass,st,st,deletedDate,deletedDate +msDS-SupportedEncryptionTypes,msDS-SupportedEncryptionTypes,systemFlags,systemFlags,objectGUID,objectGUID,l,l,last_evt_flg,domain +name,name,uSNChanged,uSNChanged,objectSid,objectSid,c,c,lc,last_evt_flg +objectCategory,objectCategory,uSNCreated,uSNCreated,operatingSystem,operatingSystem,DomainDNSName,DomainDNSName,,lc +objectClass,objectClass,whenChanged,whenChanged,operatingSystemServicePack,operatingSystemServicePack,deletedDate,deletedDate,,src_nt_domain +objectGUID,objectGUID,whenCreated,whenCreated,operatingSystemVersion,operatingSystemVersion,dn,dn,, +objectSid,objectSid,st,st,primaryGroupID,primaryGroupID,dn_path,dn_path,, +physicalDeliveryOfficeName,physicalDeliveryOfficeName,l,l,pwdLastSet,pwdLastSet,last_evt_flg,domain,, +postalCode,postalCode,c,c,rIDSetReferences,rIDSetReferences,Linked_GPO,last_evt_flg,, +primaryGroupID,primaryGroupID,DomainDNSName,DomainDNSName,sAMAccountName,sAMAccountName,,Linked_GPO,, +pwdLastSet,pwdLastSet,deletedDate,deletedDate,sAMAccountType,sAMAccountType,,q_link_id,, +sAMAccountName,sAMAccountName,dn,dn,serverReferenceBL,serverReferenceBL,,src_nt_domain,, +sAMAccountType,sAMAccountType,dn_path,dn_path,servicePrincipalName,servicePrincipalName,,dn_hist_hold,, +servicePrincipalName,servicePrincipalName,last_evt_flg,domain,sid_lookup,sid_lookup,,orig_evt_dn,, +sid_lookup,sid_lookup,,last_evt_flg,uSNChanged,uSNChanged,,,, +showInAdvancedViewOnly,showInAdvancedViewOnly,,q_link_id,uSNCreated,uSNCreated,,,, +sn,sn,,src_nt_domain,userAccountControl,userAccountControl,,,, +streetAddress,streetAddress,,dn_hist_hold,whenChanged,whenChanged,,,, +title,title,,orig_evt_dn,whenCreated,whenCreated,,,, +uSNChanged,uSNChanged,,,st,st,,,, +uSNCreated,uSNCreated,,,l,l,,,, +userAccountControl,userAccountControl,,,c,c,,,, +userPrincipalName,userPrincipalName,,,DomainDNSName,DomainDNSName,,,, +userWorkstations,userWorkstations,,,deletedDate,deletedDate,,,, +whenChanged,whenChanged,,,dn,dn,,,, +whenCreated,whenCreated,,,dn_path,dn_path,,,, +st,st,,,last_evt_flg,domain,,,, +l,l,,,,last_evt_flg,,,, +c,c,,,,q_link_id,,,, +DomainDNSName,DomainDNSName,,,,src_nt_domain,,,, +deletedDate,deletedDate,,,,uac_bin_map,,,, +dn,dn,,,,uac_details,,,, +dn_path,dn_path,,,,dn_hist_hold,,,, +last_evt_flg,domain,,,,orig_evt_dn,,,, +,last_evt_flg,,,,,,,, +,q_link_id,,,,,,,, +,src_nt_domain,,,,,,,, +,uac_bin_map,,,,,,,, +,uac_details,,,,,,,, +,dn_hist_hold,,,,,,,, +,orig_evt_dn,,,,,,,, \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_audit_report.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_audit_report.js new file mode 100644 index 00000000..4bf5a683 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_audit_report.js @@ -0,0 +1,22 @@ +require.config({ + paths: { + "common": "../app/ms_windows_ad_objects/js/common", + "ms_windows_ad_objects": "../app/ms_windows_ad_objects/js/ms_windows_ad_objects", + }, +}); +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc/utils', + 'splunkjs/mvc', + "splunkjs/mvc/utils", + 'ms_windows_ad_objects/components/ms_ad_obj_ldaprecordview', + "splunkjs/mvc/searchmanager", + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, utils, mvc, utils, LDAPRecordView, SearchManager) { + var report = new LDAPRecordView({ + "id": "audit_report", + "managerid": "audit_query", + "el": $("#audit_report") + }).render(); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_changes.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_changes.css new file mode 100644 index 00000000..8b2b7bec --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_changes.css @@ -0,0 +1,29 @@ +#rw_initial_filters {border: 4px solid #e20082;} +#pan_initial_inputs-fieldset {padding: 0px 12px 0px 12px !important;} +#pan_initial_inputs .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;height:120px !important;width: 100% !important;border: 2px solid #e20082;} +#pan_res_type_input-fieldset {padding: 0px 12px 0px 12px !important;} +#pan_res_type_input .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;height:120px !important;width: 100% !important;border: 2px solid #e20082;} +#remove_input_res_field_type {width: 150px !important; height:25px;} +.sp-btn-gradient {background-image: linear-gradient(to left, #e20082, #f99d1c);background-color: transparent;border-color: #000000;color:#FFFFFF;} +.sp-btn-gradient:hover,.sp-btn-gradient:active,.sp-btn-gradient:focus{color:#e20082;background-color:transparent;border-color:#e20082;background-image: linear-gradient(to left, #FFFFFF, #FFFFFF)} +#result_details_tbl_list {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_list {border: 4px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;min-height:600px !important;} +#result_details_pan_list .dashboard-panel h2.panel-title {font-weight: bold !important;} +#result_details_msg_time {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_msg_chg {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_dd {width:48.5% !important;border: 4px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_dd .dashboard-panel h2.panel-title {font-weight: bold !important;} +#result_details_tbl_dd {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;width:99%;max-height: 500px !important;overflow: scroll;} +#result_details_msg_dd {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_admon_dd {width:48.5% !important;border: 4px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;min-height:600px !important;} +#result_details_pan_admon_dd .dashboard-panel h2.panel-title {font-weight: bold !important;} +#result_details_tbl_admon_dd {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;width:99%;max-height: 500px !important;overflow: scroll;} +#result_details_msg_admon_dd {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_tbl_active {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;width:99%;} +#result_details_tbl_pwd_old {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;width:99%;} +#result_details_row {min-height: 500px !important;padding-top: 5px;} +#input_res_field_type {text-align: center !important;vertical-align: middle !important;width: 350px !important;line-height:5px !important;height: 60px !important;margin: 0 0 0 15px !important;padding: 0 0 0 15px !important;} +#input_res_field_type label {margin: 0 0 0 0 !important;padding: 0 0 0 0 !important;} +#input_res_field_type div {margin-left: 2px;margin-right: 2px;text-overflow: ellipsis;overflow: hidden;width: 80px !important;text-align: center !important;font-size: 10px !important;display:inline !important;} +#input_res_field_type div div div div {-webkit-box-shadow: 0 3px 7px rgba(0, 0, 4, 0.3);box-shadow: 0 3px 7px rgba(0, 0, 4, 0.3);left: 2px;right: 2px;padding-right: 4px;padding-left: 4px;} +#input_res_field_type button {padding-top: 12px !important;margin-top: 3px!important;top: 5px!important;right: 2px!important;} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_config_h.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_config_h.js new file mode 100644 index 00000000..494e962e --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_config_h.js @@ -0,0 +1,208 @@ +require(["jquery", + "splunkjs/mvc", + "splunkjs/mvc/searchmanager", + "splunkjs/mvc/postprocessmanager", + "splunkjs/mvc/simplexml/ready!"], + function($, mvc,SearchManager,PostProcessManager) { + var defaultTokenModel = mvc.Components.get("default"); + var submitTokenModel = mvc.Components.get("submitted"); + var envTokenModel = mvc.Components.get('env'); + var start_today = new Date(); + var sub_mac_chk_res = new PostProcessManager({ + id: 'sub_mac_chk_res', + managerid: "bs_mac_chk_res", + search: "| table all_mac_st,h_all_msg,h_table,h_nt_list", + //cache: true, + preview: true, + //autostart: true, + }); + var base_admon_check_srch = splunkjs.mvc.Components.get("base_admon_check"); + base_admon_check_srch.on('search:progress', function(properties) { + // Print just the event count from the search job + $(".run_spin_sync_chk").removeClass("hidden") + }); + base_admon_check_srch.on('search:done', function(properties) { + // Print the search job properties + $(".run_spin_sync_chk").addClass("hidden") + }); + var base_dom_hlth_check_srch = splunkjs.mvc.Components.get("domain_health_check"); + base_dom_hlth_check_srch.on('search:progress', function(properties) { + // Print just the event count from the search job + $(".run_spin_dom_health_chk").removeClass("hidden") + var dom_lkp_st = defaultTokenModel.get("tok_chk_d_dom_lkp_cls") + if (dom_lkp_st == "chk_dm_lkp_ok"){ + defaultTokenModel.set("tok_chk_d_dom_health_msg","OK: AD_Obj_Domain Lookup Contains Data.") + } + }); + base_dom_hlth_check_srch.on('search:done', function(properties) { + $(".run_spin_dom_health_chk").addClass("hidden") + var dom_dom_hlth_lim = 1 + if (properties.content.resultCount > 0) { + var dom_dom_hlth_results = base_dom_hlth_check_srch.data("results"); + dom_dom_hlth_results.on("data", function() { + if(dom_dom_hlth_lim<2){ + dom_dom_hlth_lim = dom_dom_hlth_lim +1 + } + }); + } else { + var dom_lkp_st = defaultTokenModel.get("tok_chk_d_dom_lkp_cls") + if(dom_lkp_st === "chk_dm_lkp_ok"){ + defaultTokenModel.set("tok_chk_d_dom_health_lbl","OK: AD_Obj_Domain Lookup Contains Data.") + defaultTokenModel.set("tok_chk_d_dom_health_cls","chk_dm_health_ok") + } + } + }); + var base_dom_lkp_a_check_srch = splunkjs.mvc.Components.get("first_domain_build"); + var base_dom_lkp_b_check_srch = splunkjs.mvc.Components.get("second_domain_build"); + var base_dom_lkp_c_check_srch = splunkjs.mvc.Components.get("third_domain_build"); + var base_dom_lkp_d_check_srch = splunkjs.mvc.Components.get("fourth_domain_build"); + base_dom_lkp_a_check_srch.on('search:progress', function(properties) { + $(".run_spin_dom_chk").removeClass("hidden") + }); + base_dom_lkp_b_check_srch.on('search:progress', function(properties) { + $(".run_spin_dom_chk").removeClass("hidden") + }); + base_dom_lkp_c_check_srch.on('search:progress', function(properties) { + $(".run_spin_dom_chk").removeClass("hidden") + }); + base_dom_lkp_d_check_srch.on('search:progress', function(properties) { + $(".run_spin_dom_chk").removeClass("hidden") + }); + base_dom_lkp_a_check_srch.on('search:done', function(properties) { + var dom_lkp_a_lim = 1 + if (properties.content.resultCount > 0) { + var dom_lkp_a_results = base_dom_lkp_a_check_srch.data("results"); + dom_lkp_a_results.on("data", function() { + if(dom_lkp_a_lim<2){ + dom_lkp_a_lim = dom_lkp_a_lim +1 + $(".run_spin_dom_chk").addClass("hidden") + defaultTokenModel.set("tok_chk_d_dom_health_lbl","OK: AD_Obj_Domain Lookup Contains Data.") + defaultTokenModel.set("tok_chk_d_dom_health_cls","chk_dm_health_ok") + } + }); + } + }); + base_dom_lkp_b_check_srch.on('search:done', function(properties) { + var dom_lkp_b_lim = 1 + if (properties.content.resultCount > 0) { + var dom_lkp_b_results = base_dom_lkp_b_check_srch.data("results"); + dom_lkp_b_results.on("data", function() { + if(dom_lkp_b_lim<2){ + dom_lkp_b_lim = dom_lkp_b_lim +1 + $(".run_spin_dom_chk").addClass("hidden") + defaultTokenModel.set("tok_chk_d_dom_health_lbl","OK: AD_Obj_Domain Lookup Contains Data.") + defaultTokenModel.set("tok_chk_d_dom_health_cls","chk_dm_health_ok") + } + }); + } + }); + base_dom_lkp_c_check_srch.on('search:done', function(properties) { + var dom_lkp_c_lim = 1 + if (properties.content.resultCount > 0) { + var dom_lkp_c_results = base_dom_lkp_c_check_srch.data("results"); + dom_lkp_c_results.on("data", function() { + if(dom_lkp_c_lim<2){ + dom_lkp_c_lim = dom_lkp_c_lim +1 + $(".run_spin_dom_chk").addClass("hidden") + defaultTokenModel.set("tok_chk_d_dom_health_lbl","OK: AD_Obj_Domain Lookup Contains Data.") + defaultTokenModel.set("tok_chk_d_dom_health_cls","chk_dm_health_ok") + } + }); + } + }); + base_dom_lkp_d_check_srch.on('search:done', function(properties) { + $(".run_spin_dom_chk").addClass("hidden") + var dom_lkp_d_lim = 1 + if (properties.content.resultCount > 0) { + var dom_lkp_d_results = base_dom_lkp_d_check_srch.data("results"); + dom_lkp_d_results.on("data", function() { + if(dom_lkp_d_lim<2){ + dom_lkp_d_lim = dom_lkp_d_lim +1 + defaultTokenModel.set("tok_chk_d_dom_health_lbl","OK: AD_Obj_Domain Lookup Contains Data.") + defaultTokenModel.set("tok_chk_d_dom_health_cls","chk_dm_health_ok") + } + }); + } + }); + sub_mac_chk_res.on('search:progress', function(properties) { + // Print just the event count from the search job + $(".run_spin_mac_chk").removeClass("hidden") + }); + sub_mac_chk_res.on('search:done', function(m_properties) { + var mac_chk_srch_lim=1 + $(".run_spin_mac_chk").addClass("hidden") + if (m_properties.content.resultCount > 0) { + var sub_mac_chk_results = sub_mac_chk_res.data("results"); + sub_mac_chk_results.on("data", function() { + if(mac_chk_srch_lim<2){ + var tbl_mac_chk_vals = sub_mac_chk_results.data().rows; + mac_chk_srch_lim = mac_chk_srch_lim + 1 + var mac_all_st = tbl_mac_chk_vals[0][0] + var mac_all_msg = tbl_mac_chk_vals[0][1] + var mac_all_tbl = tbl_mac_chk_vals[0][2] + var mac_nts = tbl_mac_chk_vals[0][3] + if(mac_all_st!="a_idxs_o"){ + $(".mac_chk_summary").addClass("idxs_mac_warn") + $(".mac_chk_summary i").removeClass("ms_obj_icon_info").addClass("ms_obj_icon_critical") + $(".hdr_p_steps_core.p_task_crt_idx").removeClass("a_idxs_o") + } else { + $(".mac_chk_summary i").removeClass("ms_obj_icon_critical").addClass("ms_obj_icon_info") + $(".mac_chk_summary").removeClass("idxs_mac_warn") + $(".hdr_p_steps_core.p_task_crt_idx").addClass("a_idxs_o") + } + $(".mac_chk_h_tbl").html(mac_all_tbl) + $(".mac_chk_all_msg").html(mac_all_msg) + $(".mac_chk_nt_list").html(mac_nts) + } + }); + } + }); + function upd_trigger_tok(t_tok,t_tok_type){ + if(t_tok_type==="t"){ + var tgt_tok_vals = t_tok.split(",") + for (i=0;i"; + var strHtmlInput=' View Steps' + //Add TextBox With Specific Style + $td.append(strHtmlInput); + } + } + }); + + mvc.Components.get('tbl_btn_dd_prep').getVisualization(function(tableView) { + // Add custom cell renderer, the table will re-render automatically. + tableView.addCellRenderer(new CustomRangeRenderer()); + }); + mvc.Components.get('tbl_btn_dd_depl').getVisualization(function(tableView) { + // Add custom cell renderer, the table will re-render automatically. + tableView.addCellRenderer(new CustomRangeRenderer()); + }); + mvc.Components.get('tbl_btn_dd_compl').getVisualization(function(tableView) { + // Add custom cell renderer, the table will re-render automatically. = "-string" + tableView.addCellRenderer(new CustomRangeRenderer()); + }); + $('.dashboard-body').on('click', '[data-obj-step-type],[data-obj-step-id]', function(ms_ad_obj_step_stat) { + var target = $(ms_ad_obj_step_stat.currentTarget); + var step_t = target.data('obj-step-type') + "_step_details"; + var step_id = target.data('obj-step-id'); + let step_t_cls = '[^id=' + step_t + ']'; + let step_id_cls = '#' + step_id; + $( "[id^=" + step_t + "]").hide(); + $( "#" + step_id ).show(); + target.addClass("reviewed") + + }) +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_file_acl.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_file_acl.css new file mode 100644 index 00000000..aa3051c6 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_file_acl.css @@ -0,0 +1,33 @@ +ul.msobj-comp-list li {font-family:proxima_nova;font-size: 14px;line-height: 16.8px;list-style-image: none;list-style-position: outside;list-style-type: none;} +ul.msobj-comp-list li.msobj-comp-sub-head:first-child {padding-top: 10px;} +li.msobj-comp-sub-head {font-weight:600;} +li.msobj-comp-sub-head ul li{font-weight:200;font-family:proxima_nova;font-size: 14px;} +.splkgreen {color:#49B849;} +.splkblue {color:#00A4FD;} +.splkred {color:#DC4E41;} +.splkmagenta {color:#e20082;} +.pright {padding-right:10px;} +.felarge {font-size:26px;} +.flarge {font-size:16px;} +.fsmall {font-size:12px;} +.fesmall {font-size:8px;} +/* Panel Item Box Settings - Global */ +.left-body-box {width: 98% !important;height: 570px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;box-sizing: border-box;display: block;margin: 10px;padding: 10px;overflow:auto;} +.left-single-box {width: 98% !important;height: 620px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;box-sizing: border-box;display: block;margin: 5px;padding: 5px;position: static !important;overflow:auto;} +.right-head-box {width: 98% !important;height: 50px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;box-sizing: border-box;display: block;margin: 10px;padding: 10px;position: static !important;overflow:unset;} +.right-body-box {width: 98% !important;height: 570px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;box-sizing: border-box;display: block;margin: 10px;padding: 10px;overflow:auto;} +.right-single-box {width: 98% !important;height: 620px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;box-sizing: border-box;display: block;margin: 5px;padding: 5px;position: static !important;overflow:auto;} +.mod-head-box {width: 98% !important; height: 30px !important;box-sizing: border-box !important;box-shadow: 1px 1px 10px -1px rgb(198,211,222,1) !important;text-align: center !important;box-sizing: border-box;display: block;margin: 5px;padding: 5px;position: static !important;overflow:unset;} +.mod-body-box {width: 98% !important;min-height: 350px !important;max-height: 650px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;box-sizing: border-box;display: block;margin-bottom: 2px !important;margin-top: 2px !important;margin-left: 10px !important;padding-left: 10px !important;padding-top: 5px !important;overflow:auto;} +.mod-body-box ul {padding:2px !important;} +.modal-header {padding: 5px !important;} +.modal-body {padding: 0 10px !important;overflow:auto;} +.modal-footer {padding: 10px;} +#pan_audit_dd_input { width:20% !important;} +#pan_audit_dd_msg { width:80% !important;} +#pan_audit_dd_counts { width:80% !important;} +#pan_audit_dd_details { width:80% !important;} +#pan_audit_dd_raw { width:80% !important;} +#select_audit_dd_view div div div {display: inline-block !important; } +#input_filt_dd_path {margin: 0px 0px 10px 0px; padding: 0px 0px 10px 0px;} +#input_dd_path {margin: 0px 0px 10px 0px; padding: 0px 0px 10px 0px;} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_gbl_tabs.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_gbl_tabs.css new file mode 100644 index 00000000..77c3571a --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_gbl_tabs.css @@ -0,0 +1,44 @@ +.nav-tabs {padding: 0 5px;height: 38px;background-color: #fff;border-bottom: 1px solid #fff !important;} +#tabs a:hover,#tabs a:hover::after,#tabs a:focus,#tabs a:focus::after {background: #fff;} +#tabs a:focus {outline: 0;} +#tabs a::after {content:'';position:absolute;z-index: 1;top: 0;right: -.5em; bottom: 0;width: 1em;background: #ddd;background-image: linear-gradient(to bottom, #fff, #ddd); box-shadow: 2px 2px 2px rgba(0,0,0,.4);transform: skew(10deg);border-radius: 0 5px 0 0; } +#tabs #current.active a, +#tabs #current.active a::after {background: #fff;z-index: 3;} +#content {background: #fff;padding: 2em;height: 220px;position: relative;z-index: 2; border-radius: 0 5px 5px 5px;box-shadow: 0 -2px 3px -2px rgba(0, 0, 0, .5);} +#tabs li {float: left;margin: 0 .5em 0 0;} +.nav-tabs > li.active, .nav-tabs > li > a.active {box-shadow: none !important;border-radius: 0 !important;font-weight: 500;color: #3c444d;} +.nav-tabs > li {position: relative;} +.nav-pills > li, .nav-tabs > li {float: left;} +li {line-height: 20px;display: list-item;text-align: match-parent;} +::backdrop {-moz-top-layer: top !important;display: block;position: fixed;top: 0;left: 0;right: 0;bottom: 0;} +::cue {color: rgba(255, 255, 255, 1);white-space: pre-line;background-color: rgba(0, 0, 0, 0.8);font: var(--cue-font-size) sans-serif;} +#tabs a:focus {outline: 0;} +#tabs a:hover, #tabs a:hover::after, #tabs a:focus, #tabs a:focus::after {background: #fff;} +#tabs a {position: relative;background: #ddd;background-image: linear-gradient(to bottom, #fff, #ddd);padding: .7em 2.5em;float: left;text-decoration: none;color: #444;text-shadow: 0 1px 0 rgba(255,255,255,.8);border-radius: 5px 0 0 0;box-shadow: 0 2px 2px rgba(0,0,0,.4);} +.nav-tabs > li > a:focus {box-shadow: none;border-collapse: separate;outline: 0;text-decoration: none;box-shadow: inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;background-color: transparent;border-radius: 3px;} +.nav-tabs > li > a:hover {background: transparent;} +.nav > li > a:focus, .nav > li > a:hover {text-decoration: none;} +.nav-tabs > li > a {line-height: 20px;padding: 2px 15px;color: #5c6773;} +.nav-pills > li > a, .nav-tabs > li > a {padding-right: 15px;padding-left: 15px;margin-right: 2px;line-height: 14px;} +.nav > li > a {display: block;} +a:focus {box-shadow: 0 0 1px 2px rgba(0,164,253,.6);border-collapse: separate;outline: 0;text-decoration: none;} +a:hover {text-decoration: underline;} +a, a:hover {color: #006eaa;} +a:active, a:hover {outline: 0;} +a {text-decoration: none;cursor: pointer;} +.nav-tabs > li.active, .nav-tabs > li > a.active {font-weight: 500;color: #3c444d;} +li {line-height: 20px;} +li {text-align: match-parent;} +#tabs {list-style: none;} +.nav {list-style: none;} +ul, menu, dir {list-style-type: disc;} +center {text-align: -moz-center;} +.nav-tabs > li > a::before {content: "";position: absolute;width: calc(100% - 30px);height: 0;bottom: 0;left: 14px;background-color: #e1e6eb;transition: height .2s;} +#tabs li.active a {background-image: linear-gradient(to bottom, #BEE6BE, #ddd) !important;background-color: #F1813F ;} +#tabs #current.active a, #tabs #current.active a::after {background: #fff !important;z-index: 3 !important;} +.nav-tabs > li.active > a::before {height: 3px !important;background-color: #F1813F !important;width: 85% !important;} +#tabs li.active a::after {background-image: linear-gradient(to bottom, #BEE6BE, #ddd) !important} +#tabs li.active a::before {height: 3px;background-color: #F1813F !important;width: 85% !important;} +#tabs li::before {left: -7px;border-top-right-radius: 0px;border-width: 0px 0px 0px 0px;} +#tabs li::after {right: -7px;border-top-left-radius: 0px;border-width: 0px 0px 0px 1px;box-shadow: 0px 0px 0px #ECECEC;} +#tabs li::before, #tabs li::after {border: 0px solid #ECECEC; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px;box-shadow: -2px 0px 0 #ECECEC;position: absolute;top: -1px;width: 0px;height: 0px;content: "";} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_gs_cfg.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_gs_cfg.css new file mode 100644 index 00000000..66661765 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_gs_cfg.css @@ -0,0 +1,432 @@ + /* Panel Settings - Global */ +#pan_left .dashboard-panel {max-height:650px !important;} +.dashboard-row .dashboard-panel .dashboard-element {position: static;} +#pan_right_p_o .dashboard-panel {max-height:650px;} +#pan_n_object .panel-body.html {margin: 0px !important;padding: 0px !important;height: 650px;} +#pan_f_object .panel-body.html {margin: 0px !important;padding: 0px !important;height: 650px;} +#h_l_page .panel-body.html {margin: 0px;padding: 0px;} +#pan_single {width:100% !important;border: 3px solid #e20082;margin: -3px !important;} +#nav_part_r_0 {min-height: 650px;height:650px;border: 3px solid #e20082;margin: -3px !important;} +#nav_part_r_0 .dashboard-cell {min-height: 650px !important;height:650px !important;} +#pan_p_0_single {min-height: 650px !important;height:650px !important;} +#pan_scope_left {width:55% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_scope_right {width:45% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_bld_dm_table {width:80% !important;height: 450px !important;max-height: 450px !important;min-height: 450px !important;overflow: scroll;border: 3px solid #e20082;margin: -3px !important;} +#pan_bld_dm_table .dashboard-panel {min-height: 450px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 2px 10px 5px 5px !important;padding: 2px 10px 5px 5px !important;} +#pan_bld_dm_inp {width: 20% !important;height: 450px !important;max-height: 450px !important;min-height: 450px !important;overflow: scroll;border: 3px solid #e20082;margin: -3px !important;} +#pan_bld_dm_inp .dashboard-panel {min-height: 450px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 2px 10px 5px 5px !important;padding: 2px 10px 5px 5px !important;} +#pan_bld_dm_msg {width: 20% !important;height: 450px !important;max-height: 450px !important;min-height: 450px !important;overflow: scroll;} +#pan_bld_dm_msg .dashboard-panel {min-height: 450px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 2px 10px 5px 5px !important;padding: 2px 10px 5px 5px !important;} +#pan_bld_dm_warn {width:100% !important;height: 550px !important;max-height: 550px !important;min-height: 450px !important;overflow: scroll;;border: 3px solid #e20082;margin: -3px !important;} +#pan_bld_dm_warn .dashboard-panel {min-height: 450px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 2px 10px 5px 5px !important;padding: 2px 10px 5px 5px !important;} +#pan_p_t_single_4 {width:100% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_p_t_left_4 {width:50% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_p_t_right_4 {width:50% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_r_upd_domain {width:70% !important;} +#pan_p_left_4_1 {width:40% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_p_right_4_1 {width:60% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_p_right_4_1_a {width:100% !important;} +#pan_p_left_2,#pan_p_right_2_0,#pan_p_right_3_0,#pan_p_right_3_1 {width:50% !important;border: 3px solid #e20082;margin: -3px !important;} +#pan_p_single_4_1_a {width: 100% !important;height: 550px !important;max-height: 550px !important;min-height: 550px !important;overflow: scroll;} +#pan_p_single_4_1_a .dashboard-panel {min-height: 550px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 2px 10px 5px 5px !important;padding: 2px 10px 5px 5px !important;} +#pan_p_single_5_2_a {width: 49% !important;border: 3px solid #e20082;} +#pan_p_single_5_2_a .dashboard-panel {min-height: 550px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 2px 10px 5px 5px !important;padding: 2px 10px 5px 5px !important;} +#pan_p_single_5_2_b {width: 50% !important;border: 3px solid #e20082;} +#pan_p_single_5_2_b .dashboard-panel {min-height: 550px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 2px 10px 5px 5px !important;padding: 2px 10px 5px 5px !important;} + +/* Color Codes */ +.isDisabled {color: currentColor;cursor: not-allowed;opacity: 0.5;text-decoration: none;} +.splkgreen {color:#49B849;} +.splkblue {color:#00A4FD;} +.splkred {color:#DC4E41;} +.pright {padding-right:10px;} +.flarge {font-size:16px;} +.fsmall {font-size:12px;} +.fesmall {font-size:8px;} +.bxred {box-shadow: 0 0 5px 1x #DC4E41;background-color: #F1B9B3;} +.bxgreen {box-shadow: 0 0 5px 1x #49B849;background-color: #DDECDD;} + +/* Box Panels */ +.left-head-box {width: 98% !important;height: 50px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;display: block;margin: 10px;padding: 10px;position: static !important;overflow:unset;} +.left-body-box {width: 98% !important;height: 570px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 10px;padding: 10px;overflow:auto;} +.left-single-box {height: 640px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;display: block;position: static !important;overflow:auto;} +.right-head-box {width: 98% !important;height: 50px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;display: block;margin: 10px;padding: 10px;position: static !important;overflow:unset;} +.right-body-box {width: 98% !important;height: 570px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;display: block;margin: 10px;padding: 10px;overflow:auto;} +.right-single-box {width: 98% !important;height: 620px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;display: block;margin: 5px;padding: 5px;position: static !important;overflow:auto;} + +/* Initial Hide Elemenents */ +.hdr_p_top {display:none;} +.hdr_d_top {display:none;} +.hdr_u_top {display:none;} +.hdr_c_top {display:none;} +.hdr_p_steps_core {display:none;} +.hdr_p_steps_ds {display:none;} +.hdr_p_steps_hf {display:none;} +.hdr_p_steps_man_ta {display:none;} +.hdr_u_steps {display:none;} +.hdr_d_steps_man_ta {display:none} +.hdr_d_steps_uf {display:none;} +.cd_t_steps_details {display:none;} +.r_depl_msg {display:none;} +.p_t_steps_details {display:none;} +.d_t_steps_details {display:none;} +.u_t_steps_details {display:none;} +.p_task_ele_filt {display:none;} +.p_task_desc_dl {display:none;} +.p_task_desc_core {display:none;} +.p_task_desc_ds {display:none;} +.p_task_desc_hf {display:none;} +.p_task_man_ta {display:none;} +#i_prep_task_dl_mn {display:none;} +.p_task_steps_dl {display:none;} +.depl_steps_inst_uf {display:none;} +.depl_uf_inst_ele {display:none;} +.depl_uf_inst_etype {display:none;} +[id^=i_lbl_depl_step_] {display:none;} +[id^=i_lbl_hdr_prep_] {display:none;} +[id^=i_lbl_hdr_upg_] {display:none;} +[id^=stasklisthdr_] {display:none;} +a.build {display:none;} +.step_details {display:none;} + +/* MS AD WINDOWS OBJECTS Icons */ +.ms_obj_icon_tut_icons:before {font-size:18px;content: "\ECA5";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_info_popup {font-size:14px;padding-right:5px;color:#FFFFFF;} +.ms_obj_icon_info_popup:active:hover,.ms_obj_icon_info_popup:hover{color:#e20082;} +.ms_obj_icon_info_popup:before {content: "\EC9D";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;color:#3863a0;} +.ms_obj_icon_step_details {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_step_details:before {font-size:18px;content: "\ECA7";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_step_details:after {font-size:14px;content: ' Step Details:';} +.ms_obj_icon_steps:after {font-size:14px;content: ' Step Details:';} +.ms_obj_icon_steps {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_steps:before {font-size:18px;content: "\ECA7";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_steps:after {font-size:14px;content: ' Steps:';} +.ms_obj_icon_search {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_search:before {font-size:18px;content: "\EC9B";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_search:after {font-size:14px;content: ' Step Search:';} +.ms_obj_icon_f_search {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_f_search:before {font-size:18px;content: "\EC9B";font-family: Splunk Icons;font-style: normal;font-weight: 500;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_f_search:after {font-size:14px;content: ' Step Full Search:';} +.ms_obj_icon_info {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_info:after {font-size:14px;content: ' More Info:';} +.ms_obj_icon_info:before {font-size:18px;content: "i";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_settings {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_settings:before {font-size:18px;content: "\ECA5";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_settings:after {font-size:14px;content: ' Configure Settings:';} +.ms_obj_icon_review {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_review:before {font-size:18px;content: "\ECC0";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_review:after {font-size:14px;content: ' Review Results:';} +.ms_obj_icon_tip {padding-right:5px;color:#FFF9EB !important;} +.ms_obj_icon_tip:before {font-size:18px;content: "\EC98";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_tip:after {font-size:14px;content: ' Tip:';} +.ms_obj_icon_app {padding-right:5px;color:#e20082 !important;} +.ms_obj_icon_app:before {font-size:18px;content: "\ECA6";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_app:after {font-size:14px;content: '';} +.ms_obj_icon_input_settings {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_input_settings:before {font-size:18px;content: "\ECA5";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_input_settings:after {font-size:14px;content: ' Input Settings:';} +.ms_obj_icon_screenshot:after {font-size:14px;content: ' Screenshot:';} +.ms_obj_icon_screenshot {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_screenshot:before {font-size:18px;content: "\ECC0";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.ms_obj_icon_critical {padding-right:5px;color:#FFFFFF !important;} +.ms_obj_icon_critical:before {font-size:18px;content: "\26A0";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +.icon-warning.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:25px !important;width:25px;height: 25px;padding-left: 4px;color:#DC4E41} +.icon-error.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:25px !important;width:25px;height: 25px;padding-left: 4px;color:#f99d1c} +.icon-question-circle.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:25px !important;width:25px;height: 25px;padding-left: 4px;color:#007ABD;} +.icon-info-circle.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:25px !important;width:25px;height: 25px;padding-left: 4px;color:#007ABD;} +.icon-external {font-size:18px !important;color:#40A540;} +.img_icon_small {height: 20px !important;width: 20px !important;} +.img_icon_large {height: 30px !important;width: 30px !important;} +.ms_obj_icon_small {font-size:20px !important;height: 20px !important;width: 20px !important;} +.ms_obj_icon_esmall {font-size:12px !important;height: 12px !important;width: 12px !important;} +.ms_obj_icon_large {height: 30px !important;width: 30px !important;} +.ms_obj_img_icon_small {font-size:20px !important;height: 20px !important;width: 20px !important;} +.ms_obj_img_icon_esmall {font-size:12px !important;height: 12px !important;width: 12px !important;} +.ms_obj_img_icon_large {height: 30px !important;width: 30px !important;} + +i.chk_data.chk_dm_lkp_ok:before {content: "\2713";color: #40A540;height: 18px;font-size: 15px;height:20px;width:20px;} +i.chk_data.chk_dm_lkp_missing:before {content: "\26A0";font-family: Splunk Icons;font-style: normal;height:20px;width:20px;color:#DC4E41;} +i.chk_data.chk_dm_health_ok:before {content: "\2713";color: #40A540;height: 18px;font-size: 15px;height:20px;width:20px;} +i.chk_data.chk_dm_health_missing:before {content: "\26A0";font-family: Splunk Icons;font-style: normal;height:20px;width:20px;color:#DC4E41;} +i.chk_data.chk_admon_sync_ok:before {content: "\2713";color: #40A540;height: 18px;font-size: 15px;height:20px;width:20px;} +i.chk_data.chk_admon_sync_missing:before {content: "\26A0";font-family: Splunk Icons;font-style: normal;height:20px;width:20px;color:#DC4E41;} +b.chk_data.chk_dm_lkp_ok {color: #40A540;} +b.chk_data.chk_dm_lkp_missing {color:#DC4E41;} +b.chk_data.chk_dm_health_ok {color: #40A540;} +b.chk_data.chk_dm_health_missing{color:#DC4E41;} +b.chk_data.chk_admon_sync_ok {color: #40A540;} +b.chk_data.chk_admon_sync_missing{color:#DC4E41;} + +/* Detail View Styles */ +details {font: 12px "Open Sans", "Arial", sans-serif !important;width: 100% !important;padding-top:5px !important;padding-bottom:5px !important;margin-top:5px !important;margin-bottom:5px !important;} +details > summary {margin-bottom: 10px !important;padding: 2px 5px !important;min-width: 12em !important;background-color: rgb(230,230,230);border: none !important;box-shadow: 2px 2px 3px #000000 !important;max-width: 24em;width: 100% !important;margin-bottom: 2px;color:#000000;} +details summary.ms_obj_summary_step_details {background-color: rgba(243,112,33) !important;border-color: #000000;color:#FFFFFF !important;} +details summary.ms_obj_summary_step_search {background-color: rgba(226,0,130) !important;border-color: #000000;color:#FFFFFF !important;} +details summary.ms_obj_summary_step_review {background-color: rgb(0,112,243) !important;border-color: #000000;color:#FFFFFF;} +details summary.ms_obj_summary_step_info {background-color: rgb(2,199,169) !important;border-color: #000000;color:#FFFFFF;} +details summary.ms_obj_summary_step_f_search {background-color: rgb(152,10,236) !important;border-color: #000000;color:#FFFFFF !important;} +details summary.ms_obj_summary_step_settings {background-color: rgb(249,157,28) !important;border-color: #000000;color:#FFFFFF !important;} +details summary.ms_obj_summary_input_settings {background-color: rgb(249,157,28) !important;border-color: #000000;color:#FFFFFF !important;} +details summary.ms_obj_summary_steps {background-color: rgb(249,157,28) !important;border-color: #000000;color:#FFFFFF !important;} +details summary.ms_obj_summary_question {background-color: rgb(230,230,230) !important;border-color: #FFFFFF;color:#000000 !important;} +details summary.ms_obj_summary_question i.icon-question-circles {color:#000000 !important;} +details summary.ms_obj_summary_screenshot {background-color: rgb(0,112,243) !important;border-color: #000000;color:#FFFFFF;} +details summary.ms_obj_summary_step_critical {background-color: #f99d1c !important;border-color: #000000;color:#FFFFFF;} +details summary.ms_obj_summary_step_tip {background-color: rgb(0,112,243) !important;border-color: #000000;color:#FFFFFF;} +details summary.ms_obj_summary_step_app {background-color: rgb(0,112,243) !important;border-color: #000000;color:#FFFFFF;} + +/* Buttons */ +.sp-btn-gradient {background-image: linear-gradient(to left, #e20082, #f99d1c);background-color: transparent;border-color: #000000;color:#FFFFFF;} +.sp-btn-gradient:hover,.sp-btn-gradient:active,.sp-btn-gradient:focus{color:#e20082;background-color:transparent;border-color:#e20082;background-image: linear-gradient(to left, #FFFFFF, #FFFFFF);} +.sp-btn-gradient:hover i:before,.sp-btn-gradient:active i:before,.sp-btn-gradient:focus i:before {color:#000000;} +.sp-btn-gradient.disabled,#ms_obj_sub_step_wizard_holder a.disabled:hover,#ms_obj_sub_step_wizard_holder a.disabled:focus{text-size-adjust: 100%;font-family: Splunk Platform Sans,Proxima Nova,Roboto,Droid,Helvetica Neue,Helvetica,Arial,sans-serif;border-collapse: collapse;border-spacing: 0;box-sizing: bor +-box;border-radius: 3px;white-space: nowrap;border: solid 1px;font-weight: 500;background-color: transparent;color: #97999B;box-shadow: inset 0 -1px 0 #e1e6eb;cursor: not-allowed;text-decoration: none;text-shadow: none;transition: background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit +-box-shadow .2s,-webkit-text-decoration .2s;background-image: linear-gradient(to left, #F2F4F5, #FFFFFF);filter: none;display: inline-block;} +/* Prep - Task - Button Action */ +.hdr_tbl_d.Completed {background-color:#DFF2DF !important;} +.hdr_tbl_p.Completed {background-color:#DFF2DF !important;} +.hdr_td_p.Completed {background-color:#DFF2DF !important;} + +/* Modal Popups */ +.mod-head-box {width: 98% !important; height: 30px !important;box-sizing: border-box !important;box-shadow: 1px 1px 10px -1px rgb(198,211,222,1) !important;text-align: center !important;box-sizing: border-box;display: block;margin: 5px;padding: 5px;position: static !important;overflow:unset;} +.mod-body-box {width: 98% !important;min-height: 350px !important;max-height: 650px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;box-sizing: border-box;display: block;margin-bottom: 2px !important;margin-top: 2px !important;margin-left: 10px !important;padding-left: 10px !important;padding-top: 5px !important;overflow:auto;} +.mod-body-box ul {padding:2px !important;} +.modal-header {padding: 5px !important;} +.modal-body {padding: 0 10px !important;overflow:auto;} +.modal-footer {padding: 10px;} + +/* Modal Popups */ +.mod-head-box {width: 98% !important; height: 30px !important;box-sizing: border-box !important;box-shadow: 1px 1px 10px -1px rgb(198,211,222,1) !important;text-align: center !important;box-sizing: border-box;display: block;margin: 5px;padding: 5px;position: static !important;overflow:unset;} +.mod-body-box {width: 98% !important;min-height: 375px !important;max-height: 650px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;box-sizing: border-box;display: block;margin-bottom: 2px !important;margin-top: 2px !important;margin-left: 10px !important;padding-left: 10px !important;padding-top: 5px !important;overflow:auto;} +.mod-body-box ul {padding:2px !important;} +.modal-header {padding: 5px !important;} +.modal-body {padding: 0 10px !important;overflow:auto;} +.modal-footer {padding: 10px;} + +/* Screen Pop Up Sizing */ +[id^=prep_task_pop_ent_inst_ss] {width:34% !important;left:33% !important;min-width: 450px !important;min-height: 375px !important;max-height: 650px !important;} +[id^=prep_task_pop_ent_idx_ss] {width:34% !important;left:33% !important;min-width: 450px !important;min-height: 620px !important;max-height: 700px !important;} +[id^=prep_task_pop_inst_uf] {width:34% !important;left:33% !important;min-width: 450px !important;min-height: 620px !important;max-height: 700px !important;} +[id^=prep_task_pop_cloud_idx_ss] {width:34% !important;left:33% !important;min-width: 450px !important;min-height: 375px !important;max-height: 650px !important;} +[id^=prep_task_pop_dl_cc_ss_1] {max-width: 90%; width: 50%; height: auto; left: 25%; margin-left: 0px; max-height: 90%;} +[id^=prep_task_pop_dl_cc_istr_1] {max-width: 90%; width: 44%; height: auto; left: 28%; margin-left: 0px; max-height: 90%;} +#info_mod_info_ds_cloud_diag_pop_modal {width:34% !important;left:33% !important;min-width: 450px !important;min-height: 375px !important;max-height: 650px !important;} +[id^=gs_prep_task_input_] {width:60% !important;left:20% !important;max-height: 80% !important;} +#info_mod_intro_1_pop_modal.modal {width:40% !important;left:30% !important;} + +/* Top Step Wizard */ +#ms_obj_top_step_wizard.step-wizard .topstep-container.notcompleted .bg-svg .topiconsvg .main-start {stop-color: #FFFFFF;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.notcompleted .bg-svg .topiconsvg .main-stop {stop-color: #FFFFFF;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.notcompleted .vjitp-1{fill:none;stroke:#000000 !important;stroke-linecap:round;stroke-linejoin:round;stroke-width:25px;stroke-linecap:round;stroke-linejoin:round;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.notcompleted .vjitp-c{stroke:#000000 !important;stroke-linecap:round;stroke-linejoin:round;stroke-width:25px;stroke-linecap:round;stroke-linejoin:round;} +#test_ms_obj_top_step_wizard.step-wizard .topstep-container.active .topstep-label{box-sizing: border-box !important;box-shadow: 1px 2px 9px -1px rgb(198,211,222,1) !important;text-align: center !important;display: block;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.active {box-shadow: 4px 4px 9px 4px rgb(198 211 222) !important;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.active .topstep-label {box-sizing: border-box !important;box-shadow: 0 0 5px 1px #e20082 !important;text-align: center !important;display: block;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.completed .bg-svg .topiconsvg .main-start {stop-color: #f99d1c;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.completed .bg-svg .topiconsvg .main-stop {stop-color: #e20082;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.completed .vjitp-1{fill:none;stroke:#FFFFFF !important;stroke-linecap:round;stroke-linejoin:round;stroke-width:25px;stroke-linecap:round;stroke-linejoin:round;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.completed .vjitpf-1{fill:none;stroke:#FFFFFF !important;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.completed .vjitp-c{stroke:#000000 !important;stroke-linecap:round;stroke-linejoin:round;stroke-width:25px;stroke-linecap:round;stroke-linejoin:round;} +#ms_obj_top_step_wizard .topstep-container div.active.divider::before { content: ''; position: absolute; top: .9em; left: -2.7em; width: 2em; height: .2em; background: #e20082; z-index: 1; padding-left: 5px; margin-left: 5px;} +#ms_obj_top_step_wizard .topstep-container div.not_active.divider::before { content: ''; position: absolute; top: .9em; left: -2.7em; width: 2em; height: .2em; background: #f99d1c; z-index: 1; padding-left: 5px; margin-left: 5px; opacity: 0.4;} +#ms_obj_top_step_wizard div.box { width:100%; box-sizing: border-box; text-align: center !important; display: block; margin-left: 29%; margin-right: 29%;} +#ms_obj_top_step_wizard { box-sizing: border-box !important; box-shadow: 6px 10px 39px -1px rgb(198,211,222,1) !important; width: 100% !important; text-align: center !important; float: center !important;} +#ms_obj_top_step_wizard.step-wizard .wizard-label { font-size: 20px; float: left; line-height: 50px; padding-right: 10px;} +#ms_obj_top_step_wizard.step-wizard .topstep-container { display: inline-block; min-height: 50px; margin: auto; padding: auto; font-size: 12px; width: -moz-min-content;} +#ms_obj_top_step_wizard.step-wizard .topstep-container .topstep-label { color: #999; padding: 4px 1.25em 0; max-width: 150px; display: inline-block; text-overflow: ellipsis; overflow: hidden; width: -moz-max-content;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.active .icon { height: 17px; width: 17px; border-radius: 10px; -webkit-border-radius: 10px; border-radius: 10px; -moz-border-radius: 10px; background-color: #e20082;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.active .circle { height: 17px; width: 17px; -webkit-border-radius: 10px; border-radius: 10px; -moz-border-radius: 10px; background-color: #e20082; } +#ms_obj_top_step_wizard.step-wizard .topstep-container.last .circle { height: 16px; width: 16px; border: 3px solid #bbb; background-color: transparent;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.last .finished-icon { font-size: 16px; color: #fff; display: none;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.last.active .circle { background-color: #e20082; border-color: #e20082;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.last.active .finished-icon { display: block;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.completed .step-label { opacity: .6; filter: alpha(opacity=60); color: #e20082;} +#ms_obj_top_step_wizard.step-wizard .btn-group .nav-buttons {padding-left: 10px;vertical-align: middle; margin: auto;} +#ms_obj_top_step_wizard.step-wizard .nav-buttons .next-button { margin-left: 3px; height: 23px;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.notcompleted .topstep-label span.multicolortext {background-image: linear-gradient(to left, #999); -webkit-background-clip: text;-webkit-background-clip: text;-moz-background-clip: text; background-clip: text;color: transparent;} +#ms_obj_top_step_wizard.step-wizard .topstep-container.completed .topstep-label span.multicolortext {background-image: linear-gradient(to left, #e20082, #f99d1c);-webkit-background-clip: text;-webkit-background-clip: text;-moz-background-clip: text; background-clip: text;color: transparent;} + +/* Sub Step Wizard */ +#ms_obj_sub_step_wizard {width: 98% !important;height: 50px !important;box-sizing: border-box !important;box-shadow: 1px 1px 7px -1px rgb(198,211,222,1) !important;text-align: center !important;display: block;margin: 10px 15px 0px 10px;padding: 10px 15px 5px 10px;} +#ms_obj_sub_step_wizard .panel-body.html {padding: 0px !important;} +#ms_obj_sub_step_wizard_holder li.active {width: 2em;height: 2em;text-align: center;line-height: 2em;border-radius: 1em;background-image: linear-gradient(to left, #e20082, #f99d1c);;margin: 0 1em;display: inline-block;color: white;position: relative;} +#ms_obj_sub_step_wizard_holder li.not_active {width: 2em;height: 2em;text-align: center;line-height: 2em;border-radius: 1em;background: #f99d1c;margin: 0 1em;display: inline-block;color: white;opacity: 0.4;position: relative;} +#ms_obj_sub_step_wizard_holder li.hidden {display: none;} +#ms_obj_sub_step_wizard_holder li.active div.active::before { content: ''; position: absolute; top: .9em; left: -2.7em; width: 2em; height: .2em; background-image: linear-gradient(to left, #e20082, #f99d1c); z-index: 1; padding-left: 5px; margin-left: 5px;} +#ms_obj_sub_step_wizard_holder li.not_active div.not_active::before { content: ''; position: absolute; top: .9em; left: -2.7em; width: 2em; height: .2em; background: #f99d1c; z-index: 1; padding-left: 5px; margin-left: 5px; opacity: 0.4;} +#ms_obj_sub_step_wizard_holde div.box { width:100%; box-sizing: border-box; text-align: center !important; display: block; margin-left: 29%; margin-right: 29%;} + +/* Inputs */ +[id^=inp_ms_obj_mod_] .label::after {font-size:18px;content: "\ECA5";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} + +/* Scope Selector */ +.step_act_btn.Completed:before {content: "\2713";color: #49B849;height: 18px;font-size: 12px;padding-right: 5px;} +#link-switch-view a.webstlink.Completed.chosen {display:inline-block;background-color:#BBD9BA;border: 1px solid #000000;} +#link-switch-view a.webstlink.Completed.chosen:before {content: "\2713";color: #000000;height: 18px;font-size: 12px;padding-right: 5px;} +#link-switch-view a.webstlink.Next {display:inline-block;} +#link-switch-view a.webstlink.Pending,#link-switch-view a.webstlink.Not_Required {display:none;} +#link-switch-view .row_hdr{text-align: center !important;vertical-align: middle !important;line-height: 25px !important;height: 25px !important;box-shadow: 0px 0px 4px #222;background-image: linear-gradient(to left, #e20082, #f99d1c);background-color: transparent;border-color: #000000;color: #FFFFFF;margin: 0 0 0 5px !important;padding: 0 0 0 5px !important;} +.rowval.Pending {background-color: #BFE9FF;} +.rowval.Not_Required {background-color: #FFF9EB;} +.rowval.Completed {background-color: #DFF2DF;} +.rowval.Completed.subrow {background-color: #EEF6EE;} +.substate.Next {background-color: #FFFFFF;} +.substate.Completed {background-color: #DFF2DF;} +.rowmsg.Skip {display:none;} +.rowmsg.Complete {background-color: #DFF2DF;display:inline;} +.rowmsg.Not_Required {display:inline;background-color: #FFF9EB;} +.rowval.Skip {display:none;} +.resultpendhdr {display:inline;} +.resultpendhdr.completed {display:none;} +.tasklist {display:none;} +.tasklist.completed {display:inline;} +#tbl_task_categories {width:98%;} +#tbl_task_categories .table {padding:4px;border: 4px solid #e20082;margin: 2px;} +/*.results-table table thead { display:none !important;}*/ +.results-table table tbody tr { padding:2px;border: 1px solid #f99d1c !important;margin: 2px;} +.colquestion.Completed {background-color: #FFFFFF !important;} +.input_btn_grp {display:flex !important;} + +/* Detail Steps */ +/*.step_details.$tok_step_details_link$ {display:inline;}*/ +.view_steps.reviewed:before {content: "\2713";color: #000000;height: 18px;font-size: 12px;padding-right: 5px;} + +/* Number and Note Lists Styles */ +.tr_number {display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 10px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #f99d1c;color: #FFFFFF;margin-right: 4px;} +ol {-webkit-tap-highlight-color: rgba(0,0,0,0);font-size: 14px;line-height: 1.42857143;color: #222222;-webkit-font-smoothing: antialiased;font-family: 'proxima_nova';direction: ltr;box-sizing: border-box;list-style-image: none;margin: 0.3em 0 0 3.2em;padding: 0;overflow: visible;padding-left: 0px;list-style-position: outside;margin-left: 4em;margin-bottom: 10px;font-weight: bold;list-style-type: decimal;} +ol.nbr_list {list-style: none;counter-reset: steps;margin-left:20px !important;} +ol.nbr_list li.nbr_step {counter-increment: steps;} +ol.nbr_list li.nbr_step::before {content: counter(steps);display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 17px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #00A4FD;color: #FFFFFF;margin-right: 5px;} +ol.nbr_list ol.nbr_lista {list-style: none;counter-reset: stepsa;} +ol.nbr_list ol.nbr_lista li.nbr_stepa {counter-increment: stepsa;} +ol.nbr_list ol.nbr_lista li.nbr_stepa:before {content: counter(steps) "." counter(stepsa) " ";} +ol.nbr_list ol.nbr_lista ol.nbr_listb {list-style: none;counter-reset: stepsb;} +ol.nbr_list ol.nbr_lista ol.nbr_listb li.nbr_stepb {counter-increment: stepsb;} +ol.nbr_list ol.nbr_lista ol.nbr_listb li.nbr_stepb:before {content: counter(steps) "." counter(stepsa) "." counter(stepsb) " ";} +div.nbr_tr_list {list-style: none;counter-reset: nbr_trs_steps;margin-left: 0px !important;display: inline;text-align: center;} +div.nbr_tr_list div.nbr_tr_step {counter-increment: nbr_trs_steps;} +div.nbr_tr_list div.nbr_tr_step::before {content: counter(nbr_trs_steps);display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 14px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #00A4FD;color: #FFFFFF;} +div.nbr_str_list {list-style: none;counter-reset: nbr_strs_steps;margin-left: 0px !important;display: inline;text-align: center;} +div.nbr_str_list div.nbr_str_step {counter-increment: nbr_strs_steps;} +div.nbr_str_list div.nbr_str_step::before {content: counter(nbr_strs_steps);display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 14px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #7ECD7E;color: #FFFFFF;} +div.nbr_d_list {list-style: none;counter-reset: nbr_d_steps;padding: 0px 10px 0px 5px !important;margin-bottom: 5px !important; margin-left: 5px !important;} +div.nbr_d_list div.nbr_d_step {counter-increment: nbr_d_steps;} +div.nbr_d_list div.nbr_d_step::before {content: counter(nbr_d_steps);display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 10px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #f99d1c;color: #FFFFFF;margin-right: 4px;} +div.nbr_d_list div.nbr_d_step.mrk_important::before {content: counter(nbr_d_steps);display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 10px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #DC4E41;color: #FFFFFF;margin-right: 4px;} +div.nbr_d_list div.nbr_d_lista {list-style: none;counter-reset: nbr_d_stepsa;} +div.nbr_d_list div.nbr_d_lista div.nbr_d_stepa {counter-increment: nbr_d_stepsa;} +div.nbr_d_list div.nbr_d_lista div.nbr_d_stepa:before {content: counter(nbr_d_steps) "." counter(nbr_d_stepsa) " ";color:#f99d1c;font-weight:800;} +div.nbr_d_list div.nbr_d_lista div.nbr_d_stepa.mrk_important:before {content: counter(nbr_d_steps) "." counter(nbr_d_stepsa) " ";color:#DC4E41;font-weight:800;} +div.nbr_d_list div.nbr_d_lista div.nbr_d_listb {list-style: none;counter-reset: nbr_d_stepsb;} +div.nbr_d_list div.nbr_d_lista div.nbr_d_listb div.nbr_d_stepb {counter-increment: nbr_d_stepsb;} +div.nbr_d_list div.nbr_d_lista div.nbr_d_listb div.nbr_d_stepb:before {content: counter(nbr_d_steps) "." counter(nbr_d_stepsa) "." counter(nbr_d_stepsb) " ";} +div.nbr_d_list div.nbr_d_lista div.nbr_d_listb div.nbr_d_stepb.mrk_important:before {content: counter(nbr_d_steps) "." counter(nbr_d_stepsa) "." counter(nbr_d_stepsb) " ";color:#DC4E41;font-weight:800;} +ol.nbr_ts_list {list-style: none;counter-reset: nbr_ts_steps;padding: 0px 10px 0px 5px !important;margin-bottom: 5px !important; margin-left: 5px !important;} +ol.nbr_ts_list li.nbr_ts_step {counter-increment: nbr_ts_steps;} +ol.nbr_ts_list li.nbr_ts_step::before {content: counter(nbr_ts_steps);display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 10px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #f99d1c;color: #FFFFFF;margin-right: 4px;} +ol.nbr_ts_list li.nbr_ts_step.mrk_important::before {content: counter(nbr_ts_steps);display: inline-block;vertical-align: baseline;padding: 2px 4px 3px 4px;line-height: 10px;min-width: 10px;text-align: center;border-radius: 9px;white-space: nowrap;font-weight: normal;background: #DC4E41;color: #FFFFFF;margin-right: 4px;} +ol.nbr_ts_list ol.nbr_ts_lista {list-style: none;counter-reset: nbr_ts_stepsa;} +ol.nbr_ts_list ol.nbr_ts_lista li.nbr_ts_stepa {counter-increment: nbr_ts_stepsa;} +ol.nbr_ts_list ol.nbr_ts_lista li.nbr_ts_stepa:before {content: counter(nbr_ts_steps) "." counter(nbr_ts_stepsa) " ";} +ol.nbr_ts_list ol.nbr_ts_lista ol.nbr_ts_listb {list-style: none;counter-reset: nbr_ts_stepsb;} +ol.nbr_ts_list ol.nbr_ts_lista ol.nbr_ts_listb li.nbr_ts_stepb {counter-increment: nbr_ts_stepsb;} +ol.nbr_ts_list ol.nbr_ts_lista ol.nbr_ts_listb li.nbr_ts_stepb:before {content: counter(nbr_ts_steps) "." counter(nbr_ts_stepsa) "." counter(nbr_ts_stepsb) " ";} +ul.note_lst {list-style: none;padding-bottom:0px;margin-bottom:0px;} +ul.note_lst li.mrk_note::before {font-weight: 800;content: "📌Note:";padding-right: 5px;} +ul.note_lst li.mrk_review {padding-right:5px;color:rgb(0,112,243) !important;} +ul.note_lst li.mrk_review::before {font-size:18px;content: "\ECC0";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right: 5px;} +ul.note_lst li.mrk_important {padding-right:5px;color:#DC4E41 !important;} +ul.note_lst li.mrk_important::before {font-size:18px;content: "\26A0";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right: 5px;} +ul.note_lst li.mrk_greater {padding-right:5px;color:#40A540 !important;} +ul.note_lst li.mrk_greater::before {font-size:15px;content: "\203A";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right: 5px;} +ul.note_lst li.mrk_task_info {padding-right:5px;color:#DC4E41 !important;} +ul.note_lst li.mrk_task_info::before {font-size:18px;content: "\ECD5";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right: 5px;} +ul.note_lst li.mrk_task_list {padding-right:5px;color:#DC4E41 !important;} +ul.note_lst li.mrk_task_list::before {font-size:18px;content: "\ECA7";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right: 5px;} +ul.note_lst li.mrk_arrow_r {padding-right:5px;color:#DC4E41 !important;} +ul.note_lst li.mrk_arrow_r::before {font-size:18px;content: "\27A1";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right: 5px;} +div.li_content.mrk_d_important {padding-right:5px;color:#DC4E41 !important;} +div.li_content.mrk_d_important::before {font-size:18px;content: "\26A0";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +div.li_content.mrk_d_task_info {padding-right:5px;color:#DC4E41 !important;} +div.li_content.mrk_d_task_info::before {font-size:18px;content: "\ECD5";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +div.li_content.mrk_d_task_list {padding-right:5px;color:#DC4E41 !important;} +div.li_content.mrk_d_task_list::before {font-size:18px;content: "\ECA7";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +div.li_content.mrk_d_greater {padding-right:5px;color:#40A540 !important;} +div.li_content.mrk_d_greater::before {font-size:15px;content: "\203A";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +div.li_content.mrk_d_note::before {font-weight: 800;content: "📌Note:";padding-right: 5px;} +.li_content {-webkit-tap-highlight-color: rgba(0,0,0,0);font-size: 14px;line-height: 1.42857143;-webkit-font-smoothing: antialiased;font-family: 'proxima_nova';direction: ltr;list-style-image: none;list-style-position: outside;list-style-type: decimal;box-sizing: border-box;color: #000000 !important;font-weight: normal; display:inline !important;} +/* Hide if all indexes created and have data */ +.hdr_p_steps_core.p_task_crt_idx.a_idxs_o {display:none !important;} +/* Macro Autocheck Status Styles */ +.m_st_c.idxs_m {color:#DC4E41 !important;} +.m_st_c.idxs_nd {color:#f99d1c !important;} +.m_st_c.idxs_ok {color:#40A540 !important;} +.ma_st_c.idxs_m {color:#DC4E41 !important;} +.ma_st_c.idxs_nd {color:#f99d1c !important;} +.ma_st_c.idxs_ok {color:#40A540 !important;} +.ma_st_ci.idxs_m {color:#DC4E41 !important;} +.ma_st_ci.idxs_m:before {font-size:18px !important;content: "\26A0" !important;font-family: Splunk Icons !important;font-style: normal !important;font-weight: 400 !important;text-decoration: inherit !important;line-height: inherit !important;} +.ma_st_ci.idxs_nd {color:#f99d1c !important;} +.ma_st_ci.idxs_nd:before {font-size:18px !important;content: "\ECE2" !important;font-family: Splunk Icons !important;font-style: normal !important;font-weight: 400 !important;text-decoration: inherit !important;line-height: inherit !important;} +.ma_st_ci.idxs_ok {color:#40A540 !important;} +.ma_st_ci.idxs_nd:before {font-size:18px !important;content: "\ECD3" !important;font-family: Splunk Icons !important;font-style: normal !important;font-weight: 400 !important;text-decoration: inherit !important;line-height: inherit !important;} +.idxs_icon_ok {font-size:18px !important;padding-right:5px !important;color:#40A540 !important;} +.idxs_icon_warn {font-size:18px !important;padding-right:5px !important;color:#DC4E41 !important;} +.tblidxchk {padding:3px;border: 3px solid #e20082;padding: 2px;margin: 3px;width:98%;} +.tblidxchk_hdr_row {padding:2px;border: 2px solid #000000;padding: 2px;margin: 2px;} +.tblidxchk_hdr_row th {text-align:center;padding:2px;border: 2px solid #000000;padding: 2px;margin: 2px;} +.tblidxchk_res_row {padding:2px;margin: 2px;} +.tblidxchk_res_row td.chkmac {text-align:center;padding:2px;border: 1px solid #f99d1c;margin: 2px;} +.tblidxchk_res_row td.chkmactype {text-align:center;font-weight:500;padding:2px;border: 1px solid #f99d1c;margin: 2px;} +.tblidxchk_res_row td.chkmacother {padding:5px;border: 1px solid #f99d1c;margin: 2px;} +.mac_chk_summary.idxs_mac_warn {background-color: #DC4E41 !important;} +.ts_dom_lkp.chk_dm_lkp_ok {display:none !important;} +.ts_admon_sync.chk_admon_sync_ok {display:none !important;} +.ts_admon_sync_ok.chk_d_res_admon_y.chk_admon_sync_missing {display:none !important;} +.ts_admon_sync_ok.chk_d_res_admon_n.chk_admon_sync_ok {display:inline !important;} +.run_spin.hidden {display:none !important;} +/* AD Object Lookup Builder Styles */ +i.build {font-size: 18px !important; color:#f99d1c !important;} +i.build:before {content: "\2301";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +i.build.Pending {font-size: 18px !important; color:#00A4FD !important;} +i.build.Pending:before {content: "\231A";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +i.build.Migrating {font-size: 18px !important; color:#f99d1c !important;} +i.build.Migrating:before {content: "\21BB";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +i.build.Next {font-size: 18px !important; color:#e20082 !important;} +i.build.Next:before {content: "\2691";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +i.build.Warning {font-size: 18px !important; color:#DC4E41 !important;} +i.build.Warning:before {content: "\26A0";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +i.build.Cancelled {font-size: 18px !important; color:#DC4E41 !important;} +i.build.Cancelled:before {content: "\2297";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +i.build.Success {font-size: 18px !important; color:#49B849 !important;} +i.build.Success:before {content: "\ECD3";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;} +td.build {border: 2px solid #00A4FD;color:#00A4FD !important;} +td.build.Success {border: 2px solid #49B849;color:#49B849 !important;} +td.build.Warning {border: 2px solid #DC4E41;color:#DC4E41 !important;} +td.build.Cancelled {border: 2px solid #DC4E41;color:#DC4E41 !important;} +td.build.Migrating {border: 2px solid #f99d1c;color:#f99d1c !important;} +td.build.Next {border: 2px solid #e20082;color:#e20082 !important;} +td.build.Running {border: 2px solid #f99d1c;color:#f99d1c !important;} +tr.build {border: 3px solid #f99d1c;} +tr.build.Success {border: 3px solid #49B849;} +tr.build.Warning {border: 3px solid #DC4E41;} +tr.build.Cancelled {border: 3px solid #DC4E41;} +tr.build.Next {border: 3px solid #e20082;} + +a.build.Success {display:inline;} +a.build.Warning {display:inline;} +a.build.Cancel.Running {display: inline;border-radius: 10px !important;} +a.build.Cancel.Migrating {display: inline;border-radius: 10px !important;} +a.extsrch {display:none;} +a.extsrch.Warning {display:inline} +a[aria-disabled="true"] {color: #E1E6EB;display: inline-block; pointer-events: none;opacity: 0.5;text-decoration: none;} +div[aria-disabled="true"] {color: #E1E6EB;display: inline-block;pointer-events: none;opacity: 0.5;text-decoration: none;} +[id^=upd_dm_] label {color: #f99d1c} +[id^=upd_dm_] label::before {color: #f99d1c;font-size: 18px;content: "\2610";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right:10px !important;} +[id^=upd_dm_] label.di_completed {color: #40A540;} +[id^=upd_dm_] label.di_completed::before {color: #40A540;font-size: 18px;content: "\2611";font-family: Splunk Icons;font-style: normal;font-weight: 400;text-decoration: inherit;line-height: inherit;padding-right:10px !important;} +#upd_dm_host::after {content: 'EX: DCPROD01';font-style: italic !important;font-size: 10px !important;color:#818D99 !important;display: inline-block;width: 100%;text-align:center !important;} +#upd_dm_forest::after {content: 'EX: acme.com';font-style: italic !important;font-size: 10px !important;color:#818D99 !important;display: inline-block;width: 100%;text-align:center !important;} +#upd_dm_site::after {content: 'EX: Default-First-Site-Name';font-style: italic !important;font-size: 10px !important;color:#818D99 !important;display: inline-block;width: 100%;text-align:center !important;} +#upd_dm_dns::after {content: 'EX: production.acme.com';font-style: italic !important;font-size: 10px !important;color:#818D99 !important;display: inline-block;width: 100%;text-align:center !important;} +#upd_dm_netbios::after {content: 'EX: PRODUCTION';font-style: italic !important;font-size: 10px !important;color:#818D99 !important;display: inline-block;width: 100%;text-align:center !important;} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_html_token_setter.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_html_token_setter.js new file mode 100644 index 00000000..2ec20aaf --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_html_token_setter.js @@ -0,0 +1,46 @@ +require(['jquery', 'underscore', 'splunkjs/mvc', 'util/console', + "splunkjs/mvc/simplexml/ready!"], function($, _, mvc, console) { + function setToken(name, value) { + var defaultTokenModel = mvc.Components.get('default'); + if (defaultTokenModel) { + defaultTokenModel.set(name, value); + } + var submittedTokenModel = mvc.Components.get('submitted'); + if (submittedTokenModel) { + submittedTokenModel.set(name, value); + } + } + $('.dashboard-body').on('click', '[data-set-token],[data-unset-token],[data-token-json]', function(e) { + e.preventDefault(); + var target = $(e.currentTarget); + var setTokenName = target.data('set-token'); + if (setTokenName) { + setToken(setTokenName, target.data('value')); + } + var unsetTokenName = target.data('unset-token'); + if (unsetTokenName) { + setToken(unsetTokenName, undefined); + } + var tokenJson = target.data('token-json'); + if (tokenJson) { + try { + if (_.isObject(tokenJson)) { + _(tokenJson).each(function(value, key) { + if (value == null ) { + // Unset the token + setToken(key, undefined); + } else if (value =='undefined') { + setToken(key, undefined); + } else { + setToken(key, value); + } + }); + } + } catch (e) { + console.warn('Cannot parse token JSON: ', e); + } + } + }); +}); + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_input_status.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_input_status.js new file mode 100644 index 00000000..8f10adb8 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_input_status.js @@ -0,0 +1,99 @@ +require([ + "jquery", + "underscore", + 'backbone', + "splunkjs/mvc", + "splunkjs/mvc/textinputview", + "splunkjs/mvc/searchmanager", + "splunkjs/mvc/simplexml/ready!" +], function( + $, + _, + Backbone, + mvc, + SearchManager +) { + var defaultTokens = mvc.Components.get('default'); + var submittedTokens = mvc.Components.get('submitted'); + + $("[id^=upd_dm_host]") + .find("input") + .on("change", function() { + if($(this).val()===""){ + defaultTokens.unset("tok_upd_dm_host") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_host]").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_host]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_forest]") + .find("input") + .on("change", function() { + if($(this).val()===""){ + defaultTokens.unset("tok_upd_dm_forest") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_forest]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_forest]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_site]") + .find("input") + .on("change", function() { + if($(this).val()===""){ + defaultTokens.unset("tok_upd_dm_site") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_site]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_site]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_dns]") + .find("input") + .on("change", function() { + if($(this).val()===""){ + defaultTokens.unset("tok_upd_dm_dns") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_dns]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_dns]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_netbios]") + .find("input") + .on("change", function() { + if($(this).val()===""){ + defaultTokens.unset("tok_upd_dm_netbios") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_netbios]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_netbios]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + function check_d_btn(){ + var d_host=$("[id^=upd_dm_host]").find("input").val(); + var d_dns=$("[id^=upd_dm_dns]").find("input").val(); + var d_netbios=$("[id^=upd_dm_netbios]").find("input").val(); + var d_forest=$("[id^=upd_dm_forest]").find("input").val(); + var d_site=$("[id^=upd_dm_site]").find("input").val(); + if (d_host==="" || d_dns==="" || d_netbios==="" || d_forest==="" || d_site==="" ) { + $('#btn_upd_domaina').attr("aria-disabled","true"); + defaultTokens.set("tok_dm_btn", "true") + } else { + $('#btn_upd_domaina').attr("aria-disabled","false"); + defaultTokens.set("tok_dm_btn", "false") + } + } + check_d_btn() +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_lkp_v.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_lkp_v.js new file mode 100644 index 00000000..dfd76fc5 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_lkp_v.js @@ -0,0 +1,107 @@ +require(["jquery", + "splunkjs/mvc", + "splunkjs/mvc/simplexml/ready!"], + function($, mvc) { + var defaultTokenModel = mvc.Components.get("default"); + var submitTokenModel = mvc.Components.get("submitted"); + function setToken(name, value) { + var defaultTokenModel = mvc.Components.get('default'); + if (defaultTokenModel) { + defaultTokenModel.set(name, value); + } + var submittedTokenModel = mvc.Components.get('submitted'); + if (submittedTokenModel) { + submittedTokenModel.set(name, value); + } + } + defaultTokenModel.on("change:tok_filt_type", function(model, tok_filt_type, options) { + var f_type=defaultTokenModel.get("tok_filt_type"); + if(f_type==="by_fld"){ + $("#input_obj_filt,#input_obj_list,#input_obj_byp").addClass("hidden"); + setToken("tok_trg_check",undefined) + setToken("tok_srch_trg_bs_fld",undefined) + setToken("tok_srch_fmt_fld_cnt",undefined) + setToken("tok_srch_trg_filt_fld_val",undefined) + setToken("tok_tgr_sub_obj_list",undefined) + setToken("form.inp_obj_filt",undefined) + setToken("inp_obj_filt",undefined) + setToken("form.inp_fld_filt",undefined) + setToken("inp_fld_filt",undefined) + setToken("form.inp_tok_obj","sel") + setToken("inp_tok_obj","sel") + setToken("tok_sel_obj",undefined) + setToken("tok_sel_obj_lbl",undefined) + setToken("tokshowfldfilt",undefined) + setToken("tokshowfldbyp",undefined) + setToken("tokshowfldvallist",undefined) + setToken("tokshowobjfilt",undefined) + setToken("tokshowobjlist",undefined) + setToken("tokshowobjbyp",undefined) + setToken("tokshowresobj",undefined) + setToken("tokshowtabs",undefined) + setToken("tok_sel_fld_lbl",undefined) + setToken("tok_bypass_obj",undefined) + setToken("tok_bypass_fld",undefined) + setToken("tokshowresseltbl",undefined) + setToken("tokshowresselmsg","True") + setToken("tokshowresdettbl",undefined) + setToken("tokshowresdetmsg","True") + setToken("tokshowresfld","True") + setToken("form.inp_tok_sel_fld","sel") + setToken("inp_tok_sel_fld","sel") + setToken("tok_message_color","green") + setToken("tok_message_state","3.") + setToken("tok_message","Select the Lookup Field to use for the Filter.") + setToken("tok_obj_filt_lbl","") + setToken("tok_obj_list_msg","") + setToken("tok_obj_list_label_msg","") + setToken("tokshowfldlist","yes") + setToken("tok_tab_1_label","Base Object List (Pending)") + setToken("tok_obj_type_lbl","") + $("#input_obj_filt,#input_obj_list,#input_obj_byp,#input_fld_filt,#input_fld_val_list,#input_fld_byp").addClass("hidden"); + $("#input_fld_list").removeClass("hidden"); + } else { + setToken("tok_trg_check",undefined) + setToken("tok_srch_trg_bs_fld",undefined) + setToken("tok_srch_fmt_fld_cnt",undefined) + setToken("tok_srch_trg_filt_fld_val",undefined) + setToken("tok_tgr_sub_obj_list",undefined) + setToken("form.inp_obj_filt",undefined) + setToken("inp_obj_filt",undefined) + setToken("form.inp_tok_obj","sel") + setToken("inp_tok_obj","sel") + setToken("tok_sel_obj",undefined) + setToken("tok_sel_obj_lbl",undefined) + setToken("tokshowresfld",undefined) + setToken("tokshowfldlist",undefined) + setToken("tokshowfldvallist",undefined) + setToken("tokshowfldfilt",undefined) + setToken("tokshowfldlistbyp",undefined) + setToken("tokshowobjlist",undefined) + setToken("tok_bypass_obj",undefined) + setToken("tokshowobjbyp",undefined) + setToken("tokshowtabs",undefined) + setToken("tokshowresseltbl",undefined) + setToken("tokshowresselmsg","True") + setToken("tokshowresdettbl",undefined) + setToken("tokshowresdetmsg","True") + setToken("tokshowresobj","True") + setToken("tokshowobjfilt","True") + setToken("tok_sel_srch_filt_fld","") + setToken("tok_obj_filter_nmb","3") + setToken("tok_obj_bypass_nmb","4") + setToken("tok_obj_type_lbl","User") + setToken("tok_obj_filt_lbl","Enter a Filter for the Object's cn,sAMAccountName,dNSHostName or userPrincipal Name.") + setToken("tok_obj_list_msg","Enter a Filter for the Object's cn,sAMAccountName,dNSHostName or userPrincipal Name.") + setToken("tok_obj_list_label_msg","Enter a Filter for the User's cn,sAMAccountName,dNSHostName or userPrincipal Name.") + setToken("tok_obj_list_msg_color","green") + setToken("tok_message_color","green") + setToken("tok_message_state","3.") + setToken("tok_message"," Enter a Filter for the Object's cn,sAMAccountName,dNSHostName or userPrincipal Name. Use a * for a wildcard.") + setToken("tok_tab_1_label","Base Object List (Pending)") + setToken("tok_obj_type_fld_lbl","") + $("#input_fld_filt,#input_fld_list,#input_fld_val_list,#input_fld_byp").addClass("hidden"); + $("#input_obj_filt").removeClass("hidden"); + } + }); + }); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_lkp_view.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_lkp_view.css new file mode 100644 index 00000000..5caca966 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_lkp_view.css @@ -0,0 +1,91 @@ +/*Lookup View Styles*/ +#rw_initial_filters {border: 4px solid #e20082;} +#pan_initial_inputs-fieldset {padding: 0px 12px 0px 12px !important;} +#pan_initial_inputs .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;height:120px !important;width: 100% !important;border: 2px solid #e20082;} +#input_fld_byp {width:150px !important;} +#input_obj_byp {width:150px !important;} +#input_tgt_type {width:250px !important;} +#input_tgt_member {width:250px !important;} +[id^="input_fld_byp"] .splunk-radiogroup {height:20px !important;} +[id^="input_fld_byp"] .splunk-radiogroup div div div {padding-top:0px !important;} +[id^="input_obj_byp"] .splunk-radiogroup {height:20px !important;} +[id^="input_obj_byp"] .splunk-radiogroup div div div {padding-top:0px !important;} +[id^="input_tgt_type"] .splunk-radiogroup {height:20px !important;} +[id^="input_tgt_type"] .splunk-radiogroup div div div {padding-top:0px !important;} +[id^="input_tgt_member"] .splunk-radiogroup {height:20px !important;} +[id^="input_tgt_member"] .splunk-radiogroup div div div {padding-top:0px !important;} +#input_obj_list.select2-drop-mask {padding: 0 0 0 0 !important;padding-bottom: 50px !important;margin: 0 0 0 0 !important;width: 100% !important;} +#input_obj_list {line-height: 1px;width:300px !important;padding-right: 20px !important;margin-right: 20px !important;} +[id^="input_obj_list_"] [data-component="splunk-core:/splunkjs/mvc/components/Dropdown"] {width: 275px !important; padding-right:20px !important;margin-right:20px !important;display: flex;} +#input_fld_val_list.select2-drop-mask {padding: 0 0 0 0 !important;padding-bottom: 50px !important;margin: 0 0 0 0 !important;width: 100% !important;} +#input_fld_val_list {line-height: 1px;width:300px !important;padding-right: 20px !important;margin-right: 20px !important;} +[id^="input_fld_val_list"] [data-component="splunk-core:/splunkjs/mvc/components/Dropdown"] {width: 275px !important; padding-right:20px !important;margin-right:20px !important;display: flex;} +.sp-btn-gradient {background-image: linear-gradient(to left, #e20082, #f99d1c);background-color: transparent;border-color: #000000;color:#FFFFFF;} +.sp-btn-gradient:hover,.sp-btn-gradient:active,.sp-btn-gradient:focus{color:#e20082;background-color:transparent;border-color:#e20082;background-image: linear-gradient(to left, #FFFFFF, #FFFFFF)} +[id^="result_split3_pan"] {border: 4px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;width:32.5% !important;} +[id^="result_single_pan"] {border: 4px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;width:99.2% !important;} +#result_rw_single_gchg,#result_rw_single_gmchg {border: 4px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;width:99.2% !important;} +[id^="result_rw_single_"] .dashboard-panel h2.panel-title {font-weight: bold !important;} +[id^="result_details_pan"] {border: 4px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;} +[id^="result_details_pan"] .panel-element-row {width:99.2% !important;} +[id^="result_details_tbl_"] {border: 2px solid #f99d1c;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;} +[id^="result_details_msg_"] {border: 2px solid #e20082;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;} +[id^="result_details_run_"] {border: 2px solid #e20082;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;} +[id^="ldap_details_"] {border: 4px solid #f99d1c;width:49% !important;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;} +[id^="ldap_details_"] .dashboard-panel h2.panel-title {font-weight: bold !important;} +#result_details_pan_sel_obj_msg {width:99.2% !important;} +#result_details_pan_fld_filt_cnts {width:49% !important;} +[id^="result_single_pan"] .dashboard-panel h2.panel-title {font-weight: bold !important;} +[id^="result_details_pan"] .dashboard-panel h2.panel-title {font-weight: bold !important;} +#msg_obj_sel_details {border: 4px solid red;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;width: 99.2% !important;} +#msg_obj_list_details {border: 4px solid red;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;width: 99.2% !important;} +#msg_obj_chg_gm_details,#msg_obj_chg_g_details {border: 4px solid red;margin-bottom: 0px !important;margin-left: 2px !important;padding-bottom: 0px !important;width: 99.2% !important;} +#result_details_pan_sel_obj_tbl {width:44.5% !important;height:750px !important;} +#result_details_pan_sel_obj_ldp {width:53.5% !important;height:750px !important;} +#result_details_pan_fld_cnts,#result_details_pan_filt_obj {height:750px !important;width:99.2% !important;} +#restblflddet,#restblobjdet,#restblobjsel,#restblobjselldp {height:700px !important;overflow:scroll !important;} + +/*Tab Styles*/ +.nav-tabs {padding: 0 5px;height: 38px;background-color: #fff;border-bottom: 1px solid #fff !important;} +#tabs a:hover,#tabs a:hover::after,#tabs a:focus,#tabs a:focus::after {background: #fff;} +#tabs a:focus {outline: 0;} +#tabs a::after {content:'';position:absolute;z-index: 1;top: 0;right: -.5em; bottom: 0;width: 1em;background: #ddd;background-image: linear-gradient(to bottom, #fff, #ddd); box-shadow: 2px 2px 2px rgba(0,0,0,.4);transform: skew(10deg);border-radius: 0 5px 0 0; } +#tabs #current.active a,#tabs #current.active a::after {background: #fff;z-index: 3;} +#content {background: #fff;padding: 2em;height: 220px;position: relative;z-index: 2; border-radius: 0 5px 5px 5px;box-shadow: 0 -2px 3px -2px rgba(0, 0, 0, .5);} +#tabs li {float: left;margin: 0 .5em 0 0;} +.nav-tabs > li.active, .nav-tabs > li > a.active {box-shadow: none !important;border-radius: 0 !important;font-weight: 500;color: #3c444d;} +.nav-tabs > li {position: relative;} +.nav-pills > li, .nav-tabs > li {float: left;} +li {line-height: 20px;display: list-item;text-align: match-parent;} +::backdrop {-moz-top-layer: top !important;display: block;position: fixed;top: 0;left: 0;right: 0;bottom: 0;} +::cue {color: rgba(255, 255, 255, 1);white-space: pre-line;background-color: rgba(0, 0, 0, 0.8);font: var(--cue-font-size) sans-serif;} +#tabs a:focus {outline: 0;} +#tabs a:hover, #tabs a:hover::after, #tabs a:focus, #tabs a:focus::after {background: #fff;} +#tabs a {position: relative;background: #ddd;background-image: linear-gradient(to bottom, #fff, #ddd);padding: .7em 2.5em;float: left;text-decoration: none;color: #444;text-shadow: 0 1px 0 rgba(255,255,255,.8);border-radius: 5px 0 0 0;box-shadow: 0 2px 2px rgba(0,0,0,.4);} +.nav-tabs > li > a:focus {box-shadow: none;border-collapse: separate;outline: 0;text-decoration: none;box-shadow: inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;background-color: transparent;border-radius: 3px;} +.nav-tabs > li > a:hover {background: transparent;} +.nav > li > a:focus, .nav > li > a:hover {text-decoration: none;} +.nav-tabs > li > a {line-height: 20px;padding: 2px 15px;color: #5c6773;} +.nav-pills > li > a, .nav-tabs > li > a {padding-right: 15px;padding-left: 15px;margin-right: 2px;line-height: 14px;} +.nav > li > a {display: block;} +a:focus {box-shadow: 0 0 1px 2px rgba(0,164,253,.6);border-collapse: separate;outline: 0;text-decoration: none;} +a:hover {text-decoration: underline;} +a, a:hover {color: #006eaa;} +a:active, a:hover {outline: 0;} +a {text-decoration: none;cursor: pointer;} +.nav-tabs > li.active, .nav-tabs > li > a.active {font-weight: 500;color: #3c444d;} +li {line-height: 20px;} +li {text-align: match-parent;} +#tabs {list-style: none;} +.nav {list-style: none;} +ul, menu, dir {list-style-type: disc;} +center {text-align: -moz-center;} +.nav-tabs > li > a::before {content: "";position: absolute;width: calc(100% - 30px);height: 0;bottom: 0;left: 14px;background-color: #e1e6eb;transition: height .2s;} +#tabs li.active a {background-image: linear-gradient(to bottom, #BEE6BE, #ddd) !important;background-color: #F1813F ;} +#tabs #current.active a, #tabs #current.active a::after {background: #fff !important;z-index: 3 !important;} +.nav-tabs > li.active > a::before {height: 3px !important;background-color: #F1813F !important;width: 85% !important;} +#tabs li.active a::after {background-image: linear-gradient(to bottom, #BEE6BE, #ddd) !important} +#tabs li.active a::before {height: 3px;background-color: #F1813F !important;width: 85% !important;} +#tabs li::before {left: -7px;border-top-right-radius: 0px;border-width: 0px 0px 0px 0px;} +#tabs li::after {right: -7px;border-top-left-radius: 0px;border-width: 0px 0px 0px 1px;box-shadow: 0px 0px 0px #ECECEC;} +#tabs li::before, #tabs li::after {border: 0px solid #ECECEC; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px;box-shadow: -2px 0px 0 #ECECEC;position: absolute;top: -1px;width: 0px;height: 0px;content: "";} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_login_by.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_login_by.css new file mode 100644 index 00000000..d9a37b47 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_login_by.css @@ -0,0 +1,136 @@ +/* Result Table Formatting */ +.table, .table td {border:1px solid rgba(0, 0, 0, 0.3);border-collapse: collapse;} +.table.th {border: 2px solid green;} +/* Hidden - Initial Hiding of Objects */ +[id^=row_] {display:none;} +#rw_inputs {display:none;} +#rw_initial_post_panel {display:none;} +#input_obj_list_id {display:none;} +.prg_run_state {display:none;} +.show_filt_btn {display:none;} +.hide_filt_btn {display:none;} +.msg_obj_warn {display:none;} +.msg_obj_m_warn {display:none;} +.msg_prg_run_failed {display:none;} +.msg_prg_run_nodata {display:none;} +.msg_prg_init_nodomain {display:none;} +#row_d_results_a {display:none;} +#row_d_results_b {display:none;} +/* Active - Input Filters */ +#rw_inputs.active {display:block !important;} +#input_obj_list_id.active {display:inline-block !important;} +#rw_inputs.active #rw_initial_panel {width:100% !important;} +#rw_inputs.active #rw_initial_panel.split {width:70% !important;} +#rw_inputs.active #rw_initial_panel-fieldset {height:80px !important;padding: 5px 12px 0px 12px !important;} +#rw_inputs.active #rw_initial_panel .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;height:120px !important;width: 100% !important;border: 4px solid #e20082;} +#rw_inputs.active #rw_initial_post_panel.active {display:block !important;width:30% !important;} +#rw_inputs.active #rw_initial_post_panel-fieldset {height:80px !important;padding: 5px 12px 0px 12px !important;} +#rw_inputs.active #rw_initial_post_panel .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;height:120px !important;border: 4px solid #e20082;} +/* Active - Input Filters - Non JS Class Set */ +#input_src_filt_element_ou {width:500px !important;padding-right: 20px !important;margin-right: 20px !important;} +[id^="input_src_filt_element_ou"] [data-component="splunk-core:/splunkjs/mvc/components/Dropdown"] {width: 475px !important; padding-right:20px;margin-right:20px !important;display: flex;} +#advance_opt_id {width:210px !important;padding-right: 10px !important;margin-right: 10px !important;} +[id^="advance_opt_id"] [data-component="splunk-core:/splunkjs/mvc/components/Dropdown"] {width: 210px !important; padding-right:10px;margin-right:10px !important;display: flex;} +#rw_inputs_njs #rw_initial_panel_njs {min-width:80% !important;} +#rw_inputs_njs #rw_initial_panel_njs-fieldset {min-height:80px !important;padding: 5px 12px 0px 12px !important;} +#rw_inputs_njs #rw_initial_panel_njs .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;width: 100% !important;border: 4px solid #e20082;} +#rw_inputs_njs #rw_initial_post_panel_njs {width:20% !important;} +#rw_inputs_njs #rw_initial_post_panel_njs-fieldset {height:80px !important;padding: 5px 12px 0px 12px !important;} +#rw_inputs_njs #rw_initial_post_panel_njs .dashboard-panel {margin: 0 5px 0px 0 !important;min-height:120px !important;border: 4px solid #e20082;} +/* Selecting Logon Type Formatting */ +#select_logon_type {text-align: center !important;vertical-align: middle !important;line-height:5px !important;height: 60px !important;width: 350px !important;box-shadow: 0px 0px 4px #222;background-image: -moz-linear-gradient(top, #eeeeee, #cccccc);background-image: -webkit-gradient(linear,left top,left bottom,color-stop(0, #eeeeee),color-stop(1, #cccccc));background-image: -webkit-linear-gradient(top, #eeeeee, #cccccc);background-image: -moz-linear-gradient(top, #eeeeee, #cccccc);background-image: -ms-linear-gradient(top, #eeeeee, #cccccc);background-image: -o-linear-gradient(top, #eeeeee, #cccccc);margin: 0 0 0 15px !important;padding: 0 0 0 15px !important;} +#select_logon_type label {text-align: center !important;margin: 0 0 0 0 !important;padding: 0 0 0 0 !important;} +#select_logon_type a {margin-left: 2px;margin-right: 2px;text-overflow: ellipsis;overflow: hidden;width: 80px !important;text-align: center !important;font-size: 10px !important;background-color:#ffffff;border:1px solid #999;border:1px solid rgba(0, 0, 0, 0.3);*border:1px solid #999;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-moz-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;outline:none;} +/* Active - Tabs */ +#row_tabs.active {display:block !important;} +/* Active - Result Rows */ +#row_d_results_a.active {display:block !important;} +#row_d_results_b.active {display:block !important;} +#row_d_members.active {display:block !important;} +#row_d_search_info.active {display:block !important;} +/* Active - Run Gif and Show-Hide Filter Buttons */ +.prg_run_state.active {display:block !important;} +.show_filt_btn.active {display:block !important;padding-left: 15px !important;padding-right: 15px !important;} +.hide_filt_btn.active {display:block !important;padding-left: 15px !important;padding-right: 15px !important;} +/* Active - Messages */ +#row_msgs.active {display:block !important;} +.msg_obj_warn.active {display:block !important;border: 4px solid #DC4E41;} +.msg_obj_m_warn.active {display:block !important;border: 4px solid #DC4E41;} +.msg_prg_run_failed.active {display:block !important;border: 4px solid #DC4E41;} +.msg_prg_run_nodata.active {display:block !important;border: 4px solid #DC4E41;} +.msg_prg_init_nodomain.active {display:block !important;border: 4px solid #DC4E41;} +/* -- Icon Formatting -- */ +.icon-warning.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:18px !important;width:25px;height: 25px;padding-left: 4px;color:#DC4E41 !important;} +.icon-error.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:18px !important;width:25px;height: 25px;padding-left: 4px;color:#f99d1c !important;} +.icon-question-circle.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:18px !important;width:25px;height: 25px;padding-left: 4px;color:#007ABD !important;} +.icon-info-circle.ms-obj-mod-icon {cursor:pointer;padding-right:10px !important;font-size:18px !important;width:25px;height: 25px;padding-left: 4px;color:#007ABD !important;} +.icon-external {font-size:18px !important;color:#40A540;} +/* Button Formatting */ +a.btn.small {padding: 2px 10px;font-size: 10.2px;border-radius: 3px;background-color: #619f35;background-image: linear-gradient(180deg,#65a637,#5b9532);background-repeat: repeat-x;background-color: #65a637;border: 1px solid #4d7e2a;border-bottom-color: #4d7e2a;border-top-color: #4d7e2a;color: #fff;box-shadow: inset 0 1px 0 #69ac39;text-shadow: none;} +#rw_show_filt_btn {padding: 2px;width: 99% !important;margin-bottom: 0px !important;margin-left: 10px !important;padding-bottom: 0px !important;} +#rw_show_filt_btn .dashboard-panel {min-height: 45px !important;height: 45px !important;width: 100% !important;} +#hide_filt_btn {padding: 2px;width: 99% !important;margin-bottom: 0px !important;margin-left: 10px !important;padding-bottom: 0px !important;min-height: 45px !important;height: 45px !important;} +#hide_filt_btn a {min-height: 25px !important;height: 25px !important;} +/* -- Table Formatting -- */ +.mddominpsettoptbl {padding:4px;border: 4px solid #e20082;padding: 2px;margin: 2px;width:98%;} +.mddominpsettoptbl th{text-align:center;padding:2px;border: 2px solid #000000;padding: 2px;margin: 2px;} +.mddominpsettoptbl tr.mddomsinpsettoprow {padding:4px;border: 4px solid #e20082;padding: 2px;margin: 2px} +.mddominpsettoptbl tr.digsinpsetdesc {padding:4px;border: 3px solid #e20082;padding: 2px;margin: 2px} +.mddominpsettoptbl tr.digsinpsethdrrow {padding:4px;border: 3px solid #e20082;padding: 2px;margin: 2px} +.mddominpsettoptbl tr.digsinpsethdrrow td{background-color: #f99d1c;text-align:center;font-weight:500;padding:2px;border: 3px solid #000000;margin: 2px;} +.mddominpsettoptbl tr.domsetvrw {padding:3px;border: 3px solid #f99d1c;padding: 2px;margin: 2px} +.mddominpsettoptbl tr.domsetvrw td{text-align:center;font-weight:300;padding:2px;border: 3px solid #f99d1c;margin: 2px;} +.mdwarninpsettoptbl {padding:4px;border: 4px solid #DC4E41;padding: 2px;margin: 2px;width:98%;} + +.sp-btn-gradient {background-image: linear-gradient(to left, #e20082, #f99d1c);background-color: transparent;border-color: #000000;color:#FFFFFF;} +.sp-btn-gradient:hover,.sp-btn-gradient:active,.sp-btn-gradient:focus{color:#e20082;background-color:transparent;border-color:#e20082;background-image: linear-gradient(to left, #FFFFFF, #FFFFFF)} +#row_d_results_a,#row_d_results_b,#row_d_members {padding: 4px;border: 4px solid #DC4E41;padding: 2px;margin: 2px;width: 99.2%;} +/* Tabs Formatting */ +.nav-tabs {padding: 0 5px;height: 38px;background-color: #fff;border-bottom: 1px solid #fff !important;} +#tabs a:hover,#tabs a:hover::after,#tabs a:focus,#tabs a:focus::after {background: #fff;} +#tabs a:focus {outline: 0;} +#tabs a::after {content:'';position:absolute;z-index: 1;top: 0;right: -.5em; bottom: 0;width: 1em;background: #ddd;background-image: linear-gradient(to bottom, #fff, #ddd); box-shadow: 2px 2px 2px rgba(0,0,0,.4);transform: skew(10deg);border-radius: 0 5px 0 0; } +#tabs #current.active a, +#tabs #current.active a::after {background: #fff;z-index: 3;} +#content {background: #fff;padding: 2em;height: 220px;position: relative;z-index: 2; border-radius: 0 5px 5px 5px;box-shadow: 0 -2px 3px -2px rgba(0, 0, 0, .5);} +#tabs li {float: left;margin: 0 .5em 0 0;} +.nav-tabs > li.active, .nav-tabs > li > a.active {box-shadow: none !important;border-radius: 0 !important;font-weight: 500;color: #3c444d;} +.nav-tabs > li {position: relative;} +.nav-pills > li, .nav-tabs > li {float: left;} +li {line-height: 20px;display: list-item;text-align: match-parent;} +::backdrop {-moz-top-layer: top !important;display: block;position: fixed;top: 0;left: 0;right: 0;bottom: 0;} +::cue {color: rgba(255, 255, 255, 1);white-space: pre-line;background-color: rgba(0, 0, 0, 0.8);font: var(--cue-font-size) sans-serif;} +#tabs a:focus {outline: 0;} +#tabs a:hover, #tabs a:hover::after, #tabs a:focus, #tabs a:focus::after {background: #fff;} +#tabs a {position: relative;background: #ddd;background-image: linear-gradient(to bottom, #fff, #ddd);padding: .7em 2.5em;float: left;text-decoration: none;color: #444;text-shadow: 0 1px 0 rgba(255,255,255,.8);border-radius: 5px 0 0 0;box-shadow: 0 2px 2px rgba(0,0,0,.4);} +.nav-tabs > li > a:focus {box-shadow: none;border-collapse: separate;outline: 0;text-decoration: none;box-shadow: inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;background-color: transparent;border-radius: 3px;} +.nav-tabs > li > a:hover {background: transparent;} +.nav > li > a:focus, .nav > li > a:hover {text-decoration: none;} +.nav-tabs > li > a {line-height: 20px;padding: 2px 15px;color: #5c6773;} +.nav-pills > li > a, .nav-tabs > li > a {padding-right: 15px;padding-left: 15px;margin-right: 2px;line-height: 14px;} +.nav > li > a {display: block;} +a:focus {box-shadow: 0 0 1px 2px rgba(0,164,253,.6);border-collapse: separate;outline: 0;text-decoration: none;} +a:hover {text-decoration: underline;} +a, a:hover {color: #006eaa;} +a:active, a:hover {outline: 0;} +a {text-decoration: none;cursor: pointer;} +/* *|*:any-link:not(svg|a) {text-decoration: underline;} +*|*:link {color: rgb(0, 0, 238);} +:any-link {cursor: pointer;} +*|*:any-link {cursor: pointer;}*/ +.nav-tabs > li.active, .nav-tabs > li > a.active {font-weight: 500;color: #3c444d;} +li {line-height: 20px;} +li {text-align: match-parent;} +#tabs {list-style: none;} +.nav {list-style: none;} +ul, menu, dir {list-style-type: disc;} +center {text-align: -moz-center;} +.nav-tabs > li > a::before {content: "";position: absolute;width: calc(100% - 30px);height: 0;bottom: 0;left: 14px;background-color: #e1e6eb;transition: height .2s;} +#tabs li.active a {background-image: linear-gradient(to bottom, #BEE6BE, #ddd) !important;background-color: #F1813F ;} +#tabs #current.active a, #tabs #current.active a::after {background: #fff !important;z-index: 3 !important;} +.nav-tabs > li.active > a::before {height: 3px !important;background-color: #F1813F !important;width: 85% !important;} +#tabs li.active a::after {background-image: linear-gradient(to bottom, #BEE6BE, #ddd) !important} +#tabs li.active a::before {height: 3px;background-color: #F1813F !important;width: 85% !important;} +#tabs li::before {left: -7px;border-top-right-radius: 0px;border-width: 0px 0px 0px 0px;} +#tabs li::after {right: -7px;border-top-left-radius: 0px;border-width: 0px 0px 0px 1px;box-shadow: 0px 0px 0px #ECECEC;} +#tabs li::before, #tabs li::after {border: 0px solid #ECECEC; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px;box-shadow: -2px 0px 0 #ECECEC;position: absolute;top: -1px;width: 0px;height: 0px;content: "";} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_login_by.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_login_by.js new file mode 100644 index 00000000..56708c98 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_login_by.js @@ -0,0 +1,198 @@ +require([ + "jquery", + "splunkjs/mvc", + "splunkjs/mvc/searchmanager", + "splunkjs/mvc/postprocessmanager", + "splunkjs/mvc/simplexml/ready!" +], function($,mvc,SearchManager,PostProcessManager) { + var defaultTokenModel = mvc.Components.get("default"); + var submitTokenModel = mvc.Components.get("submitted"); + + var base_domain_search_val = new SearchManager({ + id: "base_domain_search", + search: "| `ms_obj_domain_list`", + earliest_time: "-24h@h", + latest_time: "now", + preview: true, + cache: true, + status_buckets: 300 + }); + base_domain_search_val.on('search:progress', function(properties) { + var srch_dr_cnt = properties.content.resultCount + if(srch_dr_cnt==0){ + defaultTokenModel.set("ts_srch_domain","`ms__obj_win_ad_index` eventtype=\"ms_ad_obj_msad-dc-health\""); + defaultTokenModel.set("ts_bld_domain","`ms_obj_admon_bld_domain`"); + $("#row_msgs").addClass("active") + $("#msg_prg_init_nodomain").addClass("active") + $("#rw_inputs").removeClass("active") + } else { + $("#rw_inputs").addClass("active") + } + }); + var base_obj_search_val = new SearchManager({ + id: "base_obj_search", + search: "$tok_srch_ad_group_list$", + earliest_time: "-24h@h", + latest_time: "now", + preview: true, + cache: true, + status_buckets: 300 + }, {tokens: true}); + base_obj_search_val.on('search:progress', function(properties) { + var srch_g_cnt = properties.content.resultCount + $("#row_tabs").removeClass("active") + $("[id^=row_d]").removeClass("active") + $("#rw_initial_panel").removeClass("split") + $("#rw_initial_post_panel").removeClass("active") + $("#row_msgs").removeClass("active") + if(srch_g_cnt>0){ + $("#input_obj_list_id").addClass("active") + } + }); + base_obj_search_val.on('search:done', function(properties) { + var srch_gd_cnt = properties.content.resultCount + if(srch_gd_cnt===0){ + $("#input_obj_list_id").removeClass("active") + $("#row_msgs").addClass("active") + $(".msg_obj_warn").addClass("active") + } else { + $("#input_obj_list_id").addClass("active") + } + }); + var base_obj_m_search_val = new SearchManager({ + id: "base_obj_m_search", + search: "$tok_srch_ad_user_list$", + earliest_time: "-24h@h", + latest_time: "now", + preview: true, + cache: true, + status_buckets: 300 + }, {tokens: true}); + base_obj_m_search_val.on('search:progress', function(properties) { + $("row_tabs").removeClass("active") + $(".prg_run_state").addClass("active") + $("#prg_run_state_msg").html("(Search Running)") + }); + base_obj_m_search_val.on('search:done', function(properties) { + //document.getElementById("prg_run_state_msg").innerHTML=""; + var srch_r_cnt = properties.content.resultCount + var srch_r_cnt_str = String(srch_r_cnt); + defaultTokenModel.set("tok_group_m_count",srch_r_cnt); + if(srch_r_cnt==0){ + $(".show_filt_btn").removeClass("active") + $(".hide_filt_btn").removeClass("active") + $(".msg_prg_run_nodata").removeClass("active") + $("#row_msgs").addClass("active") + $(".msg_obj_m_warn").addClass("active") + defaultTokenModel.set("ex_s_trigger",undefined); + submitTokenModel.set("ex_s_trigger",undefined); + } else { + var base_obj_m_search_res = base_obj_m_search_val.data("results"); + defaultTokenModel.set("tok_g_m_count",srch_r_cnt_str); + base_obj_m_search_res.on("data", function() { + $("#row_msgs").removeClass("active") + $(".msg_obj_m_warn").removeClass("active") + defaultTokenModel.set("ex_s_trigger",srch_r_cnt_str); + submitTokenModel.set("ex_s_trigger",srch_r_cnt_str); + }); + } + }); + var prg_logon_search_val = new SearchManager({ + id: "base_logon_search", + search: "$tok_srch_logon$" + + "| eval ex_search_trigger=\"$ex_s_trigger$\"", + earliest_time: "$time_field.earliest$", + latest_time: "$time_field.latest$", + preview: true, + cache: true, + status_buckets: 300 + }, {tokens: true}); + + prg_logon_search_val.on('search:cancelled', function(properties) { + $("[id^=msg_]").removeClass("active") + }); + + prg_logon_search_val.on('search:failed', function(properties) { + $(".prg_run_state").removeClass("active") + $(".msg_prg_run_nodata").removeClass("active") + $(".msg_prg_run_failed").addClass("active") + $(".show_filt_btn").removeClass("active") + $(".hide_filt_btn").removeClass("active") + }); + + prg_logon_search_val.on('search:progress', function(properties) { + $(".prg_run_state").addClass("active") + var srch_pe_cnt = String(properties.content.eventCount) + if(srch_pe_cnt==undefined){ + srch_pe_cnt="0" + } + //document.getElementById("prg_run_state_msg").innerHTML="(Search Running " + srch_pe_cnt + " events...)"; + $("#prg_run_state_msg").html("(Search Running " + srch_pe_cnt + " events...)") + $("[id^=row_]").removeClass("active") + $("[id^=tab_]").removeClass("active") + $("[id^=msg_]").removeClass("active") + $(".show_filt_btn").removeClass("active") + $(".hide_filt_btn").removeClass("active") + }); + + prg_logon_search_val.on('search:done', function(properties) { + $(".prg_run_state").removeClass("active") + var srch_e_cnt = properties.content.eventCount + var srch_e_cnt_str = String(srch_e_cnt) + defaultTokenModel.set("tok_result_count",srch_e_cnt_str); + if(srch_e_cnt==0){ + $("#row_msgs").addClass("active") + $("[id^=row_d_results]").removeClass("active") + $("[id^=tab_li_]").removeClass("active") + $("#row_tabs").removeClass("active") + $("#row_d_members").addClass("active") + $("#tbl_members").removeClass("mddominpsettoptbl") + $("#tbl_members").addClass("mdwarninpsettoptbl") + $(".msg_prg_run_nodata").addClass("active") + $("#rw_initial_panel").removeClass("split") + $("#rw_initial_post_panel").removeClass("active") + } else { + $("#rw_initial_panel").addClass("split") + $("#rw_initial_post_panel").addClass("active") + $("#row_tabs").addClass("active") + $("#rw_show_filt_btn").addClass("active") + $(".hide_filt_btn").addClass("active") + $("#row_d_results_a").addClass("active") + $(".tb_res_def").addClass("active") + $("#tbl_members").removeClass("mdwarninpsettoptbl") + $("#tbl_members").addClass("mddominpsettoptbl") + } + }); + $(document).on("click","[data-tab-tgt]", function(e) { + e.preventDefault(); + $("[id^=tab_li_]").removeClass("active") + $("[id^=row_d_]").removeClass("active") + var tab_tgt=$(this).data('tab-tgt'); + var tab_li="#tab_li_"+tab_tgt; + var tab_row="#row_d_"+tab_tgt; + $(tab_li).addClass("active") + $(tab_row).addClass("active"); + }); + $(document).on("click","[data-filt-btn-show],[data-filt-btn-hide],[data-filt-tgt]", function(e) { + e.preventDefault(); + var obj_show=$(this).data('filt-btn-show'); + var obj_hide=$(this).data('filt-btn-hide'); + var obj_tgt="#"+$(this).data('filt-tgt'); + $(obj_show).addClass("active"); + $(obj_hide).removeClass("active"); + if(obj_show==".hide_filt_btn"){ + $(obj_tgt).addClass("active") + } else { + $(obj_tgt).removeClass("active") + } + }); + defaultTokenModel.on("change:tok_domain", function(e) { + $("#input_obj_list_id").removeClass("active") + $("#row_tabs").removeClass("active") + $("[id^=row_d]").removeClass("active") + $("#rw_initial_post_panel").removeClass("active") + $("[id^=msgs_]").removeClass("active") + defaultTokenModel.set("ex_s_trigger",undefined); + submitTokenModel.set("ex_s_trigger",undefined); + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_md_cfg.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_md_cfg.js new file mode 100644 index 00000000..cd1803dd --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_md_cfg.js @@ -0,0 +1,475 @@ +require(["jquery", +"splunkjs/mvc", +"splunkjs/mvc/searchmanager", +"splunkjs/mvc/postprocessmanager", +'splunkjs/mvc/tableview', +'../app/ms_windows_ad_objects/components/ms_ad_obj_modal/ms_ad_obj_modal_popup', +"splunkjs/mvc/simplexml/ready!"], +function($, mvc,SearchManager,PostProcessManager, TableView, ms_ad_obj_modal_preview) { +$(document).ready(function () { + var defaultTokenModel = mvc.Components.get("default"); + var submitTokenModel = mvc.Components.get("submitted"); + var tokens = { + get: function(tokenName) { + return defaultTokenModel.get(tokenName); + }, + + set: function(tokenName, tokenValue) { + defaultTokenModel.set(tokenName, tokenValue); + submitTokenModel.set(tokenName, tokenValue); + }, + on: function(eventName, callback) { + defaultTokenModel.on(eventName, callback); + } + }; + var envTokenModel = mvc.Components.get('env'); + const val_user_id=envTokenModel.get('user'); + var bs_ad_upd_dom_list = new SearchManager({ + id: 'bs_ad_upd_dom_list', + search: "| makeresults | eval domain=\"hold\",kv_suffix=\"hold\",dc_val=\"hold\",multi_lkps_enabled=\"f\" | outputlookup tmp_ms_obj_md_cfg.csv", + //cache: true, + preview: true, + //autostart: true, + }); + var chk_dc_val_srch = new SearchManager({ + id: 'chk_dc_val_srch', + search: "| makeresults | eval hold=\"hold\"", + //cache: true, + preview: true, + autostart: false + }); + // Build HTML Tables for Configuration Tabs + var bs_h_list = new PostProcessManager({ + id: 'bs_h', + managerid: "base_ad_h", + //cache: true, + preview: true, + //autostart: true, + }); + // Build HTML Table For Populate and Remove Configurations + var ppl_h_list = new PostProcessManager({ + id: 'ppl_h', + managerid: "kv_create", + search: "|`ms_obj_kv_cfg_ppl_rem_h`", + //cache: true, + preview: true, + //autostart: true, + }); + // ---- Check admon Domain Filter --- // + var sub_chk_dc_val = new PostProcessManager({ + id: 'sub_check_dc_val', + managerid: "check_dc_val", + //cache: true, + preview: true, + //autostart: true, + }); + // ---- Show Config Settings --- // + var sub_cfg_h_tbls = new PostProcessManager({ + id: 'sub_confg_h_tbls', + managerid: "kv_create", + search: "|`ms_obj_cfg_filter_md_h_tbls`", + //cache: true, + preview: true, + //autostart: true, + }); + // ---- Save Config Changes --- // + var upd_dom_table_val = new PostProcessManager({ + id: 'upd_dom_table_val', + managerid: "upd_dom_table", + //cache: true, + preview: true, + //autostart: true, + }); + // ---- Population Search --- // + var ppl_lkp_srch_val = new PostProcessManager({ + id: 'ppl_lkp_srch_val', + managerid: "ppl_lkp_srch", + //cache: true, + preview: true, + //autostart: true, + }); + upd_dom_table_val.on('search:done', function(properties) { + $(".md-cfg-save-spin").addClass("hidden") + $(".md-cfg-save").addClass("hidden") + + }); + sub_chk_dc_val.on('search:progress', function(properties) { + var chk_dc_dom=defaultTokenModel.get("tok_chk_dc_val_dom") + var chk_dc_spin=".chk_dc_run_spin_"+chk_dc_dom + var chk_dc_btn=".chk_dc_verify_"+chk_dc_dom + $(chk_dc_spin).removeClass("hidden") + $(chk_dc_btn).addClass("hidden") + }); + sub_chk_dc_val.on('search:done', function(properties,ms_ad_obj_modal_pop) { + var chk_dc_dom=defaultTokenModel.get("tok_chk_dc_val_dom") + var chk_dc_spin=".chk_dc_run_spin_"+chk_dc_dom + var chk_dc_btn=".chk_dc_verify_"+chk_dc_dom + $(chk_dc_btn).removeClass("hidden") + $(chk_dc_spin).addClass("hidden") + var srch_chk_dc=1 + var srch_chk_dc_nd=1 + var target = $(ms_ad_obj_modal_pop.currentTarget); + t_modal = "cfg_dc_val_chk_mod_hold_pop"; + if (properties.content.resultCount > 0) { + var sub_srch_dc_chk_results = sub_chk_dc_val.data("results"); + sub_srch_dc_chk_results.on("data", function() { + if(srch_chk_dc<2){ + srch_chk_dc=srch_chk_dc+1 + var tbl_chk_dc_vals = sub_srch_dc_chk_results.data().rows; + var h_tp_tbl_rw= new Array() + for (i=0;i'+res_dc_val+''+ + ''+res_obj_cat+'' + h_tp_tbl_rw.push(h_chk_rw) + } + var chk_rw=h_tp_tbl_rw.join("") + var chk_hdr_rw='
dc_val
objectCategory
' + var chk_h_tbl = ''+chk_hdr_rw+' '+chk_rw+'
' + $("#chkdcvalres").html(chk_h_tbl) + var t_m_obj=document.getElementById(t_modal); + var t_obj_i_html=t_m_obj.innerHTML + var prev_ms_ad_obj_modal = new ms_ad_obj_modal_preview({ t_title: t_modal,t_inner_p_html: t_obj_i_html}); + prev_ms_ad_obj_modal.show(); + } + }) + } else { + if(srch_chk_dc_nd<2){ + srch_chk_dc_nd=srch_chk_dc_nd+1 + $("#chkdcvalres").html("NO RESULTS FOUND") + var t_m_obj=document.getElementById(t_modal); + var t_obj_i_html=t_m_obj.innerHTML + var prev_ms_ad_obj_modal = new ms_ad_obj_modal_preview({ t_title: t_modal,t_inner_p_html: t_obj_i_html}); + prev_ms_ad_obj_modal.show(); + } + } + }) + function updateenaCollection (dom_sel_id, sel_type) { + var upd_dom_sel=[] + dom_sel_id = String(dom_sel_id) + tok_dom_sel = defaultTokenModel.get("tok_dom_array"); + if(tok_dom_sel!=undefined){ + upd_dom_sel=tok_dom_sel.split(",") + } + if (sel_type === "Add") { + if(tok_dom_sel===undefined){ + upd_dom_sel.push(dom_sel_id); + } else if (upd_dom_sel.indexOf(dom_sel_id) === -1) { + upd_dom_sel.push(dom_sel_id); + } + } else { + if(tok_dom_sel!=undefined){ + var i = upd_dom_sel.indexOf(dom_sel_id); + if(i != -1) { + upd_dom_sel.splice(i, 1); + } + } + } + if(upd_dom_sel && upd_dom_sel!=""){ + upd_dom_sel = upd_dom_sel.join(',') + defaultTokenModel.set("tok_dom_array", upd_dom_sel); + submitTokenModel.set("tok_dom_array", upd_dom_sel); + } else { + defaultTokenModel.set("tok_dom_array", undefined); + submitTokenModel.set("tok_dom_array", undefined); + } + } + bs_h_list.on('search:done', function(properties) { + var srch_h=1 + if (properties.content.resultCount > 0) { + var sub_srch_ad_h_results = bs_h_list.data("results"); + sub_srch_ad_h_results.on("data", function() { + if(srch_h<2){ + srch_h=srch_h+1 + var tbl_ad_h_list_vals = sub_srch_ad_h_results.data().rows; + var inp_h = tbl_ad_h_list_vals[0][0] + $("#setmdinputs").html(inp_h) + } + }) + } + }) + sub_cfg_h_tbls.on('search:done', function(properties) { + var srch_h_tbls=1 + if (properties.content.resultCount > 0) { + var sub_cfg_h_tbls_results = sub_cfg_h_tbls.data("results"); + sub_cfg_h_tbls_results.on("data", function() { + if(srch_h_tbls<2){ + srch_h_tbls=srch_h_tbls+1 + var sub_cfg_h_tbls_vals = sub_cfg_h_tbls_results.data().rows; + var coll_h = sub_cfg_h_tbls_vals[0][0] + var trans_h = sub_cfg_h_tbls_vals[0][1] + var def_srch_h = sub_cfg_h_tbls_vals[0][2] + var new_srch_h = sub_cfg_h_tbls_vals[0][3] + $("#cfgcollh").html(coll_h) + $("#cfgtransh").html(trans_h) + $("#cfgdefsrchh").html(def_srch_h) + $("#cfgnewsrchh").html(new_srch_h) + } + }) + } + }) + ppl_h_list.on('search:done', function(properties) { + var srch_ppl_h=1 + if (properties.content.resultCount > 0) { + var ppl_h_list_results = ppl_h_list.data("results"); + ppl_h_list_results.on("data", function() { + if(srch_ppl_h<2){ + srch_ppl_h=srch_ppl_h+1 + var ppl_h_list_vals = ppl_h_list_results.data().rows; + var ppl_h = ppl_h_list_vals[0][0] + $("#ppltbls").html(ppl_h) + } + }) + } + }) + $('.dashboard-body').on('change', '[data-inp-md-set],[data-inp-md-dom]', function(e) { + e.preventDefault(); + var inp_set_value = $(this).val(); + var inp_set_fld=$(this).data('inp-md-set'); + var inp_set_dom=$(this).data('inp-md-dom'); + var cur_kv_suffix = defaultTokenModel.get("tok_upd_kv_suffix") + var cur_dc_val = defaultTokenModel.get("tok_upd_dc_val") + defaultTokenModel.set("tok_show_cfg_save_tab","true") + $(".md-cfg-save").removeClass("hidden") + if(inp_set_fld==="kv_suffix"){ + var user_lkp_new="AD_Obj_User_"+inp_set_value + var group_lkp_new="AD_Obj_Group_"+inp_set_value + var computer_lkp_new="AD_Obj_Computer_"+inp_set_value + var tgt_user_lkp_h=".chk-dom-"+inp_set_dom+"-userlkp" + var tgt_group_lkp_h=".chk-dom-"+inp_set_dom+"-grouplkp" + var tgt_computer_lkp_h=".chk-dom-"+inp_set_dom+"-computerlkp" + $(tgt_user_lkp_h).html(user_lkp_new) + $(tgt_group_lkp_h).html(group_lkp_new) + $(tgt_computer_lkp_h).html(computer_lkp_new) + if(cur_kv_suffix===undefined){ + var new_kv_suffix=inp_set_dom+":kv_suffix="+inp_set_value + defaultTokenModel.set("tok_upd_kvsuff_array",new_kv_suffix) + submitTokenModel.set("tok_upd_kvsuff_array",new_kv_suffix) + } else { + var new_kv_suffix=cur_kv_suffix+"|"+inp_set_dom+":kv_suffix="+new_kv_suffix + defaultTokenModel.set("tok_upd_kvsuff_array",new_kv_suffix) + submitTokenModel.set("tok_upd_kvsuff_array",new_kv_suffix) + } + } + if(inp_set_fld==="dc_val"){ + if(cur_dc_val===undefined){ + var new_dc_val=inp_set_dom+":dc_val="+inp_set_value + defaultTokenModel.set("tok_upd_dc_array",new_dc_val) + submitTokenModel.set("tok_upd_dc_array",new_dc_val) + } else { + var hide_old=cur_dc_val.replace(inp_set_dom+":","updatedobj:") + var upd_dc_val=hide_old+"|"+inp_set_dom+":dc_val="+inp_set_value + defaultTokenModel.set("tok_upd_dc_array",upd_dc_val) + submitTokenModel.set("tok_upd_dc_array",upd_dc_val) + } + } + }); + $(document).on("click","[data-inp-chk-dc]", function(e) { + e.preventDefault(); + var dc_val_chk_id=$(this).data('inp-chk-dc'); + var dc_val_chk_hid="#dcvalinp"+dc_val_chk_id + var dc_val_chk=$(dc_val_chk_hid).val(); + defaultTokenModel.set("tok_dc_val_chk",dc_val_chk) + submitTokenModel.set("tok_dc_val_chk",dc_val_chk) + defaultTokenModel.set("tok_chk_dc_val_dom",dc_val_chk_id) + submitTokenModel.set("tok_chk_dc_val_dom",dc_val_chk) + }); + $(document).on("click","[data-cfg-md-save]", function(e) { + e.preventDefault(); + $(".md-cfg-save").addClass("hidden") + $(".md-cfg-save-spin").removeClass("hidden") + var dc_val_chk_id=$(this).data('cfg-md-save'); + defaultTokenModel.set(dc_val_chk_id,"true") + submitTokenModel.set(dc_val_chk_id,"true") + }); + $(document).on("click","[data-ppl-dom],[data-ppl-src],[data-ppl-dest],[data-ppl-type],[data-ppl-tgt],[data-ppl-suff],[data-ppl-dcval],[data-ppl-tgt-up]", function(e) { + e.preventDefault(); + $(".ppl_lkp_btn").addClass("hidden") + var ppl_dom=$(this).data('ppl-dom'); + var ppl_src=$(this).data('ppl-src'); + var ppl_dest=$(this).data('ppl-dest'); + var ppl_type=$(this).data('ppl-type'); + var ppl_tgt=$(this).data('ppl-tgt'); + var ppl_tgt_up=$(this).data('ppl-tgt-up'); + var ppl_suff=$(this).data('ppl-suff'); + var ppl_dcval=$(this).data('ppl-dcval'); + var ppl_bs=ppl_tgt+"_"+ppl_dom + var ppl_st=".ppl_"+ppl_bs+"_st" + var ppl_spin=".ppl_"+ppl_bs+"_spin" + var ppl_btn=".ppl_"+ppl_bs+"_btn" + $(ppl_spin).addClass("running") + if(ppl_type==="mgt"){ + $(ppl_spin).removeClass("hidden") + defaultTokenModel.set("tok_ppl_bs","ppl_"+ppl_bs) + var ppl_mgt_srch_lbl="| inputlookup "+ppl_src+" WHERE domain=\""+ppl_dom+"\" | eval _key=objectGUID.\"#\".DomainDNSName | outputlookup "+ppl_dest + var ppl_mgt_srch=ppl_mgt_srch_lbl+" | fields | stats count| eval tgt_st=\""+ppl_st+"\",tgt_btn=\""+ppl_btn+"\",tgt_msg=\"(\".tostring(count,\"commas\").\" "+ppl_tgt_up+"s Migrated into "+ppl_dest+" lookup)\"| table tgt_st,tgt_btn,count,tgt_msg" + tokens.set("tok_ppl_search_lbl",ppl_mgt_srch_lbl) + tokens.set("tok_ppl_search_btn",ppl_btn) + execpplsearch(ppl_mgt_srch,ppl_dom,ppl_type,ppl_tgt) + } else if(ppl_type==="ad"){ + $(ppl_spin).removeClass("hidden") + tokens.set("tok_ppl_bs","ppl_"+ppl_bs) + var ppl_ad_srch_lbl="`ms_obj_md_admon_bld_upd_out(\""+ppl_dom+"\",\""+ppl_dcval+"\","+ppl_tgt+","+ppl_tgt_up+")`" + var ppl_ad_srch=ppl_ad_srch_lbl+" | fields | stats count | eval tgt_st=\""+ppl_st+"\",tgt_btn=\""+ppl_btn+"\",tgt_msg=\"(\".tostring(count,\"commas\").\" "+ppl_dom+" domain "+ppl_tgt_up+"s Added into "+ppl_dest+" lookup)\"| table tgt_st,tgt_btn,count,tgt_msg| table tgt_st,tgt_btn,count,tgt_msg" + tokens.set("tok_ppl_search_lbl",ppl_ad_srch_lbl) + tokens.set("tok_ppl_search_btn",ppl_btn) + execpplsearch(ppl_ad_srch,ppl_dom,ppl_type,ppl_tgt) + } else if(ppl_type==="rem"){ + var rem_spin=".rem_"+ppl_bs+"_spin" + $(rem_spin).removeClass("hidden") + defaultTokenModel.set("tok_ppl_bs","rem_"+ppl_bs) + var rem_st=".rem_"+ppl_bs+"_st" + var rem_btn=".rem_"+ppl_bs+"_btn" + var rem_srch_lbl="| inputlookup "+ppl_dest+" WHERE domain!=\""+ppl_dom+"\" | eval _key=objectGUID.\"#\".DomainDNSName | outputlookup "+ppl_dest+" " + var rem_srch=rem_srch_lbl+"| fields | stats count AS no_cnt| eval count=2,tgt_st=\""+rem_st+"\",tgt_btn=\""+rem_btn+"\",tgt_msg=\"("+ppl_dom+" Domain "+ppl_tgt+"s Removed from "+ppl_dest+" lookup)\"| table tgt_st,tgt_btn,count,tgt_msg" + defaultTokenModel.set("tok_ppl_search_lbl",rem_srch_lbl) + defaultTokenModel.set("tok_ppl_search_btn",rem_btn) + execpplsearch(rem_srch,ppl_dom,ppl_type,ppl_tgt) + } + }); + $(document).on("click","[data-toggle],[data-onstyle],[data-offstyle],[data-toggle-tgt]", function(e) { + e.preventDefault(); + var tog_chk=$(this).data('toggle'); + var tog_on=$(this).data('onstyle'); + var tog_off=$(this).data('offstyle'); + var tog_tgt=$(this).data('toggle-tgt'); + var tog_tgt_def=".chk-dom-"+tog_tgt+"def" + var tog_tgt_inp=".chk-dom-"+tog_tgt+"inp" + var tog_val=$(this).val(); + var cur_ena_array=defaultTokenModel.get("tok_upd_ena_array") + var cur_dis_array=defaultTokenModel.get("tok_upd_dis_array") + defaultTokenModel.set("tok_show_cfg_save_tab","true") + $(".md-cfg-save").removeClass("hidden") + if($(this).attr('class')==="toggle btn btn-danger off"){ + $(this).removeClass("btn-danger off"); + $(this).addClass("btn-success"); + $(tog_tgt_def).addClass("hidden") + $(tog_tgt_inp).removeClass("hidden") + if(cur_ena_array===undefined){ + defaultTokenModel.set("tok_upd_ena_array",tog_tgt) + submitTokenModel.set("tok_upd_ena_array",tog_tgt) + } else { + var n_arry=cur_ena_array+","+tog_tgt + defaultTokenModel.set("tok_upd_ena_array",n_arry) + submitTokenModel.set("tok_upd_ena_array",n_arry) + } + if(cur_dis_array!=undefined){ + var upd_dis_arry=cur_dis_array.replace(tog_tgt,"") + defaultTokenModel.set("tok_upd_dis_array",upd_dis_arry) + submitTokenModel.set("tok_upd_dis_array",upd_dis_arry) + } else { + defaultTokenModel.set("tok_upd_dis_array","") + submitTokenModel.set("tok_upd_dis_array","") + } + } + else { + $(this).removeClass("btn-success"); + $(this).addClass("btn-danger off"); + $(tog_tgt_inp).addClass("hidden") + $(tog_tgt_def).removeClass("hidden") + if(cur_ena_array!=undefined){ + var upd_arry=cur_ena_array.replace(tog_tgt,"") + defaultTokenModel.set("tok_upd_ena_array",upd_arry) + submitTokenModel.set("tok_upd_ena_array",upd_arry) + } else { + defaultTokenModel.set("tok_upd_ena_array","") + submitTokenModel.set("tok_upd_ena_array","") + } + if(cur_dis_array===undefined){ + defaultTokenModel.set("tok_upd_dis_array",tog_tgt) + submitTokenModel.set("tok_upd_dis_array",tog_tgt) + } else { + var n_darry=cur_dis_array+","+tog_tgt + defaultTokenModel.set("tok_upd_dis_array",n_darry) + submitTokenModel.set("tok_upd_dis_array",n_darry) + } + } + + }); + function execpplsearch(ppl_srch,ppl_dom,ppl_type,ppl_tgt) { + var srchbasepplupd = mvc.Components.get("base_upd_ppl_lkp"); + var h_tgt_btn=".ppl_"+ppl_tgt+"_"+ppl_dom+"_st" + var h_tgt_rem_btn=".rem_"+ppl_tgt+"_"+ppl_dom+"_btn" + var h_tgt_rem_st=".rem_"+ppl_tgt+"_"+ppl_dom+"_st" + srchbasepplupd.settings.set("search", ppl_srch); + srchbasepplupd.startSearch(); + srchbasepplupd.on('search:progress', function(properties) { + var prog_base_upd_cnt=properties.content.resultCount + var prog_base_upd_st=properties.content.dispatchState + var prog_base_upd_msgs=properties.content.messages + var prog_base_upd_msgs_flg=prog_base_upd_msgs.length + var prog_base_upd_dur=Math.round(properties.content.runDuration) + if(prog_base_upd_msgs_flg==1){ + if(prog_base_upd_msgs[0].type=="INFO"){ + prog_base_upd_msgs_flg=0 + } + } + if(prog_base_upd_msgs_flg>0){ + $(".ppl_lkp_spin").addClass("hidden") + $(".ppl_lkp_btn").removeClass("hidden") + var h_err_msg= "RunTime: "+prog_base_upd_dur+" Seconds" + for (i=0;i"+m_err_type+": "+m_err_msg; + } + defaultTokenModel.set("tok_ppl_search_sev","Error") + defaultTokenModel.set("tok_ppl_search_msg",h_err_msg) + $(h_tgt_btn).removeClass("Pending") + $(h_tgt_btn).addClass("iconwarn") + $(".ppl_err_msg_val").html(h_err_msg) + $(".ppl_err_msg").removeClass("hidden") + } + }); + srchbasepplupd.on('search:done', function(properties) { + var dn_base_upd_cnt=properties.content.resultCount + $(".ppl_lkp_spin").addClass("hidden") + $(".ppl_lkp_btn").removeClass("hidden") + if (dn_base_upd_cnt > 0) { + var srchbasepplupd_results = srchbasepplupd.data("results"); + srchbasepplupd_results.on("data", function() { + if(srchbasepplupd_results.data().rows){ + var srchbasepplupd_vals = srchbasepplupd_results.data().rows; + var h_ppl_btn=srchbasepplupd_vals[0][1] + var h_ppl_cnt=srchbasepplupd_vals[0][2] + if(h_ppl_btn!=undefined){ + $(".ppl_err_msg").addClass("hidden") + $(".ppl_lkp_btn").removeClass("hidden") + $(".ppl_lkp_spin").addClass("hidden") + var h_ppl_st=srchbasepplupd_vals[0][0] + var h_ppl_msg=srchbasepplupd_vals[0][3] + var h_ppl_st_msg_div=h_ppl_st+"_msg" + if(h_ppl_cnt>0){ + var h_ppl_st_msg_h="

"+h_ppl_msg+"

" + $(h_ppl_st_msg_div).html(h_ppl_st_msg_h) + $(h_tgt_btn).removeClass("iconwarn") + $(h_tgt_btn).removeClass("Pending") + $(h_ppl_btn).addClass("Completed") + $(h_ppl_st).addClass("Completed") + } else { + var h_ppl_st_msg_h="

No "+ppl_tgt+"s found.

" + $(h_ppl_st_msg_div).html(h_ppl_st_msg_h) + $(h_tgt_btn).removeClass("iconwarn") + $(h_tgt_btn).removeClass("Pending") + $(h_ppl_btn).addClass("Completed") + $(h_ppl_st).addClass("Completed") + if(ppl_type=="mgt"){ + var h_rem_st_msg_h="

No "+ppl_tgt+"s to remove from default lookup.

" + $(h_tgt_rem_st).html(h_rem_st_msg_h) + $(h_tgt_rem_st).removeClass("Pending") + $(h_tgt_rem_st).addClass("Completed") + $(h_tgt_rem_btn).addClass("Completed") + } + } + } + } + }); + }; + + }); + }; + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_overview.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_overview.css new file mode 100644 index 00000000..08e5e7b6 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_overview.css @@ -0,0 +1,12 @@ +a.btn.small {padding: 2px 10px;font-size: 10.2px;border-radius: 3px;background-color: #619f35;background-image: linear-gradient(180deg,#65a637,#5b9532);background-repeat: repeat-x;background-color: #65a637;border: 1px solid #4d7e2a;border-bottom-color: #4d7e2a;border-top-color: #4d7e2a;color: #fff;box-shadow: inset 0 1px 0 #69ac39;text-shadow: none;} +#input_release_notes_id {text-align: center !important;vertical-align: middle !important;line-height:5px !important;height: 65px !important;width: 15% !important;box-shadow: 0px 0px 4px #222; background-image: -moz-linear-gradient(top, #eeeeee, #cccccc); background-image: -webkit-gradient(linear,left top,left bottom,color-stop(0, #eeeeee),color-stop(1, #cccccc));background-image: -webkit-linear-gradient(top, #eeeeee, #cccccc); background-image: -moz-linear-gradient(top, #eeeeee, #cccccc); background-image: -ms-linear-gradient(top, #eeeeee, #cccccc); background-image: -o-linear-gradient(top, #eeeeee, #cccccc);margin: 0 0 0 15px !important;padding: 0 0 0 15px !important;} +#input_release_notes_id label{font-weight: bold !important;text-align: center !important;margin: 0 0 0 0 !important;padding: 0 0 0 0 !important;} +#input_release_notes_id a {margin-left: 2px;margin-right: 2px;text-overflow: ellipsis;overflow: hidden;width: 200px !important;text-align: center !important;font-size: 10px !important;background-color:#ffffff;border:1px solid #999;border:1px solid rgba(0, 0, 0, 0.3);*border:1px solid #999;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-moz-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;outline:none;} +#input_splk_ent_id {text-align: center !important;vertical-align: middle !important;line-height:5px !important;height: 65px !important;width: 35% !important;box-shadow: 0px 0px 4px #222; background-image: -moz-linear-gradient(top, #eeeeee, #cccccc); background-image: -webkit-gradient(linear,left top,left bottom,color-stop(0, #eeeeee),color-stop(1, #cccccc));background-image: -webkit-linear-gradient(top, #eeeeee, #cccccc); background-image: -moz-linear-gradient(top, #eeeeee, #cccccc); background-image: -ms-linear-gradient(top, #eeeeee, #cccccc); background-image: -o-linear-gradient(top, #eeeeee, #cccccc);margin: 0 0 0 15px !important;padding: 0 0 0 15px !important;} +#input_splk_ent_id label {font-weight: bold !important;text-align: center !important;margin: 0 0 0 0 !important;padding: 0 0 0 0 !important;} +#input_splk_ent_id a {margin-left: 2px;margin-right: 2px;text-overflow: ellipsis;overflow: hidden;width: 200px !important;text-align: center !important;font-size: 10px !important;background-color:#ffffff;border:1px solid #999;border:1px solid rgba(0, 0, 0, 0.3);*border:1px solid #999;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-moz-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;outline:none;} +#input_splk_cloud_id {text-align: center !important;vertical-align: middle !important;line-height:5px !important;height: 65px !important;width: 35% !important;box-shadow: 0px 0px 4px #222; background-image: -moz-linear-gradient(top, #eeeeee, #cccccc); background-image: -webkit-gradient(linear,left top,left bottom,color-stop(0, #eeeeee),color-stop(1, #cccccc));background-image: -webkit-linear-gradient(top, #eeeeee, #cccccc); background-image: -moz-linear-gradient(top, #eeeeee, #cccccc); background-image: -ms-linear-gradient(top, #eeeeee, #cccccc); background-image: -o-linear-gradient(top, #eeeeee, #cccccc);margin: 0 0 0 15px !important;padding: 0 0 0 15px !important;} +#input_splk_cloud_id label{font-weight: bold !important;text-align: center !important;margin: 0 0 0 0 !important;padding: 0 0 0 0 !important;} +#input_splk_cloud_id a {margin-left: 2px;margin-right: 2px;text-overflow: ellipsis;overflow: hidden;width: 200px !important;text-align: center !important;font-size: 10px !important;background-color:#ffffff;border:1px solid #999;border:1px solid rgba(0, 0, 0, 0.3);*border:1px solid #999;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-moz-box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);box-shadow:0 3px 7px rgba(0, 0, 0, 0.3);-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;outline:none;} +.table, .table td {border:1px solid rgba(0, 0, 0, 0.3);border-collapse: collapse;} +.table.th {border: 2px solid green;} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_quick_nav.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_quick_nav.js new file mode 100644 index 00000000..bcffa7bf --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_quick_nav.js @@ -0,0 +1,98 @@ + require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/simplexml/ready!' +], function(_,$, mvc) { + $(document).ready(function () { + var defaultTokenModel = mvc.Components.get("default"); + var submittedTokenModel = mvc.Components.get("submitted"); + $("[id^=nav_part_r_]").hide(); + $("#nav_part_r_0").show(); + submittedTokenModel.set("tok_get_cfg", "true") + $("#nav_top_prev_btn").prop('disabled', true) + function setToken(name, value) { + var defaultTokenModel = mvc.Components.get('default'); + if (defaultTokenModel) { + defaultTokenModel.set(name, value); + } + var submittedTokenModel = mvc.Components.get('submitted'); + if (submittedTokenModel) { + submittedTokenModel.set(name, value); + } + } + // Get Configuration Preset Values + function nav_upd_top(p_dir,p_t_old_id,p_t_new_id,p_t_btn_prev_id,p_t_btn_prev_st,p_t_trg_use,p_t_trg_tok,p_t_trg_tok_val,p_max_compl) { + var part_new_show = '[id^=nav_part_r_'+p_t_new_id+']' + var part_new_cont = '#nav_top_part_cont_'+p_t_new_id + var part_old_cont = '#nav_top_part_cont_'+p_t_old_id + var part_prev_btn = '#'+p_t_btn_prev_id + $(part_new_show).show(); + $(part_old_cont).removeClass("active") + $(part_old_cont).addClass("completed") + $(part_new_cont).addClass("active") + if(p_t_btn_prev_st==="disabled"){ + $(part_prev_btn).prop('disabled', true) + } else { + $(part_prev_btn).prop('disabled', false) + } + if(p_t_trg_use){ + setToken(p_t_trg_tok, p_t_trg_tok_val); + } + if(p_max_compl){ + $(part_new_cont).addClass("completed") + } + setToken("tok_cur_part", p_t_new_id); + } + defaultTokenModel.on("change:tok_t_nav_btn_next_st", function(e) { + var next_btn_st=defaultTokenModel.get("tok_t_nav_btn_next_st") + if(next_btn_st==="disabled"){ + $("#nav_top_next_btn").prop('disabled', true) + $("#nav_top_next_btn").show(); + } else if(next_btn_st==="enabled"){ + $("#nav_top_next_btn").prop('disabled', false) + $("#nav_top_next_btn").show(); + } else if(next_btn_st==="hidden"){ + $("#nav_top_next_btn").prop('disabled', false) + $("#nav_top_next_btn").hide(); + } + }); + $('.dashboard-body').on('click', '[data-obj-top-nav],[data-obj-top-nav-max]', function(ms_ad_obj_nav) { + var target = $(ms_ad_obj_nav.currentTarget); + var part_exec = target.data('obj-top-nav'); + var part_max_txt = String(target.data('obj-top-nav-max')); + var part_cur_txt = String(defaultTokenModel.get("tok_cur_part")); + var part_max_nmb = Number(part_max_txt); + var part_cur_nmb = Number(part_cur_txt); + var part_next_nmb=part_cur_nmb+1 + var part_prev_nmb=part_cur_nmb-1 + var part_next_txt=String(part_next_nmb) + var part_prev_txt=String(part_prev_nmb) + $("[id^=nav_part_r_]").hide(); + setToken("tok_show_man_domain_update", undefined); + if(part_exec==="PrevPart"){ + setToken("tok_t_nav_btn_next_st", "enabled"); + if(part_cur_txt==="1"){ + nav_upd_top(part_exec,part_cur_txt,part_prev_txt,"nav_top_prev_btn","disabled",false,"","",false) + } else { + nav_upd_top(part_exec,part_cur_txt,part_prev_txt,"nav_top_prev_btn","enabled",false,"","",false) + } + } else { + var part_btn_next_st= "tok_t_nav_"+part_next_txt+"_btn_next_st" + var tok_next_st = String(defaultTokenModel.get(part_btn_next_st)); + setToken("tok_t_nav_btn_next_st", tok_next_st); + if(part_cur_txt==="0"){ + nav_upd_top(part_exec,part_cur_txt,part_next_txt,"nav_top_prev_btn","enabled",false,"","",false) + } else if(part_next_txt==="2"){ + nav_upd_top(part_exec,part_cur_txt,part_next_txt,"nav_top_prev_btn","enabled",true,"tok_check_mac_trigger","3",false) + } else if(part_next_txt==="4"){ + nav_upd_top(part_exec,part_cur_txt,part_next_txt,"nav_top_prev_btn","enabled",true,"tok_check_mac_trigger","5",false) + } else if(part_next_txt===part_max_txt){ + nav_upd_top(part_exec,part_cur_txt,part_next_txt,"nav_top_prev_btn","enabled",false,"","",true) + } else { + nav_upd_top(part_exec,part_cur_txt,part_next_txt,"nav_top_prev_btn","enabled",false,"","",false) + } + } + }); + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_reports.css b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_reports.css new file mode 100644 index 00000000..ad1f4e32 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_reports.css @@ -0,0 +1,31 @@ +#rw_initial_filters {border: 4px solid #e20082;max-height:165px !important;} +#pan_initial_inputs-fieldset {padding: 0px 12px 0px 12px !important;} +#pan_initial_inputs {max-height:220px !important;} +#pan_initial_inputs .dashboard-panel {min-height:145px;max-height:155px;margin: 0 5px 0px 0 !important;border: 2px solid #e20082;} +#pan_res_type_input {max-height:220px !important;} +#pan_res_type_input-fieldset {padding: 0px 12px 0px 12px !important;} +#pan_res_type_input .dashboard-panel {min-height:145px;max-height:155px;margin: 0 5px 0px 0 !important;border: 2px solid #e20082;} +#remove_input_res_field_type {width: 150px !important; height:25px;} +.sp-btn-gradient {background-image: linear-gradient(to left, #e20082, #f99d1c);background-color: transparent;border-color: #000000;color:#FFFFFF;} +.sp-btn-gradient:hover,.sp-btn-gradient:active,.sp-btn-gradient:focus{color:#e20082;background-color:transparent;border-color:#e20082;background-image: linear-gradient(to left, #FFFFFF, #FFFFFF)} +#result_details_tbl_list {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;padding-right: 2px !important;width: 98.5% !important;} +#result_details_pan_list {border: 3px solid #f99d1c;margin-bottom: 0px !important;margin-left: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_list .dashboard-panel h2.panel-title {font-weight: bold !important;} +#result_details_msg_time {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_msg_chg {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_dd {width:49% !important;border: 3px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_dd .dashboard-panel h2.panel-title {font-weight: bold !important;} +#result_details_tbl_dd {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;padding-right: 2px !important;width: 98.5% !important;} +#result_details_msg_dd {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_admon_dd {width:49% !important;border: 3px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_pan_admon_dd .dashboard-panel h2.panel-title {font-weight: bold !important;} +#result_details_tbl_admon_dd {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;padding-right: 2px !important;width: 98.5% !important;} +#result_details_msg_admon_dd {border: 2px solid #e20082;margin-bottom: 0px !important;padding-bottom: 0px !important;} +#result_details_tbl_active {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;width:98.5% !important;} +#result_details_tbl_pwd_old {border: 2px solid #f99d1c;margin-bottom: 0px !important;padding-bottom: 0px !important;width:98.5% !important;} +#result_details_row {min-height: 500px !important;padding-top: 5px;} +#input_res_field_type {text-align: center !important;vertical-align: middle !important;line-height:5px !important;height: 60px !important;width: 100% !important;margin: 0 0 0 15px !important;padding: 0 0 0 15px !important;} +#input_res_field_type label {text-align: center !important;margin: 0 0 0 0 !important;padding: 0 0 0 0 !important;} +#input_res_field_type div {margin-left: 2px;margin-right: 2px;text-overflow: ellipsis;overflow: hidden;width: 80px !important;text-align: center !important;font-size: 10px !important;display:inline !important;} +#input_res_field_type div div div div {-webkit-box-shadow: 0 3px 7px rgba(0, 0, 4, 0.3);box-shadow: 0 3px 7px rgba(0, 0, 4, 0.3);left: 2px;right: 2px;padding-right: 4px;padding-left: 4px;} +#input_res_field_type button {padding-top: 12px !important;margin-top: 3px!important;top: 5px!important;right: 2px!important;} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_table_status.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_table_status.js new file mode 100644 index 00000000..d89d62b8 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_table_status.js @@ -0,0 +1,38 @@ + require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/tableview', + 'splunkjs/mvc/simplexml/ready!' + ], function(_, $, mvc, TableView) { + var status_array = []; + var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ + canRender: function(cell) { + //return cell.field; + return cell.field === "Status"; + }, + render: function($td, cell) { + // Requires the Status column to contain an string array with "Icon Class", "Status Label", "Status Color", in that order and with a comma seperator: + // example ("icon-check-circle,OK,green") + // NOTE: You can also use hex colors like #49B849 for the Status Color + status_array = cell.value.split(","); + var status_icon = status_array[0] + var status_name = status_array[1] + var status_color = status_array[2] + $td.html("
("+status_name+")
") + } + }); + $(document).ready(function () { + var defaultTokenModel = mvc.Components.get('default'); + defaultTokenModel.on("change:tok_panel_refresh_trigger", function(e) { + var sh = mvc.Components.get("icon_status_table"); + if(typeof(sh)!="undefined") { + sh.getVisualization(function(tableView) { + // Add custom cell renderer and force re-render + tableView.table.addCellRenderer(new CustomRangeRenderer()); + tableView.table.render(); + }); + } + }); + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_table_toggle.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_table_toggle.js new file mode 100644 index 00000000..2be4faf4 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_table_toggle.js @@ -0,0 +1,134 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/tableview', + 'splunkjs/mvc/searchmanager', + 'splunkjs/mvc/postprocessmanager', + 'splunkjs/mvc/dropdownview', + 'splunkjs/mvc/textinputview', + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, mvc, TableView, SearchManager,PostProcessManager,DropdownView,TextInputView) { + // Set up Arrays for Selection Changes + var uc_data_enable_array = []; + var uc_data_disable_array = []; + // Set and Get Tokens + var defaultTokenModel = mvc.Components.get('default'); + var submittedTokenModel = mvc.Components.get('submitted'); + var envTokenModel = mvc.Components.get('env'); + const val_user_id=envTokenModel.get('user'); + // ---- Search Managers --- // + // Main UC Data Lookup Search + var sm_uc_data_base = new SearchManager({ + id: "sm_uc_data_base", + search: '|inputlookup vj_cfg_uc_data_cat WHERE user=\"'+val_user_id+'\"| eval Status=if(state=="0","dis","ena")."".id | makemv delim="," use_cases| table id, Status, description, use_cases, type', + earliest_time: "-1h@h", + latest_time: "now", + preview: true, + cache: true + }); + // ---- Post Search Managers --- // + // Table Search - Get UC Data Sub List - for Showing Results + var sm_uc_data_sub_display = new PostProcessManager({ + id: "sm_uc_data_display", + managerid: "sm_uc_data_base", + search: "rename description AS Description, type AS Category, use_cases AS Use-Cases | table Status, Category, Use-Cases, Description" + }); + + // ---- Table Views --- // + // Create a UC Data Table View + var tbl_uc_data_view = new TableView({ + id: "tbl_uc_data_view_id", + managerid: "sm_uc_data_display", + fields: "Status, Category, Use-Cases, Description", + wrap: true, + el: $("#tbl_uc_data_view_id") + }).render(); + // ---- Functions --- // + // Function for Updating Selection Array + function updateucdatasCollection (uc_data, typevl) { + if (typevl === "Add") { + if (uc_data_enable_array.indexOf(uc_data) === -1) { + uc_data_enable_array.push(uc_data); + } + } else { + var i = uc_data_enable_array.indexOf(uc_data); + if(i != -1) { + uc_data_enable_array.splice(i, 1); + uc_data_disable_array.push(uc_data); + } + } + } + + // Action - onClick - Bypass default drilldown behavior for Selections + tbl_uc_data_view.on("click", function(e) { + e.preventDefault(); + }); + + // ---- Render Actions --- // + // Render Cell Value - Toggle Selection Switch + var CustomCellRenderer = TableView.BaseCellRenderer.extend({ + canRender: function(cellData) { + // This method returns "true" for the "Status" field + return cellData.field === "Status"; + }, + + // This render function only works when canRender returns "true" + render: function($td, cellData) { + var sel_int = cellData.value.substr(0,3); + var idvl = cellData.value.substr(3,50); + var i = uc_data_enable_array.indexOf(idvl); + if(i != -1) { + sel_int = "ena"; + } + var k = uc_data_disable_array.indexOf(idvl); + if(k != -1) { + sel_int = "dis"; + } + var $toggleAction = $('
'); + if(sel_int === 'ena') { + $toggleAction.prop("checked", true); + var selstr = 'checked="true"'; + var selvl = 'success'; + updateucdatasCollection(idvl, "Add"); + } + else { + $toggleAction.prop("checked", false); + var selstr = 'checked="false"'; + var selvl = 'danger off'; + updateucdatasCollection(idvl, "Remove"); + } + var a = $('
').attr({"id":"chk-uc-item-"+idvl,"name":"uc_data_"+idvl,"value":idvl,"data-toggle":"toggle","style":"width: 31.2333px; height: 16.7333px;"}).addClass('toggle btn btn-' + selvl).click(function() { + if($(this).attr('class')==="toggle btn btn-success") + { + $(this).removeClass(); + $(this).addClass("toggle btn btn-danger off"); + updateucdatasCollection($(this).attr('value'), "Remove"); + $toggleAction.prop("checked", false); + } + else { + $(this).removeClass(); + $(this).addClass("toggle btn btn-success"); + updateucdatasCollection($(this).attr('value'), "Add"); + $toggleAction.prop("checked", true); + } + defaultTokenModel.set("tok_uc_data_array", uc_data_enable_array.join()); + submittedTokenModel.set(defaultTokenModel.toJSON()); + }).append($toggleAction).appendTo($td); + } + }); + // ---- Execution Actions --- // + // Render - Create an instance of the custom cell renderer,add it to the table, and render the table + var myCellRenderer = new CustomCellRenderer(); + tbl_uc_data_view.addCellRenderer(myCellRenderer); + tbl_uc_data_view.render(); + + // Function - Capture Selections and update tok_uc_data_array token + $(document).ready(function () { + $(".splunk-view splunk-paginator").on("click", function (e) { + e.preventDefault(); + defaultTokenModel.set("tok_uc_data_array", uc_data_enable_array.join()); + submittedTokenModel.set(defaultTokenModel.toJSON()); + }); + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_upd_domain.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_upd_domain.js new file mode 100644 index 00000000..4c72ae6f --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_upd_domain.js @@ -0,0 +1,143 @@ +require([ + "jquery", + "underscore", + 'backbone', + "splunkjs/mvc", + "splunkjs/mvc/textinputview", + "splunkjs/mvc/searchmanager", + "splunkjs/mvc/simplexml/ready!" +], function( + $, + _, + Backbone, + mvc, + TextInputView, + SearchManager +) { +var defaultTokens = mvc.Components.get('default'); +var submittedTokens = mvc.Components.get('submitted'); +var cur_domain_base = new SearchManager({ + id: "cur_domain_list_srch", + search: "|inputlookup AD_Obj_Domain |table host,domain,DomainDNSName,DomainNetBIOSName,Site,Forest", + preview: true, + cache: true, + status_buckets: 300 +}); +var upd_user = [] +var upd_domain_base = new SearchManager({ + id: "upd_domain_srch", + search: "|makeresults| eval hold=\"hold for updating instance lookup\"", + preview: true, + cache: true, + auto_start: false, + status_buckets: 300 +}); +var val_inp_dns_name = new TextInputView({ + id:"inp_dom_dns_name_id", + default: "", + value: mvc.tokenSafe("$tok_dom_dns_name$"), + el: $("#inp_dom_dns_name") +}).render(); + +var val_inp_netbios_name = new TextInputView({ + id:"inp_dom_netbios_name_id", + default: "", + value: mvc.tokenSafe("$tok_dom_netbios_name$"), + el: $("#inp_dom_netbios_name") +}).render(); + +var val_inp_forest = new TextInputView({ + id:"inp_dom_forest_id", + default: "", + value: mvc.tokenSafe("$tok_dom_forest$"), + el: $("#inp_dom_forest") +}).render(); + +var val_inp_site = new TextInputView({ + id:"inp_dom_site_id", + default: "", + value: mvc.tokenSafe("$tok_dom_site$"), + el: $("#inp_dom_site") +}).render(); + + // ## Function to Check if inputs have been entered before enabling action buttons + function check_d_btn(){ + var d_host=val_inp_host.settings.get("value"); + var d_dns=val_inp_dns_name.settings.get("value"); + var d_netbios=val_inp_netbios_name.settings.get("value"); + var d_forest=val_inp_forest.settings.get("value"); + var d_site=val_inp_site.settings.get("value"); + if (d_host==="" || d_dns==="" || d_netbios==="" || d_forest==="" || d_site==="" ) { + $('#btn_add_domain').attr("aria-disabled","true"); + } else { + $('#btn_add_domain').attr("aria-disabled","false"); + } + } +// ## Functions to clear the input values after Owner or User Account Creations. + function clear_d_inputs() { + $('#btn_add_domain').attr("aria-disabled","true"); + val_inp_host.settings.set("value", ""); + val_inp_dns_name.settings.set("value", ""); + val_inp_netbios_name.settings.set("value", ""); + val_inp_forest.settings.set("value", ""); + val_inp_site.settings.set("value", ""); + setToken("tok_create_lk_upd_target",undefined,true); + setToken("button_add_domain",undefined,true); + upd_domain=[] + }; + + function d_upd_domain_srch (d_n_dom_details) { + var lkp_running=true; + var limit=2; + var lkp_current=0; + var base_upd_dom_srch="| makeresults" + + "| eval host=\""+ d_n_dom_details.d_host + "\"" + + "| eval DomainDNSName=\""+ d_n_dom_details.d_dns_name + "\"" + + "| eval DomainNetBiosName=\""+ d_n_dom_details.d_netbios_name + "\"" + + "| eval forest=\""+ d_n_dom_details.d_forest + "\"" + + "| eval site=\""+ d_n_dom_details.d_site + "\"" + + "| eval domain=\""+ d_n_dom_details.d_domain + "\"" + + "| eval multi_lkps_enabled=\"f\",kv_suffix=\""+ d_n_dom_details.d_netbios_name + "\",dc_val=\""+ d_n_dom_details.d_dns_name + "\",user_lookup=\"AD_Obj_User\",group_lookup=\"AD_Obj_Group\",computer_lookup=\"AD_Obj_Computer\"" + + "| eval key=\""+ d_n_dom_details.d_host + "\"" + var action_upd_dom_srch = base_upd_dom_srch + + "| outputlookup AD_Obj_Domain key_field=key append=true" + + var submittedTokens = mvc.Components.get('submitted'); + var update_d_table = submittedTokens.get('tok_upd_d_table') + update_d_table++; + upd_domain_base.cancel(); + upd_domain_base.settings.unset("search"); + upd_domain_base.settings.set("search", action_upd_dom_srch); + upd_domain_base.startSearch(); + upd_domain_base.on('search:done', function(a_properties) { + lkp_current=lkp_current+1; + var a_searchName = a_properties.content.request.label + if(lkp_running){ + if (a_properties.content.resultCount == 0) { + lkp_running=false; + } else { + clear_d_inputs + submittedTokens.set('tok_upd_d_table', update_d_table); + lkp_running=false; + } + } else { + return false; + } + }); + }; +// ## Account Creation Actions from Create Owner and Create User buttons +//var splunkWebHttp = new splunkjs.SplunkWebHttp(); +//var service = new splunkjs.Service(splunkWebHttp); + $('.add_new_domain').on('click', function(e) { + e.preventDefault(); + var d_value_array = { + d_host: val_inp_host.settings.get("value"), + d_dns_name: val_inp_dns_name.settings.get("value"), + d_netbios_name: val_inp_netbios_name.settings.get("value"), + d_forest: val_inp_forest.settings.get("value"), + d_site: val_inp_site.settings.get("value"), + d_domain: val_inp_netbios_name.settings.get("value") + }; + d_upd_domain_srch (d_value_array); + }); +}) \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_update_input.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_update_input.js new file mode 100644 index 00000000..f77538ca --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_update_input.js @@ -0,0 +1,127 @@ +require([ + "jquery", + "underscore", + 'backbone', + "splunkjs/mvc", + "splunkjs/mvc/textinputview", + "splunkjs/mvc/searchmanager", + "splunkjs/mvc/simplexml/ready!" +], function( + $, + _, + Backbone, + mvc, + SearchManager +) { + var defaultTokens = mvc.Components.get('default'); + var submittedTokens = mvc.Components.get('submitted'); + + $("[id^=upd_dm_host]") + .find("input") + .on("change", function() { + if($(this).val()==="" || $(this).val()===null){ + defaultTokens.unset("tok_upd_dm_host") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_host]").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_host]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_forest]") + .find("input") + .on("change", function() { + if($(this).val()==="" || $(this).val()===null){ + defaultTokens.unset("tok_upd_dm_forest") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_forest]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_forest]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_site]") + .find("input") + .on("change", function() { + if($(this).val()==="" || $(this).val()===null){ + defaultTokens.unset("tok_upd_dm_site") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_site]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_site]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_dns]") + .find("input") + .on("change", function() { + if($(this).val()==="" || $(this).val()===null){ + defaultTokens.unset("tok_upd_dm_dns") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_dns]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_dns]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + $("[id^=upd_dm_netbios]") + .find("input") + .on("change", function() { + if($(this).val()==="" || $(this).val()===null){ + defaultTokens.unset("tok_upd_dm_netbios") + $(this).css("border-color", "#f99d1c"); + $("[id^=upd_dm_netbios]").find("label").removeClass('di_completed'); + } else { + $(this).css("border-color", "#40A540"); + $("[id^=upd_dm_netbios]").find("label").addClass('di_completed'); + } + check_d_btn() + }) + defaultTokens.on("change:tok_reset_dom_man_inputs", function(e) { + defaultTokens.unset("tok_upd_dm_host") + defaultTokens.unset("tok_upd_dm_forest") + defaultTokens.unset("tok_upd_dm_site") + defaultTokens.unset("tok_upd_dm_dns") + defaultTokens.unset("tok_upd_dm_netbios") + defaultTokens.unset("form.tok_upd_dm_host") + defaultTokens.unset("form.tok_upd_dm_forest") + defaultTokens.unset("form.tok_upd_dm_site") + defaultTokens.unset("form.tok_upd_dm_dns") + defaultTokens.unset("form.tok_upd_dm_netbios") + $("[id^=upd_dm_netbios]").find("label").removeClass('di_completed'); + $("[id^=upd_dm_netbios]").css("border-color", "#f99d1c"); + $("[id^=upd_dm_netbios]").find("input").css("border-color", "#f99d1c"); + $("[id^=upd_dm_dns]").find("label").removeClass('di_completed'); + $("[id^=upd_dm_dns]").css("border-color", "#f99d1c"); + $("[id^=upd_dm_dns]").find("input").css("border-color", "#f99d1c"); + $("[id^=upd_dm_site]").find("label").removeClass('di_completed'); + $("[id^=upd_dm_site]").css("border-color", "#f99d1c"); + $("[id^=upd_dm_site]").find("input").css("border-color", "#f99d1c"); + $("[id^=upd_dm_forest]").find("label").removeClass('di_completed'); + $("[id^=upd_dm_forest]").css("border-color", "#f99d1c"); + $("[id^=upd_dm_forest]").find("input").css("border-color", "#f99d1c"); + $("[id^=upd_dm_host]").find("label").removeClass('di_completed'); + $("[id^=upd_dm_host]").css("border-color", "#f99d1c"); + $("[id^=upd_dm_host]").find("input").css("border-color", "#f99d1c"); + $('#nbtn_upd_domain').attr("aria-disabled","true"); + }); + function check_d_btn(){ + var d_host=$("[id^=upd_dm_host]").find("input").val(); + var d_dns=$("[id^=upd_dm_dns]").find("input").val(); + var d_netbios=$("[id^=upd_dm_netbios]").find("input").val(); + var d_forest=$("[id^=upd_dm_forest]").find("input").val(); + var d_site=$("[id^=upd_dm_site]").find("input").val(); + if (d_host==="" || d_dns==="" || d_netbios==="" || d_forest==="" || d_site==="" || d_host===null || d_dns===null || d_netbios===null || d_forest===null || d_site===null ) { + $('#nbtn_upd_domain').attr("aria-disabled","true"); + defaultTokens.set("tok_dm_btn", "true") + } else { + $('#nbtn_upd_domain').attr("aria-disabled","false"); + defaultTokens.set("tok_dm_btn", "false") + } + } + check_d_btn() +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_wiz_flow.js b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_wiz_flow.js new file mode 100644 index 00000000..8a5996df --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_ad_obj_wiz_flow.js @@ -0,0 +1,236 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/tableview', + 'splunkjs/mvc/searchmanager', + 'splunkjs/mvc/postprocessmanager', + '../app/ms_windows_ad_objects/components/ms_ad_obj_modal/ms_ad_obj_modal_popup', + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, mvc, TableView, SearchManager,PostProcessManager,ms_ad_obj_modal_preview) { + $(document).ready(function () { + const exec_flg="0"; + var defaultTokenModel = mvc.Components.get('default'); + var submittedTokenModel = mvc.Components.get('submitted'); + //Set Tokens Values + function setToken(name, value, submit) { + if (defaultTokenModel && typeof name !== 'undefined') { + if(value=="undefined"){ + defaultTokenModel.unset(name) + } else { + defaultTokenModel.set(name, value); + } + } + if (!!submit) { + submitTokens(); + } + } + // Copy defaultTokems values into submittedTokens + function submitTokens() { + if (submittedTokenModel && defaultTokenModel) { + submittedTokenModel.set(defaultTokenModel.toJSON()); + } + } + var base_tut_srch = splunkjs.mvc.Components.get("base_tut_nav"); + var src_part_details = splunkjs.mvc.Components.get("base_tut_nav_details"); + var src_part_states = splunkjs.mvc.Components.get("sub_part_state_details"); + var src_step_states = splunkjs.mvc.Components.get("sub_step_state_details"); + src_part_details.on('search:done', function(properties) { + $("#row_single").hide() + $("#row_sub").hide() + var def_part_details_results = src_part_details.data("results"); + def_part_details_results.on("data", function() { + if(def_part_details_results.hasData()) { + var def_p_details = def_part_details_results.data().rows; + defaultTokenModel.set("tok_uc_id",def_p_details[0][0]) + defaultTokenModel.set("tok_part_0_label",def_p_details[0][1]) + defaultTokenModel.set("tok_part_1_label",def_p_details[0][2]) + defaultTokenModel.set("tok_part_2_label",def_p_details[0][3]) + defaultTokenModel.set("tok_part_3_label",def_p_details[0][4]) + defaultTokenModel.set("tok_part_4_label",def_p_details[0][5]) + defaultTokenModel.set("tok_part_5_label",def_p_details[0][6]) + defaultTokenModel.set("tok_part_6_label",def_p_details[0][7]) + defaultTokenModel.set("tok_part_7_label",def_p_details[0][8]) + var pre_build_b_vid = def_p_details[0][9]; + var pre_build_b_view = def_p_details[0][10]; + var pre_build_b_srch = def_p_details[0][11]; + var pre_build_b_dash = def_p_details[0][12]; + var pre_build_b_rpt = def_p_details[0][13]; + var pre_build_init_show = def_p_details[0][14]; + if(pre_build_b_vid!="undefined"){ + //setToken("tok_pre_build_b_vid",pre_build_b_vid,false) + var obj_b_vid = '' + $("#content_vid_object").html(obj_b_vid) + } + if(pre_build_b_view!="undefined"){ + //setToken("tok_pre_build_b_view",pre_build_b_view,false) + var obj_b_view = '' + $("#content_view_object").html(obj_b_view) + } + if(pre_build_b_srch!="undefined"){ + //setToken("tok_pre_build_b_srch",pre_build_b_srch,false) + var obj_b_srch = '' + $("#content_srch_object").html(obj_b_srch) + } + if(pre_build_b_dash!="undefined"){ + //setToken("tok_pre_build_b_dash",pre_build_b_dash,false) + var obj_b_dash = '' + $("#content_dash_object").html(obj_b_dash) + } + if(pre_build_b_rpt!="undefined"){ + //setToken("tok_pre_build_b_rpt",pre_build_b_rpt,false) + var obj_b_rpt = '' + $("#content_rpt_object").html(obj_b_rpt) + //$("#content_dyn_rpt_object").hide() + } + if(pre_build_init_show!="undefined"){ + var pre_build_init_id="#content_"+pre_build_init_show + $(pre_build_init_id).show(); + } + }; + }); + }); + src_part_states.on('search:done', function(properties) { + var def_part_state_results = src_part_states.data("results"); + def_part_state_results.on("data", function() { + if(def_part_state_results.hasData()) { + var def_p_state = def_part_state_results.data().rows; + setToken("tok_next_part",def_p_state[0][0],false) //next_part + setToken("tok_previous_part",def_p_state[0][1],false) //previous_part + setToken("tok_show_part_next_btn",def_p_state[0][2],false) //show_part_next_btn + setToken("tok_label_part_next_btn",def_p_state[0][3],false) //label_part_next_btn + setToken("tok_show_part_prev_btn",def_p_state[0][4],false) //show_part_prev_btn + setToken("tok_total_parts",def_p_state[0][5],false) //total_parts + setToken("tok_set_part_0_tok",def_p_state[0][6],false) //set_part_0_tok + setToken("tok_part_0_state",def_p_state[0][7],false) //part_0_state + setToken("tok_set_part_1_tok",def_p_state[0][8],false) //set_part_1_tok + setToken("tok_part_1_state",def_p_state[0][9],false) //part_1_state + setToken("tok_part_1_compl",def_p_state[0][10],false) //part_1_compl + setToken("tok_set_part_2_tok",def_p_state[0][11],false) //set_part_2_tok + setToken("tok_part_2_state",def_p_state[0][12],false) //part_2_state + setToken("tok_part_2_compl",def_p_state[0][13],false) //part_2_compl + setToken("tok_set_part_3_tok",def_p_state[0][14],false) //set_part_3_tok + setToken("tok_part_3_state",def_p_state[0][15],false) //part_3_state + setToken("tok_part_3_compl",def_p_state[0][16],false) //part_3_compl + setToken("tok_set_part_4_tok",def_p_state[0][17],false) //set_part_4_tok + setToken("tok_part_4_state",def_p_state[0][18],false) //part_4_state + setToken("tok_part_4_compl",def_p_state[0][19],false) //part_4_compl + setToken("tok_set_part_5_tok",def_p_state[0][20],false) //set_part_5_tok + setToken("tok_part_5_state",def_p_state[0][21],false) //part_5_state + setToken("tok_part_5_compl",def_p_state[0][22],false) //part_5_compl + setToken("tok_set_part_6_tok",def_p_state[0][23],false) //set_part_6_tok + setToken("tok_part_6_state",def_p_state[0][24],false) //part_6_state + setToken("tok_part_6_compl",def_p_state[0][25],false) //part_6_compl + setToken("tok_set_part_7_tok",def_p_state[0][26],false) //set_part_7_tok + setToken("tok_part_7_state",def_p_state[0][27],false) //part_7_state + setToken("tok_part_7_compl",def_p_state[0][28],false) //part_7_compl + setToken("tok_part_compl_name",def_p_state[0][29],false)//part_id_name + }; + }); + }); + src_step_states.on('search:done', function(properties) { + var def_step_state_results = src_step_states.data("results"); + def_step_state_results.on("data", function() { + if(def_step_state_results.hasData()) { + var def_s_state = def_step_state_results.data().rows; + setToken("tok_next_step",def_s_state[0][0],false) + setToken("tok_previous_step",def_s_state[0][1],false) + var show_sub_panels=def_s_state[0][2] + var show_panel_left=def_s_state[0][3] + var show_panel_single=def_s_state[0][4] + var show_right_page=def_s_state[0][5] + var show_right_object=def_s_state[0][6] + var show_sub_steps=def_s_state[0][7] + setToken("tok_panel_left_link",def_s_state[0][8],false) + setToken("tok_panel_right_link",def_s_state[0][9],false) + setToken("tok_panel_single_link",def_s_state[0][10],false) + var emb_object_src=def_s_state[0][11] + var emb_object_type=def_s_state[0][12] + var emb_object_title=def_s_state[0][13] + var combo_right_object=def_s_state[0][14] + setToken("tok_show_step_next_part_btn",def_s_state[0][15],false) + setToken("tok_show_step_next_btn",def_s_state[0][16],false) + setToken("tok_show_step_prev_btn",def_s_state[0][17],false) + setToken("tok_show_step_0",def_s_state[0][18],false) + setToken("tok_show_step_1",def_s_state[0][19],false) + setToken("tok_show_step_2",def_s_state[0][20],false) + setToken("tok_show_step_3",def_s_state[0][21],false) + setToken("tok_show_step_4",def_s_state[0][22],false) + setToken("tok_show_step_5",def_s_state[0][23],false) + setToken("tok_show_step_6",def_s_state[0][24],false) + setToken("tok_show_step_7",def_s_state[0][25],false) + setToken("tok_show_step_8",def_s_state[0][26],false) + + if(show_sub_panels==="T"){ + if(show_panel_single==="T"){ + $("#row_single").show() + $("#row_sub").hide() + } else { + $("#row_single").hide() + $("#row_sub").show() + if(show_panel_left==="T") { + $("#pan_left").show() + } else { + $("#pan_left").hide() + } + if(show_right_page==="T") { + $("#pan_right_p_o").show() + //$("#h_r_n_page").show() + //$("#h_r_n_page .panel-body.html").show(); + } else { + $("#pan_right_p_o").hide() + //$("#h_r_n_page").hide() + //$("#h_r_n_page .panel-body.html").hide(); + } + if(show_right_object==="T") { + set_emb_f_panel(emb_object_type,emb_object_src,emb_object_title) + } else { + $("#pan_right_f").hide() + $("#content_dyn_f_title").hide() + if(combo_right_object==="T"){ + $("#h_r_o_object").hide() + } + } + if(show_sub_steps==="T") { + $("#ms_ad_obj_sub_step_wizard").show() + //$("#ms_ad_obj_sub_step_wizard_holder").show() + } else { + $("#ms_ad_obj_sub_step_wizard").hide() + //$("#ms_ad_obj_sub_step_wizard_holder").hide() + } + } + } else { + $("#row_single").hide() + $("#row_sub").hide() + } + }; + }); + }); + function set_emb_f_panel(obj_type,obj_src,obj_title) { + $("#pan_right_f").show(); + $("#h_r_f_object").show(); + $("#pan_right_p_o").hide(); + $("#content_vid_object").hide(); + $("#content_srch_object").hide(); + $("#content_view_object").hide(); + $("#content_dash_object").hide(); + $("#content_rpt_object").hide(); + //$("#h_r_s_object").hide(); + var obj_h_id='#content_'+obj_type + var obj_dyn_id='content_dyn_'+obj_type + var obj_dyn_h_id='#content_dyn_'+obj_type + if(obj_src!="undefined"){ + $(obj_dyn_h_id).attr("src",obj_src); + } + var obj_w_title_temp = '

'+obj_title+'

' + if(obj_title==="none"){ + $("#content_dyn_f_title").hide() + } else { + $(obj_dyn_h_id).html(obj_w_title_temp) + $("#content_dyn_f_title").show() + } + $(obj_h_id).show(); + $(obj_dyn_h_id).show() + } + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/ms_windows_ad_objects_icon.png b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_windows_ad_objects_icon.png new file mode 100644 index 00000000..77dbabe3 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/ms_windows_ad_objects_icon.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_1.png b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_1.png new file mode 100644 index 00000000..8af2ecd9 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_1.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_2.png b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_2.png new file mode 100644 index 00000000..e961628c Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_2.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_3.png b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_3.png new file mode 100644 index 00000000..311be440 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_3.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_4.png b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_4.png new file mode 100644 index 00000000..f02e007e Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_4.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_5.png b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_5.png new file mode 100644 index 00000000..18d00bd0 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_5.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_6.png b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_6.png new file mode 100644 index 00000000..ed8e4416 Binary files /dev/null and b/deployment-apps/ms_windows_ad_objects/appserver/static/number_icon_6.png differ diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/showtokens.css b/deployment-apps/ms_windows_ad_objects/appserver/static/showtokens.css new file mode 100644 index 00000000..89a44fed --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/showtokens.css @@ -0,0 +1,42 @@ +.show-tokens { + background: white; + border-top: 1px solid #ccc; +} +.show-tokens h3 { + padding-left: 20px; +} +.show-tokens .token-name, .show-tokens .token-value { + font-family: monospace; +} +.show-tokens .token-name { + color: #d85d3c; +} +.show-tokens .token-value { + color: #333; +} +.show-tokens .token-value.undefined { + color: #999; +} +.show-tokens .form-switch { + float: right; + padding-right: 20px; + padding-top: 6px; +} + +/* Dark Theme */ + +.show-tokens.dark { + background: #31373E; + border-top: 1px solid #31373E; + border-bottom: 1px solid #31373E; +} + +.show-tokens.dark .token-name { + color: #AF575A; +} +.show-tokens.dark .token-value { + color: #FFFFFF; +} +.show-tokens.dark .token-value.undefined { + color: #999; +} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/showtokens.js b/deployment-apps/ms_windows_ad_objects/appserver/static/showtokens.js new file mode 100644 index 00000000..13dede9d --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/showtokens.js @@ -0,0 +1,109 @@ +/* TODO: jink to replace theme_utils with that from core */ +require.config({ + paths: { + app: '../app', + theme_utils: '../app/simple_xml_examples/theme_utils' + } +}); + +require([ + 'theme_utils', + 'splunkjs/mvc/simplexml/ready!', + 'css!app/simple_xml_examples/showtokens.css' + ], +function(themeUtils) { + var _ = require('underscore'); + var $ = require('jquery'); + var Backbone = require('backbone'); + var mvc = require('splunkjs/mvc'); + var defaultTokenModel = mvc.Components.get('default'); + var submittedTokenModel = mvc.Components.get('submitted'); + var urlTokenModel = mvc.Components.get('url'); + var models = [defaultTokenModel, submittedTokenModel, urlTokenModel]; + var isDarkTheme = themeUtils.getCurrentTheme && themeUtils.getCurrentTheme() === 'dark'; + + var TokenDebugView = Backbone.View.extend({ + className: 'show-tokens', + initialize: function() { + this.model = new Backbone.Model({ includeFormTokens: false }); + this.listenTo(this.model, 'change', this.render); + this.listenTo(defaultTokenModel, 'change', this.render); + this.listenTo(submittedTokenModel, 'change', this.render); + this.listenTo(urlTokenModel, 'change', this.render); + }, + events: { + 'click .checkbox a': function(e) { + e.preventDefault(); + this.model.set('includeFormTokens', !this.model.get('includeFormTokens')); + } + }, + render: function() { + this.$el.addClass('show-tokens'); + if (isDarkTheme){ + this.$el.addClass('dark'); + } + if (this.$el.is(':empty')) { + this.$el.html(this.template); + } + + var includeFormTokens = this.model.get('includeFormTokens'); + this.$('.checkbox>a>i')[includeFormTokens ? 'show' : 'hide'](); + + var tbody = this.$('tbody'); + tbody.empty(); + + var keys = _.union.apply(_, _(models).invoke('keys')); + + if (!includeFormTokens) { + keys = _(keys).filter(function(k) { return k.indexOf('form.') !== 0; }); + } + + keys.sort(); + + _(keys).each(function(token) { + var tr = $(''); + $('').text('$' + token + '$').appendTo(tr); + _(models).each(function(ns) { + var td = $('').appendTo(tr); + var val = ns.get(token); + if (val === undefined) { + td.addClass('undefined').text('undefined'); + } else { + if (_.isString(val)) { + td.text(val); + } else { + $('').text(JSON.stringify(val)).appendTo(td); + } + } + }); + tr.appendTo(tbody); + }); + + return this; + }, + template: '
' + + '' + + '
' + + '

Token Debug Info

' + + '' + + '' + + '' + + ' ' + + ' ' + + ' ' + + ' ' + + '' + + '' + + '' + + '
TokenDefaultSubmittedURL
' + }); + + var ct = $('#show-tokens'); + if (!ct.length) { + ct = $('
').insertAfter($('.dashboard-body')); + } + window.tokenDebug = new TokenDebugView({ el: ct }).render(); +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/table_decoration.css b/deployment-apps/ms_windows_ad_objects/appserver/static/table_decoration.css new file mode 100644 index 00000000..f52ff403 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/table_decoration.css @@ -0,0 +1,40 @@ +td.icon { + text-align: center; +} +td.icon i { + font-size: 21px; + text-shadow: 1px 1px #aaa; +} +td.icon .False { + color: #E53935; +} +td.icon .True { + color: #66BB6A; +} + +.icon-inline i { + font-size: 18px; + margin-left: 5px; +} +.icon-inline i.icon-alert-circle { + color: #ef392c; +} +.icon-inline i.icon-alert { + color: #ff9c1a; +} +.icon-inline i.icon-check { + color: #5fff5e; +} + +div[id^='decorated_table'] table tr td { + text-align: left;; +} + +div[id^='decorated_table'] table thead { + display: none; +} + +div[id^='decorated_table'] table tr td:first-child{ + font-weight: bold; + color: #333; +} \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/table_decoration.js b/deployment-apps/ms_windows_ad_objects/appserver/static/table_decoration.js new file mode 100644 index 00000000..4433d7a6 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/table_decoration.js @@ -0,0 +1,35 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/tableview', + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, mvc, TableView) { + var ICONS = { + False: 'x', + True: 'check' + }; + var tables = ['decorated_table', 'topology_table']; + + var RangeMapIconRenderer = TableView.BaseCellRenderer.extend({ + canRender: function(cell) { + return ['True', 'False'].indexOf(cell.value) > -1; + }, + render: function($td, cell) { + if (ICONS.hasOwnProperty(cell.value)) { + icon = ICONS[cell.value]; + $td.addClass('icon').html(_.template('', { + icon: icon, + value: cell.value + })); + } + } + }); + + _.each(tables, function(table) { + if (!mvc.Components.get(table)) return; + mvc.Components.get(table).getVisualization(function(tableView){ + tableView.addCellRenderer(new RangeMapIconRenderer()); + }); + }); +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/temp_custom_icons.js b/deployment-apps/ms_windows_ad_objects/appserver/static/temp_custom_icons.js new file mode 100644 index 00000000..a1cdc8ad --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/temp_custom_icons.js @@ -0,0 +1,38 @@ + require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/tableview', + 'splunkjs/mvc/simplexml/ready!' + ], function(_, $, mvc, TableView) { + var status_array = []; + var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ + canRender: function(cell) { + //return cell.field; + return cell.field === "Status"; + }, + render: function($td, cell) { + // Requires the Status column to contain an string array with "Icon Class", "Status Label", "Status Color", in that order and with a comma seperator: + // example ("icon-check-circle,OK,green") + // NOTE: You can also use hex colors like #49B849 for the Status Color + status_array = cell.value.split(","); + var status_icon = status_array[0] + var status_name = status_array[1] + var status_color = status_array[2] + $td.html("
("+status_name+")
") + } + }); + $(document).ready(function () { + var defaultTokenModel = mvc.Components.get('default'); + defaultTokenModel.on("change:refresh_table", function(e) { + var sh = mvc.Components.get("sample"); + if(typeof(sh)!="undefined") { + sh.getVisualization(function(tableView) { + // Add custom cell renderer and force re-render + tableView.table.addCellRenderer(new CustomRangeRenderer()); + tableView.table.render(); + }); + } + }); + }); +}); \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/temp_example_customtables.css b/deployment-apps/ms_windows_ad_objects/appserver/static/temp_example_customtables.css new file mode 100644 index 00000000..5b0413ca --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/temp_example_customtables.css @@ -0,0 +1,24 @@ +/* custom.css */ + +/* Define icon styles */ + +td.icon { + text-align: center; +} + +td.icon i { + font-size: 15px; + text-shadow: 1px 1px #aaa; +} + +td.icon .severe { + color: red; +} + +td.icon .elevated { + color: orangered; +} + +td.icon .low { + color: #006400; +} diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/temp_example_customtables.js b/deployment-apps/ms_windows_ad_objects/appserver/static/temp_example_customtables.js new file mode 100644 index 00000000..2b038b39 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/temp_example_customtables.js @@ -0,0 +1,133 @@ +require([ + "underscore", + "splunkjs/mvc/searchmanager", + "splunkjs/mvc/tableview", + "splunkjs/mvc/simplexml/ready!" +], function( + _, + SearchManager, + TableView +) { + + // Set up search managers + var search1 = new SearchManager({ + id: "search1", + search: "index=_internal | head 10000 | stats sparkline count by sourcetype | rangemap field=count low=0-100 elevated=101-1000 default=severe", + earliest_time: "-1h@h", + latest_time: "now", + preview: true, + cache: true + }); + + var search2 = new SearchManager({ + id: "search2", + preview: true, + cache: true, + search: "index=_internal | stats count by sourcetype, source, host" + }); + + // Create a table + var myplaintable = new TableView({ + id: "table-plain", + managerid: "search1", + el: $("#table-plain") + }).render(); + + // Create a custom table and set sparkline properties + var mycustomcelltable = new TableView({ + id: "table-customcell", + managerid: "search1", + el: $("#table-customcell"), + // Format the sparkline cell + format: { + "sparkline": [ // This field name is required + { + "type": "sparkline", // This property must be "sparkline" + + // Sparkline options + "options": + { + "type": "bar", + "height": "40px", + "barWidth": "5px", + "colorMap": + { + "100:": "#0033CC", + ":99": "#00FF00" + } + } + } + ] + } + }); + + // Create a table for a custom row expander + var mycustomrowtable = new TableView({ + id: "table-customrow", + managerid: "search2", + drilldown: "none", + el: $("#table-customrow") + }); + + // Define icons for the custom table cell + var ICONS = { + severe: "alert-circle", + elevated: "alert", + low: "check-circle" + }; + + // Use the BaseCellRenderer class to create a custom table cell renderer + var CustomCellRenderer = TableView.BaseCellRenderer.extend({ + canRender: function(cellData) { + // This method returns "true" for the "range" field + return cellData.field === "range"; + }, + + // This render function only works when canRender returns "true" + render: function($td, cellData) { + console.log("cellData: ", cellData); + + var icon = "question"; + if(ICONS.hasOwnProperty(cellData.value)) { + icon = ICONS[cellData.value]; + } + $td.addClass("icon").html(_.template('', { + icon: icon, + range: cellData.value + })); + } + }); + + // Use the BasicRowRenderer class to create a custom table row renderer + var CustomRowRenderer = TableView.BaseRowExpansionRenderer.extend({ + canRender: function(rowData) { + console.log("RowData: ", rowData); + return true; + }, + + render: function($container, rowData) { + // Print the rowData object to the console + console.log("RowData: ", rowData); + + // Display some of the rowData in the expanded row + $container.append("
" + + "rowIndex: " + rowData.rowIndex + "
" + + "colspan: " + rowData.colspan + "
" + + "fields: " + rowData.fields + "
" + + "values: " + rowData.values + + "
"); + } + }); + + // Create an instance of the custom cell renderer, + // add it to the table, and render the table + var myCellRenderer = new CustomCellRenderer(); + mycustomcelltable.addCellRenderer(myCellRenderer); + mycustomcelltable.render(); + + // Create an instance of the custom row renderer, + // add it to the table, and render the table + var myRowRenderer = new CustomRowRenderer(); + mycustomrowtable.addRowExpansionRenderer(myRowRenderer); + mycustomrowtable.render(); +}); diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_compl.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_compl.html new file mode 100644 index 00000000..f9eba4fe --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_compl.html @@ -0,0 +1,264 @@ +
+
+
+

+ Click to Build All AD Lookups + + + Click to Build AD_Obj_User Lookup First + + + Click to Migrate All AD Lookups + + +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
LookupBuild StatusObject CountStatus MessageView Results
AD_Obj_Domain + (Success) + $tok_count_domain_build$Initial Building of the AD_Obj_Domain Lookup is successfully completed. + View Lookup +
AD_Obj_Users + ($tok_status_user_build$) + $tok_count_user_build$$tok_msg_user_build$ + View Lookup + Analyze Failed Search +
AD_Obj_Computers + ($tok_status_computer_build$) + $tok_count_computer_build$$tok_msg_computer_build$ + View Lookup + Analyze Failed Search + Build AD_Obj_Computer Lookup +
AD_Obj_Group + ($tok_status_group_build$) + $tok_count_group_build$$tok_msg_group_build$ + View Lookup + Analyze Failed Search + Analyze Failed Search + Build AD_Obj_Group Lookup +
AD_Obj_OU + ($tok_status_ou_build$) + $tok_count_ou_build$$tok_msg_ou_build$ + View Lookup + Analyze Failed Search + Build AD_Obj_OU Lookup +
AD_Obj_GPO + ($tok_status_gpo_build$) + $tok_count_gpo_build$$tok_msg_gpo_build$ + View Lookup + Analyze Failed Search + Build AD_Obj_GPO Lookup +
AD_Obj_GPO and AD_Obj_OU Links + ($tok_status_gpo_ou_link$) + $tok_count_gpo_ou_link$$tok_msg_gpo_ou_link$ + View Lookup + Analyze Failed Search +
AD_Obj_Admin_Audit + ($tok_status_admin_audit_build$) + $tok_count_admin_audit_build$$tok_msg_admin_audit_build$ + View Lookup + Analyze Failed Search + Build AD_Obj_Admin_Audit Lookup +
+
+ +
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_det.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_det.html new file mode 100644 index 00000000..b0e6a1e2 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_det.html @@ -0,0 +1,478 @@ +
+

+ Deployment Tasks: Install the Splunk Universal Forwarders software on the target Windows Systems + Deployment Tasks: Manually Copy the pre-configured Windows TA's to the target windows systems. + Deployment Tasks: Install the Splunk Cloud Credentials app on the Splunk Universal Forwarders. +

+
+
+ + + + +
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Universal Forwarder on the Target Systems
+

We will now cover the steps to enable and configure the Receiving Port on your Splunk Indexer(s) using the Splunk Web console.

+
  • Now you need to install a Universal Forwarder on each of the Windows servers from which you want data. The easiest way to do this is to run the installer on your server.
+
+
    +
  • Configure a receiver using the command line: +
      +
    1. If you didn't previously Download the Splunk Universal Forwarder, then Click Here to download it to your local system. You can then copy it to a network share that the target systems have access to.
      2. +
    2. Double-click the MSI file to start the installation.
      3. +
    3. (Optional) To view the license agreement, click the "View License Agreement" button.
      4. +
    4. Select the Check this box to accept the License Agreement check box.
      5. +
    5. +
      + Uncheck the Use this UniversalForwarder with on-premises Splunk Enterprise... checkbox + Check the Use this UniversalForwarder with on-premises Splunk Enterprise... checkbox + Check the Use this UniversalForwarder with on-premises Splunk Enterprise... checkbox + Check the Use this UniversalForwarder with on-premises Splunk Enterprise... checkbox +
      +
      6. +
    6. To change any of the default installation settings, click the "Customize Options" button and open the below toggle view Customize Options to see the steps. Otherwise, click Next to proceed to the next steps. +
      + + "Customize Options" + +
        +
      1. (Optional) Click Change to specify a different installation directory.
        2. + +
      2. +
        (Optional) Select an SSL certificate to verify the identity of this machine.
        +
          +
        • Depending on your certificate requirements, you might need to specify a password and a Root Certificate Authority (CA) certificate to verify the identity of the certificate. If not, these fields can be left blank.
          • +
        +
        +
        3. +         +
      3. Select the Local System (Recommended) or Domain Account check box and click Next +
          +
        • If you specify Local System, the installer displays the Enable Windows Inputs dialog box.
          • +
        • If you specify Domain account, the installer displays a second dialog box where you enter domain and user information.
          • +
        +
        4. +
      4. If you selected "Domain account", the installer displays a dialog box for user name and password credentials. Enter the user name and password into the User name and Password fields. Specify the user name in domain\username format only, or the installation can fail. +
          +
        • Enter the password again in the Confirm password field.
          • +
        • To add the domain user you specified to the local Administrators group, select the "Add user as local administrator" check box and click Next. The installer adds the domain user you specified to the local Administrators group. +
            +
          • If you do not select the "Add user as local administrator" check box, the universal forwarder installs in "low-privilege" mode. See "Run the universal forwarder in low-privilege mode" later in this topic for additional information and caveats.
            • +
          +
          • +
        +
        5. +
      5. Do Not Enable any of these inputs. This will be done by the pre-defined TA's that will be deployed to the target Systems. Click Next.
        6. +
      +

      End of Customization Steps:

      +
      +
      +
      7. +
    7. +
      Create credentials for the Splunk administrator user, then click Next. +
      • You must complete this action, as installation of the universal forwarder cannot proceed without it. If you do not specify a username, the universal forwarder installer creates the admin user during the installation process.
      +
      8. + +
    8. In the In the Deployment Server field, enter the name of the deployment server. For example, win2016-splk-ds. As a best practice, include the full DNS name. For the port, enter port 8089 to allow the Universal Forwarder to communicate with the deployment server. Then click Next.
      9. +       + +
    9. In the Deployment Server pane, leave the value blank since you are not leveraging a Splunk Deployment Server, and click Next.
      10. +       + +
    10. In the Receiving Indexer pane, enter a host name or IP address and the receiving port for the Splunk Indexer(s) that you want the universal forwarder to send data to and click Next.
      11. +       + +
    11. In the Receiving Indexer pane, enter a host name or IP address and the receiving port for the Splunk Heavy/Gateway Forwarder that you want the universal forwarder to send data to and click Next.
      12. +       + +
    12. In the Receiving Indexer pane, enter a host name or IP address and the receiving port for the Splunk Heavy/Gateway Forwarder that you want the universal forwarder to send data to and click Next.
      13. +       + +
    13. In the Receiving Indexer pane, leave the value blank and click Next.
      14. +       +
    14. Click Install to proceed.
      15. +
    15. The installer runs and displays the Installation Completed dialog. The universal forwarder starts automatically.
      16. +
    16. From the Control Panel, confirm that the SplunkForwarder service runs.
      17. +
    +
    • +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Copy the Pre-Defined TA's to your target Windows Systems.
+

Complete the below 3 steps while leveraging the table above each step for guidance.

+
+
+ + + + + + + + + + + + + + + + +
+ + + + + + + + + + + +
+
    +

  • Validate - Network Share with previously prepared Windows TA's (\\Network_Share\Splunk UF TAs\)

    • +
+
+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Base Windows +
          +
        • ...\Splunk_TA_windows
          • +
        +
        • +
      • ...\Domain Controllers +
          +
        • ...\Splunk_TA_windows
          • +
        • ...\Splunk_TA_windows_dc
          • +
        +
        • +
      • ...\AD admon Monitor +
          +
        • ...\Splunk_TA_windows_admon
          • +
        +
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. First, review the above list, \\Network Share\Splunk UF TAs\, against your directory, if it is different then review the previous Preparation Task: Prepare the TA Examples for Deploying to your Splunk Universal Forwarders to verify all the steps were completed.
    2. +
+
+
+

+ + + + + + + + + + + + + + + + +
+
    +

  • Deploy Windows TA's to all targeted AD Domain Controllers

    • +
+
+

\\Network_Share\Splunk UF TAs\Domain Controllers\

+ 		+

...\Splunk_UniversalForwarder\etc\apps\

+
+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Domain Controllers +
          +
        • ...\Splunk_TA_windows
          • +
        • ...\Splunk_TA_windows_dc
          • +
        +
        • +
      • ...\AD admon Monitor +
          +
        • ...\Splunk_TA_windows_admon
          • +
        +
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • ...\SplunkUniversalForwarder +
      +
    • ...\etc +
        +
      • ...\apps
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Login to the target AD Domain Controller Server
    2. +
  2. Using a file explorer, navigate to the \\Network_Share\Splunk UF TAs\Domain Controllers\ directory.
    3. +
  3. Copy both the complete Splunk_TA_windows AND Splunk_TA_windows_dc folders.
    4. +
  4. Paste them on the local system in the ...\Splunk_UniversalForwarder\etc\apps\ directory.
    5. +
  5. +
    +
    Required: Complete the following addition steps on Only One of your AD Domain Controllers Per AD Domain: +
    +
      +
    1. Using a file explorer, navigate to the \\Network_Share\Splunk UF TAs\AD admon Monitor\ directory.
      2. +
    2. Copy the complete Splunk_TA_windows_admon folder.
      3. +
    3. Paste it on the local system in the ...\Splunk_UniversalForwarder\etc\apps\ directory.
      4. +
    +
      +
    • +
      You can use a Member Server (Non-Domain Controller) for collecting the admon data instead of an AD Domain Controller, but it does have some con's, such as slower extraction speeds and requiring the Splunk Universal Forwarder to run as an AD Domain Account.
      +
      • +
    +
    +
    +
    +
    6. +
  6. Restart the Splunk Forwarder Service.
    7. +
+
+
+

+ + + + + + + + + + + + + + + + +
+
    +

  • Deploy Windows TA's to all targeted Member Servers

    • +
+
+

\\Network_Share\Splunk UF TAs\Base Windows\

+ 		+

...\Splunk_UniversalForwarder\etc\apps\

+
+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Base Windows +
          +
        • ...\Splunk_TA_windows
          • +
        +
        • +
      • ...\AD admon Monitor +
          +
        • ...\Splunk_TA_windows_admon
          • +
        +
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • ...\SplunkUniversalForwarder +
      +
    • ...\etc +
        +
      • ...\apps
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Login to the target Windows Member Server (Non-AD Domain Controller)
    2. +
  2. Using a file explorer, navigate to the \\Network_Share\Splunk UF TAs\Base Windows\ directory.
    3. +
  3. Copy the complete Splunk_TA_windows folder.
    4. +
  4. Paste it on the local system in the ...\Splunk_UniversalForwarder\etc\apps\ directory.
    5. +
  5. +
    +
    Only do this step if you did not deploy the Splunk_TA_windows_admon TA to one of your AD Domain Controllers in Step 2. Perform the below steps on Only one Member Server Per AD Domain: +
    +
      +
    1. Using a file explorer, navigate to the \\Network_Share\Splunk UF TAs\AD admon Monitor\ directory.
      2. +
    2. Copy the complete Splunk_TA_windows_admon folder.
      3. +
    3. Paste it on the local system in the ...\Splunk_UniversalForwarder\etc\apps\ directory.
      4. +
    +
      +
    • +
      If you choose to use a Member Server for collecting the admon data, then you will need to update the Splunk Forwarder service to run as an AD account that has Read rights to the Active Directory.
      +
      • +
    +
    +
    +
    +
    6. +
  6. Restart the Splunk Forwarder Service.
    7. +
+
+
+

+

Validate Configuration: Review the below table to verify the correct Windows TA's were deployed to the correct systems.

+ + + + +
+
+ + + + + + + + + + + + +
+

AD Domain Controllers

+ 		+

Member Servers

+
+
    +
  • ...\SplunkUniversalForwarder\etc\apps +
      +
    • ...\Splunk_TA_windows
      • +
    • ...\Splunk_TA_windows_dc
      • +
    • ...\Splunk_TA_windows_admon
      • +
    +
    • +
+ 		+
    +
  • ...\SplunkUniversalForwarder\etc\apps +
      +
    • ...\Splunk_TA_windows
      • +
    • ...\Splunk_TA_windows_admon
      • +
    +
    • +
+
+

The Splunk_TA_windows_admon TA needs to be on only one system per AD Domain, either a single AD Domain Controller OR Member Server per domain.

+
+
+
+
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Cloud Credentials App
+

We will now cover the steps to install the Splunk Cloud Credentials Application on the Splunk Universal Forwarder(s).

+
    +
  • If you didn't previously download the Splunk Cloud Credentials App Click for instructions.
    • +
  • If you already have the Splunk Cloud Credentials App installed on your Splunk Universal Forwarder, then skip to this step.
    • +
+
+
    +
  1. Login to your Splunk Universal Forwarder system.
    2. +
  2. Using File Explorer, open the Network Share where you downloaded the Splunk Cloud Credentials App
    3. +
  3. Copy the splunkclouduf.spl file and paste it into the $SPLUNK_HOME/etc/apps/ (Ex: C:\Program Files\SplunkUniversalForwarder\etc\apps) directory on your forwarder.
    4. +
  4. Open a command prompt window in RunAs Administrator mode and navigate into the $SPLUNK_HOME/bin/ (Ex: C:\Program Files\SplunkUniversalForwarder\bin) directory.
    5. +
  5. Run the following command: +
      +
    • Replace the <full path to splunkclouduf.spl> with the location of your $SPLUNK_HOME/etc/apps directory.
      • +
    • Replace the <username>:<password> with the Splunk username and password used when you installed the Splunk Universal Forwarder
      • +
    • +
      splunk install app <full path to splunkclouduf.spl> -auth <username>:<password>
      +
      • +
    • Example: splunk install app "C:\Program Files\SplunkUniversalForwarder\etc\apps\splunkclouduf.spl" -auth admin:myPassw0rd
      • +
    +
    6. +
  6. Restart your forwarder with the following command: +
    splunk restart.
    +
    7. +
+
+
+
+
+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_hold.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_hold.html new file mode 100644 index 00000000..d4bc8c03 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_hold.html @@ -0,0 +1,17 @@ +
+
+

Waiting for Deployment Task Selection:

+
+
+
+
+

+
+ Click on the View Steps button in the left panel, following the recommended order of tasks to complete. +
    +
  • After completing the required tasks, Click the Next button to proceed to the Check Data Task
    • +
+
+

+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_src.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_src.html new file mode 100644 index 00000000..594d8844 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_depl_task_src.html @@ -0,0 +1,93 @@ +
+

+ Deployment Tasks To Complete +

+
+
+ + + + +
+
+
+ + + + + + + + + +
+
+
+

+ Deployment Task: Install the Splunk Universal Forwarders software on the target Windows Systems +

+ 		+
+ View Steps +
+
+

+
This deployment task walks through the installation of the Splunk Universal Forwarders on your target Windows Systems.
+

+
+
+
+ + + + + + + + + +
+
+
+

+ Deployment Task: Manually Copy the pre-configured Windows TA's to the target windows systems. +

+ 		+
+ View Steps +
+
+

+
This deployment task walks through the distribution of the Windows TA's to the Splunk Universal Forwarders on your target Windows Systems.
+

+
+
+
+ + + + + + + + + +
+
+
+

+ Deployment Task: Install the Splunk Cloud Credentials app on the Splunk Universal Forwarders. +

+ 		+
+ View Steps +
+
+

+
This deployment task walks through the process of installing the Splunk Cloud Credentials app on the Splunk Universal Forwarders.
 +

+
+
+
+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_intro.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_intro.html new file mode 100644 index 00000000..9ff523f0 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_intro.html @@ -0,0 +1,282 @@ +
+

Introduction - MS Windows AD Objects - Getting Started and Data In Guide

+

The MS Windows AD Objects application leverages admon data for building and updating local AD Objects Splunk Lookups. These lookup files can be leveraged for looking up the latest (< 10 Minutes) AD attribute information of User, Groups, Group Policies, Organizational Units, and Computer AD objects. This app contains updated .conf files for the Splunk® for Windows Infrastructure for replacing the use of the Splunk® Support for Active Directory ldap queries in the searches/macros/pallete panels/dashboards to instead use the local Splunk AD Objects lookup files.

+
+ + + + + + +
+
+

+ Getting Started and Data In Guide Information +

+
+
What's in this Guide?
+
This Guide is specifically designed to help you not only configure the MS Windows Application, but also to help quickly get your Windows and Active Directory data in to Splunk.
+
To aligned the configuration steps to your Splunk Environment and Deplyoment needs, the 1. Scope Definition will collect some basic information about your environment and deployment plans.
+
+
+
How to use this Guide
+
Each Section Step of this guide builds on the previous Part, verify each of the previous steps or requirements have been completed before proceeding to the next Part.
+
+
+
Goals for the Guide
+
At the end, you will have your Windows/Active Directory data flowing into Splunk, have the MS Windows AD Objects application configured and well on your way to start leveraging the power of Splunk. +
+
+
+ + + +
+
Useful Information
+
New to Splunk: If you are new to Splunk, it is recommended to specifically follow the steps outlined, and then once you become more familiar with Splunk you can adjust the different configurations, like data/indexes/etc.
+
Current Splunk Ninja: If you are Splunk Ninja, it is recommended to still walk through this guide to ensure the required MS Windows AD Objects application's configuration steps are completed.
+
Upgrading Pre-Version 4.0 - MS Windows AD Objects: If you are upgrading the MS Windows AD Objects application from a version prior to Version 4.0, it is Highly recommended you walk through this guide, because this version has numureous enhancements that you will both want to take advantage of, and make sure there is no impact to any custom created dashboards/reports in the previous version.
+
+
+
+ 		+

+ Guide Part Descriptions +

+ + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+ Section Step 1: Scope Definition +
+
+ Required: This step is used to align the subsequent steps with your environment and deployment plans. +
+
+
+ + +
+
+ Section Step 2: Preparation +
+
+ Provides the preparation steps for the Splunk Core components, MS Windows AD Objects and TA Configuration. +
+
+
+ + +
+
+ Section Step 3: Deployment +
+
+ Covers the steps for distributing the previously configured Splunk Technical Add-Ons to the target Windows Systems. +
+
+
+ + +
+
+ Section Step 4: Check Data +
+
+ This section provides you a way of verifying, and troubleshooting previous configuration steps. +
+
+
+ + +
+
+ Section Step 5: Build Lookups +
+
+ This last section walks through the the final step of building the MS Windows AD Object's lookup tables. +
+
+
+
+
Section Step Navigation:
+
Use the Prev Next navigation buttons to progress through each Section or click on the Sections icon.
+
Click Here to view the Icon Legend for this guide
+
+ 		+

+ Application Architecture and Data Sources +

+
+ + + + + + + + + + + + + +

Required Applications

+ + + + + + + + + + + + + +
Splunk Add-On for Windows (Splunk_TA_windows)
This TA (Technical Add-On) is for base Windows data collection
MS Windows AD Objects
The MS Windows AD Objects application provides over 50+ dashboards, and reports that primarily leverage admon(ActiveDirectory) build and updated in KV Store lookups.
Splunk Cloud UF App (Splunk Cloud™ Only)
You install this app on your forwarder, heavy forwarder, or on your deployment server, and it allows you to easily connect to Splunk Cloud.
+
    +
  • The MS Windows AD Objects application provide pre-configured TA inputs for collecting windows and Active Directory data. These are provided to help get you started with best practices, but they can me adjusted for your specific needs. These Pre-defined TA's will be preceded by the icon in this guide ( Download TA Examples)
    • +
+
+
+ + Splunk Core: Installed Applications + + + + + + + +
+
    +

  • Splunk Cloud™ Managed Environment:

    +
      +
    • MS Windows AD Objects
      • +
    • Splunk Add-On for Windows (Splunk_TA_windows)
      • +
    +
    • +
  • A cloud support ticket will need to be open to add the Splunk Windows Add-On for Windows to the Splunk Cloud Search Heads.
    • +
  • Make sure Sharing is set to Global for all eventtypes, macros, and field extractions.
    • +
+
+
    +
  • +

    Splunk® Enterprise:

    +
      +
    • Splunk Search Head: +
        +
      • MS Windows AD Objects
        • +
      • Splunk Add-On for Windows (Splunk_TA_windows)
        • +
      +
      • +
    • Splunk Indexer: +
        +
      • Splunk Add-On for Windows (Splunk_TA_windows)
        • +
      +
      • +

    • Splunk Heavy Forwarder:

      +
        +
      • Splunk_TA_windows
        • +
      +
      • +

    • Splunk Deployment Server

      +
        +
      • +
      • Splunk_TA_windows (* Full App and local\inputs.conf)
        • +
      • Splunk_TA_windows_dc
        • +
      • Splunk_TA_windows_admon
        • + +
      +
      • +
    +
    • +
+
+
+
+
+ + Splunk Universal Forwarders: Applications + + + + + + + + + + + + + +
+ +
+
    +

  • Windows Member Servers:

    +
      +
    • Splunk_TA_windows (* Full App and local\inputs.conf)
      • +
    +
    • +
+
+
    +

  • All Domain Controllers:

    +
      +
    • Splunk_TA_windows (* Full App and local\inputs.conf)
      • +
    • Splunk_TA_windows_dc
      • + +
    +
    • +
+
+
    +

  • Admon Collection:

    +
      +
    • Only Deploy this TA to one AD Domain Controller per AD Domain +
        +
      • Splunk_TA_windows_admon
        • +
      +
        +
      • Note: If deploying to a Domain Controller the Splunk_TA_windows_admon will be deployed along with the Splunk_TA_windows and Splunk_TA_windows_dc that are specified in the All Domain Controllers section above.
        • +
      +
      • +
    +
    • +
+
+
+
+
+
+
+
+ \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_pop.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_pop.html new file mode 100644 index 00000000..eb05990b --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_pop.html @@ -0,0 +1,2728 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_det.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_det.html new file mode 100644 index 00000000..ea876f7c --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_det.html @@ -0,0 +1,2793 @@ +
+

+ Preparation Task Steps: Download required Splunk Packages + Preparation Task Steps: Prepare Splunk® Core Components + Preparation Task Steps: Prepare the Splunk Deployment Server component + Preparation Task Steps: Prepare the Splunk Heavy Forwarder component + Preparation Task Steps: Prepare the TA Examples for Deploying to your Splunk Universal Forwarders + Upgrade Task Steps: Adjust or verify required Splunk Knowledge Objects + Upgrade Task Steps: Compare Currently Deployed Inputs with Example Pre-Defined TAs. + Upgrade Task Steps: Review Changes, configuration notes and more with the latest MS Windows AD Objects version. +

+
+
+ + + + + + + + + + + + + + + + + + + +
+
+
+
+ + + + + +
+ + + + + + + +
Splunk® Enterprise Software
+
Download the Splunk Enterprise software that will be used to install the Splunk Deployment Server, that will aslo be your Splunk Heavy Forwarder.
 +
Download the Splunk Enterprise software that will be used to install the Splunk Heavy Forwarder Server.
 +
Download the Splunk Enterprise software that will be used to install the Splunk Deployment Server.
 +
Download the Splunk Enterprise software that will be used to install the Splunk Deployment Server and Splunk Heavy Forwarder.
 +
+
+
+
+ + + + + +
+
+ + + + + + + +
Splunk Universal Forwarder Software
Download the Splunk Universal Forwarder software that will be used for installing the forwarder on each of your target Windows systems.
+
+
+
+
+ + + + + +
+
+ + + + + + + +
MS AD Windows Objects TA Examples
These pre-defined inputs and TA's are configured to help get you started with optimal, recommended, input settings to getting Windows Data into your Splunk Environment.
+
+
+
+
+ + + + + +
+
+ + + + + + + +
Splunk Add-On for Microsoft Windows Splunk_TA_windows
Download the Splunk Add-On for Microsoft Windows application.
+
+
+
+
+ + + + + +
+
+ + + + + + + +
Splunk Cloud™ Universal Forwarder Credentials Application
+
    +
  1. Click Splunk Home Page
    2. +
  2. Click on the Universal Forwarder link to open the application where you can download the Splunk Cloud Credentials application.
    3. +
  3. Then click Download Universal Forwarder Credentials : +
    4. +
+
+
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Installing the Splunk Windows TA on the single Splunk Core Instance
+

We will now cover the steps to install and verify that the Splunk Add-on for Microsoft Windows is installed on your Splunk® Enterprise Core system.

+
  • You can skip the below steps if you already have the Splunk Add-on for Microsoft Windows installed on your Splunk® Enterprise Core system.
+
+
    +
  1. +
    Click Open Manage Applications to open the Application Management view in a separate tab.
    +
    2. +
  2. +
    Click Install From File.
    +
    3. +
  3. +
    Navigate to where you downloaded the Splunk Add-on for Microsoft Windows application.
    +
    4. +
  4. +
    Click the Upload button to install the Splunk Add-on for Microsoft Windows application on this instance.
    +
    5. +
  5. +
    Follow the prompts to complete the installation.
    +
    6. +
  6. +
    Click Restart Later Don't Restart the Splunk Instance until after you have completed all of the remaining Preparation Tasks listed in the left panel.
    +
    7. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Installing the Splunk Windows TA on the Distributed Splunk Core Instances
+

We will now cover the steps to install and verify that the Splunk Add-on for Microsoft Windows is installed on your Splunk® Enterprise Core Search Head(s) and Indexer(s).

+
  • You can skip the below steps if you already have the Splunk Add-on for Microsoft Windows installed on your Splunk Search Head(s) and Indexer(s).
+
+
    +
  1. +
    Current instance: Click Open Manage Applications to open the Application Management view in a separate tab. +
      +
    • Splunk Indexer(s): For performing these steps on the Splunk Indexer(s), Login to their UI and navigate to Apps menu dropdown > Manage Applications
      • +
    +
    +
    2. +
  2. +
    Click Install From File.
    +
    3. +
  3. +
    Navigate to where you downloaded the Splunk Add-on for Microsoft Windows application.
    +
    4. +
  4. +
    Click the Upload button to install the Splunk Add-on for Microsoft Windows application on this instance.
    +
    5. +
  5. +
    Follow the prompts to complete the installation.
    +
    6. +
  6. +
    Click Restart Later Don't Restart the Splunk Instance until after you have completed all of the remaining Preparation Tasks listed in the left panel.
    +
    7. +
  7. +
    Repeat the above steps for the Indexer(s) that will be receiving Windows Data and all Search Head(s).
    +
    8. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Installing the Splunk Windows TA in the Splunk Cloud™ environment
+

We will now cover the steps to install and verify that the Splunk Add-on for Microsoft Windows is installed in your Splunk Cloud™ environment.

+
  • You can skip the below steps if you already have the Splunk Add-on for Microsoft Windows installed in your Splunk Cloud™ environment.
+
+
    +
  1. +
    Click Splunk Home Page to open the Splunk Web Home page.
    +
    2. +
  2. +
    From the Splunk Web home page, click the Apps gear icon .
    +
    3. +
  3. +
    Click Browse more apps.
    +
    4. +
  4. +
    In the filter box, type in Windows Add-On.
    +
    5. +
  5. +
    Select the Install button for the Splunk Add-on for Microsoft Windows application to install the Splunk_TA_windows application. +
      +
    • + If the Splunk Add-on for Microsoft Windows app is not listed, or if the app indicates self-service installation is not supported, contact Splunk Support +
      • +
    + .
    +
    6. +
  6. +
    Follow the prompts to complete the installation.
    +
    7. +
  7. +
    After completing this step, proceed to the next Preparation Task section.
    +
    8. + +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Enable Receiving Port on the Splunk Core System
+

We will now cover the steps to enable and configure the Receiving Port on your Splunk Core System using the Splunk Web console.

+
  • You can skip the below steps if you already have the Receiving Port Port enabled on your Splunk Core System.
+
+
    +
  1. +
    Click Open Receiving Port Setting
    +
      +
    • If the above button does not work for your, navigate in the Splunk UI to Settings > Forwarding and receiving > Configure receiving.
      • +
    +
    2. +
  2. +
    If there is an existing receiver port open enabled, then you can either use this one or click the New Receiving Port button to create a new one. +
      +
    • You cannot create a duplicate receiver port.
      • +
    • The conventional receiver port on indexers is port 9997.
      • +
    +
    +
    3. +
  3. +
    Add a port number (default is 9997)
    +
    4. +
  4. +
    Click the Save button and proceed to the next Preparation Task section.
    +
    5. + +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Enable Receiving Port on the Splunk Indexer(s)
+

We will now cover the steps to enable and configure the Receiving Port on your Splunk Indexer(s) using the Splunk Web console.

+
  • You can skip the below steps if you already have the Receiving Port Port enabled on your Splunk Indexer(s).
+
+
    +
  1. +
    In a separate browser tab, login to your Splunk Indexer(s) with an user that has the admin role.
    +
    2. +
  2. +
    In the Splunk Web UI, navigate to Settings > Forwarder and Receiving > Receiving.
    +
    3. +
  3. +
    If there is an existing receiver port open enabled, then you can either use this one or click the New Receiving Port button to create a new one. +
      +
    • You cannot create a duplicate receiver port.
      • +
    • The conventional receiver port on indexers is port 9997.
      • +
    +
    +
    4. +
  4. +
    Add a port number (default is 9997)
    +
    5. +
  5. +
    Click the Save button and proceed to next Preparation Task section.
    +
    6. + +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Create and configure the indexes on your Splunk Core system
+
Create and configure the indexes on your Splunk Indexer(s)
+

We will now cover the steps to create the indexes that will store the Windows data sent from your Windows machines.

+
    +
  • + Important Note: If your Windows data is going to different indexes then what is listed below, then make sure to follow the steps on adjusting the macros in the next Preparation step (Adjust or verify Splunk Knowledge Objects). +
    • +
+
+
    +
    • +
  • In this step, you create the following indexes, if not already created: +
      +
    • +
      Multiple indexes defined are comma separated. Don't copy the comma, but just the individual name.
      +
      • +
    +
    +
    +
    • +
  • +
    +
    + + +
      +
    • It's a best practice to create separate indexes for different types of data.
      • +
    • This can be useful if you want different storage settings for different types of data. For example, you may need to store wineventlogs for a specified time period for compliance purposes.
      • +
    +
    +
    +
    • +
+
    +
  1. +
    Click Open Index Manager to open the indexes management view. +
      +
    • If the above button does not work for you then open a separate browser tab, connect to your Splunk Instance and Navigate to Settings > Indexes.
      • +
    +
    +
    2. +
  2. +
    In a separate browser tab Login to your Splunk Indexer's Web UI with a user that is part of the admin role.
    +
    3. +
  3. +
    Navigate to Settings > Indexes
    +
    4. +
  4. Click New
    5. +
  5. For the index name, enter one of the Indexes: from the above list.
    6. +
  6. For index data type, select Events
    7. +
  7. +
    Click below to review the details on Customizing the settings: +
      +
    • +
      +
      + + +
      For other below settings you can use the defaults or if you want to customize then Click Configure index storage to review more detailed information on these index settings. +
        +
      • +
        The path locations for index data storage: +
          +
        • Home path. Leave blank for default $SPLUNK_DB/<index_name>/db
          • +
        • Cold path. Leave blank for default $SPLUNK_DB/<index_name>/colddb
          • +
        • Thawed path. Leave blank for default $SPLUNK_DB/<index_name>/thaweddb
          • +
        +
        +
        • +
      • Enable/disable data integrity check.
        • +
      • The maximum size of the entire index. Defaults to 500000MB.
        • +
      • The maximum size of each index bucket. When setting the maximum size, use auto_high_volume for high volume indexes (such as the main index); otherwise, use auto.
        • +
      • The frozen archive path. Set this field if you want to archive frozen buckets. For information on bucket archiving, see Archive indexed data.
        • +
      • The app in which the index resides.
        • +
      • The tsidx retention policy. See Reduce tsidx usage.
        • +
      +
      +
      +
      +
      • +
    +
    +
    8. +
  8. +
    Click Save
    +
    9. +
  9. +
    Repeat these steps for all of the following indexes: If there multiple indexes defined, it will be comma separated.: +
    +
    +
    10. +
  10. +
    Repeat the all of the above steps on each of the indexers that will receive windows data.
    +
    11. +
  11. +
    After completing this step, proceed to the next Preparation section Adjust or verify Splunk Knowledge Objects.
    +
    12. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Create and configure the indexes in your Splunk Cloud™ environment
+

We will now cover the steps to create the indexes that will store the Windows data sent from your Windows machines.

+
    +
  • + Important Note: If your Windows data is going to different indexes then what is listed below, then make sure to follow the steps on adjusting the macros in the next Preparation step (Adjust or verify Splunk Knowledge Objects). +
    • +
+
+
    +
    • +
  • In this step, you create the following indexes, if not already created: +
      +
    • +
      Multiple indexes defined are comma separated. Don't copy the comma, but just individual name.
      +
      • +
    +
    +
    +
    • +
  • +
    +
    + + +
      +
    • It's a best practice to create separate indexes for different types of data.
      • +
    • This can be useful if you want different storage settings for different types of data. For example, you may need to store wineventlogs for a specified time period for compliance purposes.
      • +
    +
    +
    +
    • +
+
    +
  1. +
    Click Open Index Manager to open the indexes management view. +
      +
    • If the above button does not work for you then open a separate browser tab, connect to your Splunk Instance and Navigate to Settings > Indexes.
      • +
    +
    +
    2. +
  2. Click New Index.
    3. +
  3. For the index name, enter one of the Indexes: from the above list.
    4. +
  4. For index data type, select Events.
    5. +
  5. +
    For searchable time (days), enter 90. +
      +
    • Optionally, you can extend your storage for longer if you have different requirements. By default Splunk Cloud provides 90 days of searchable storage.
      • +
    +
    +
    6. +
  6. +
    Click No Additional Storage, and click Save +
      +
    • You can also set up different types of storage for expired Splunk Cloud data (such as self-storage or archiving).
      • +
    +
    +
    7. +
  7. +
    Repeat these steps for any of the following indexes that have not already been created. Multiple indexes defined are comma separated.: +
    +
    +
    8. +
  8. +
    After completing this step, proceed to the next Preparation section Adjust or verify Splunk Knowledge Objects.
    +
    9. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Adjust or verify Splunk Knowledge Objects
+

We will now cover the steps for adjusting the Splunk Knowledge Objects(Macro's) used by the MS Windows AD Object application for pointing to the indexes where the Windows data is stored.

+
+ + Auto Check Information: +
    +
  • An autocheck search was executed to check if the defined indexes in the required macros are available (created).
    • +
  • All of the indexes that are defined in the below macro's have been found. Although, it is still recommended to review the table below to make sure the created indexes align with the correct Data Type for each macro.
    • +
  • Review the below Troubleshooting Steps: +
      +
    • If created different index names for your Windows/Active Directory data, then follow the Adjusting the Macros used by the MS AD Windows Objects steps below.
      • +
    • Troubleshooting Steps if you created the recommended indexes (wineventlog,perfmon,msad,windows) +

      Verify Role Index Permissions:

      +
        +
      1. Click Review Roles to open the Roles page
        2. +
      2. Click on the Role(s) that is associated with your account
        3. +
      3. Click on the 3. Indexes Link
        4. +
      4. Verify that the Default box is selected for each of the created indexes (wineventlog,perfmon,msad,windows)
        5. +
      5. Click Save and Click the Rerun Autocheck button below to rerun the autocheck and update the results +
        • If it is still showing errors after running the above, and you are sure you created the default indexes, then you can proceed to the next Preparation item
        +
        6. +
      +
      • +
    • Click Rerun Autocheck to rerun the autocheck if you completed the above troubleshooting, or the below preparation steps below.
      • + + +
    +
    • +
+
+
+ + Current Index Macro Definitions: +
+
+
+

Adjusting the Macros used by the MS AD Windows Objects

+
    +
  1. +
    Click Macro Settings to open the settings page for the macros or click on the individual macro names below, to adjust the macro definition.
    +
    2. +
  2. +
    Use the below list to match up the custom indexes you created for your windows data with the appropriate macro:
    +
      +
    • Macro: ms__obj_win_events_index +
        +
      • All Windows Event Logs (ie. Security,Application,System,Directory Service,etc)
        • +
      +
      • +
    • Macro: ms__obj_win_perfmon_index +
        +
      • All Windows Performance Count Data (ie. Perfmon:CPU,Perfmon:Memory,etc)
        • +
      +
      • +
    • Macro: ms__obj_win_ad_index +
        +
      • All Active Directory Specific Data (ie. ActiveDirectory,DHCP,DNS,Powershell AD Scripts,etc)
        • +
      +
      • +
    • Macro: ms__obj_win_api_index +
        +
      • All Windows OS Api and Scripts (ie. WinHostMon,WinNetMon,Update Logs,etc)
        • +
      +
      • +
    +
    3. +
  3. +
    Click on the individual macro links to update the definition with your aligned custom indexes (Using OR for mulitple indexes. Ex. index=winosevt OR index=winossecurityevt).
    +
    4. +
  4. +
    Click Save after adjusting each of the above macros.
    +
    5. +
  5. +
    Click Rerun Autocheck to rerun the autocheck search to validate your changes.
    +
    6. + +
  6. +
    After adjusting the macros and verifying the changes, proceed to the next Preparation item.
    +
    7. +
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Deployment Server
+

The Deployment Server (DS) is an instance of Splunk Enterprise that you install on a Windows or Linux machine and configure pushes Splunk apps to the Splunk Universal Forwarders on your target Windows Systems.

+
    +
  • You can skip the below steps if you already have the Splunk Deployment Server installed in your Splunk environment.
    • +
  • Follow the below Steps for for the OS Type you will be installing the Deployment Server on.
    • +
  • If you didn't download the Splunk Enterprise software in the previous preparation steps, then Click Download to download the Splunk Enterprise software that will be used to install the Splunk Deployment Server.
    • +
  • Do not install on the same machine as a Splunk Universal Forwarder.
    • +
+
+
+ + Install Splunk Deployment Server on Windows +

You can install Splunk Enterprise on Windows with the Graphical User Interface (GUI)-based installer or from the command line. More options, such as silent installation, are available if you install from the command line. See Install on Windows from the command line for the command line installation procedure.

+
    +
  • You cannot install or run the 32-bit version of Splunk Enterprise for Windows on a 64-bit Windows machine. You also cannot install Splunk Enterprise on a machine that runs an unsupported OS. For example, you cannot install Splunk Enterprise on a machine that runs Windows Server 2003. See System requirements. If you attempt to run the installer in such a way, it warns you and prevents the installation.
    • +
  • +
    + + Before you install +
      +
    • Choose the Windows user Splunk should run as +
      • Before installing, see Info to determine which user account Splunk should run as to address your specific needs. The user you choose has ramifications on what you must do prior to installing the software, and more details can be found there.
      +
      • +
    • Disable or limit antivirus software if able +
        +
      • The Splunk Enterprise indexing subsystem requires high disk throughput. Any software with a device driver that intermediates between Splunk Enterprise and the operating system can restrict processing power available to Splunk Enterprise, causing slowness and even an unresponsive system. This includes anti-virus software.
        • +
      • You must configure such software to avoid on-access scanning of Splunk Enterprise installation directories and processes before you start a Splunk installation.
        • +
      +
      • +
    • Consider installing Splunk software into a directory with a short path name +
        +
      • By default, the Splunk MSI file installs the software to \Program Files\Splunk on the system drive (the drive that booted your Windows machine.) While this directory is fine for many Splunk software installations, it might be problematic for installations that run in distributed deployments or that employ advanced Splunk features such as search-head or indexer clustering.
        • +
      • The Windows API has a path limitation of MAX_PATH which Microsoft defines as 260 characters including the drive letter, colon, backslash, 256-characters for the path, and a null terminating character. Windows cannot address a file path that is longer than this, and if Splunk software creates a file with a path length that is longer than MAX_PATH, it cannot retrieve the file later. There is no way to change this configuration.
        • +
      • To work around this problem, if you know that the instance will be a member of a search head or indexer cluster, consider installing the software into a directory with a short path length, for example C:\Splunk or D:\SPL.
        • +
      +
      • +
    +
    +
    • +
  • Begin the installation +
      +
    1. Copy the previously downloaded Splunk Enterprise Software from the Network Share to the target Splunk Deployment Server system.
      2. +
    2. +
      To start the installer, double-click the splunk.msi file. The installer runs and displays the Splunk Enterprise Installer panel. +
      +
      3. +
    3. +
      To continue the installation, check the "Check this box to accept the License Agreement" checkbox. This activates the "Customize Installation" and "Next" buttons. +
        +
      • (Optional) If you want to view the license agreement, click View License Agreement.
        • +
      • +
        + + Next Step - Installation Options +

        The Windows installer gives you two choices: Install with the default installation settings, or configure all settings prior to installing. When you choose to install with the default settings, the installer does the following:

        + `
          +
        • Installs Splunk Enterprise in \Program Files\Splunk on the drive that booted your Windows machine.
          • +
        • Installs Splunk Enterprise with the default management and Web network ports.
          • +
        • Configures Splunk Enterprise to run as the Local System user.
          • +
        • Prompts you to create a Splunk administrator password. You must do this before installation can continue.
          • +
        • Creates a Start Menu shortcut for the software.
          • +
        +
        +
        • +
      +
      +
      4. +
    +
      +
    • +
      + + Continue with Customize Options +
        +
      1. +
        Click Customize Options button.
        +
        2. +
      2. +
        Click Change… to specify a different location to install Splunk Enterprise, or click Next to accept the default value.
        +
        3. +
      3. +
        The installer displays the "Choose the user Splunk Enterprise should run as" panel. Select a user type and click Next. +
          +
        • +
          If you selected the Local System user, proceed to Step 5. Otherwise, the installer displays the Logon Information: specify a username and password panel.
          +
          • +
        +
        +
        4. +
      4. +
        Enter the Windows credentials that Splunk Enterprise uses to run on the machine and click Next. +
        • These credentials are different from the Splunk administrator credentials that you create in the next step.
        +
        +
        5. +
      5. +
        Create credentials for the Splunk administrator user by entering a username and password that meets the minimum eligibility requirements as shown in the panel and click Next. +
        • You must perform this action as the installation cannot proceed without your completing it. If you do not enter a username, the installer creates the admin user during the installation process.
        +
        +
        6. +
      6. +
        The installer displays the installation summary panel. Click Install to proceed with the installation.
        +
        7. +
      7. +
        Click Finish. The installation completes, Splunk Enterprise starts and launches in a supported browser if you checked the appropriate box.
        +
        8. +
      +
      +
      • +
    • +
      + + Or Continue With Default Options +
        +
      1. +
        Click Next
        +
        2. +
      2. +
        Enter the Windows credentials that Splunk Enterprise uses to run on the machine and click Next. +
        • These credentials are different from the Splunk administrator credentials that you create in the next step.
        +
        +
        3. +
      3. +
        The installer displays the installation summary panel. Click Install to proceed with the installation.
        +
        4. +
      4. +
        Click Finish. The installation completes, Splunk Enterprise starts and launches in a supported browser if you checked the appropriate box.
        +
        5. +
      +
      +
      • +
    +
    • +
+
+
+ + Install Splunk Deployment Server on linux +

You can install Splunk Enterprise on Linux using RPM or DEB packages or a tar file, depending on the version of Linux your host runs.

+
    +
  • +
    + + Tar file installation +
      +
    • What to know before installing with a tar file: +
        +
      • >Knowing the following items helps ensure a successful installation with a tar file: +
          +
        • Some non-GNU versions of tar might not have the -C argument available. In this case, to install in /opt/splunk, either cd to /opt or place the tar file in /opt before you run the tar command. This method works for any accessible directory on your host file system.
          • +
        • Splunk Enterprise does not create the splunk user. If you want Splunk Enterprise to run as a specific user, you must create the user manually before you install.
          • +
        • Confirm that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.
          • +
        +
        • +
      +
      • +
    • Installation procedure: +
        +
      1. +
        Expand the tar file into an appropriate directory using the tar command: + 
        tar xvzf splunk_package_name.tgz
        +

        The default installation directory is splunk in the current working directory. To install into /opt/splunk, use the following command:

        + 
        tar xvzf splunk_package_name.tgz -C /opt
        +
        +
        2. +
      +
      • +
    +
    +
    • +
  • +
    + + RedHat RPM installation +
      +
    • RPM packages are available for Red Hat, CentOS, and similar versions of Linux.
      • +
    • The rpm package does not provide any safeguards when you use it to upgrade. While you can use the --prefix flag to install it into a different directory, upgrade problems can occur If the directory that you specified with the flag does not match the directory where you initially installed the software.
      • +
    • After installation, software package validation commands (such as rpm -Vp <rpm_file> might fail because of intermediate files that get deleted during the installation process. To verify your Splunk installation package, use the splunk validate files CLI command instead.
      • +
    +
      +
    1. Confirm that the RPM package you want is available locally on the target host.
      2. +
    2. Verify that the Splunk Enterprise user account that will run the Splunk services can read and access the file.
      3. +
    3. +
      If needed, change permissions on the file. + 
      chmod 644 splunk_package_name.rpm
      +
      +
      4. +
    4. +
      Invoke the following command to install the Splunk Enterprise RPM in the default directory /opt/splunk.
      + 
      rpm -i splunk_package_name.rpm
      +
      +
      5. +
    5. +
      (Optional) To install Splunk in a different directory, use the --prefix flag.
      + 
      rpm -i --prefix=/opt/new_directory splunk_package_name.rpm
      +
      +
      6. +
    +
      +

    • Automate RPM installation with Red Hat Linux Kickstart

      +
        +
      • +
        If you want to automate an RPM install with Kickstart, edit the kickstart file and add the following. + 
        ./splunk start --accept-license
+	./splunk enable boot-start
        +
        +

        Note: The enable boot-start line is optional.

        +
        +
        • +
      +
      • +
    +
    +
    + + Debian .DEB installation +
      +
    • Prerequisites to installation +
        +
      • You can install the Splunk Enterprise Debian package only into the default location, /opt/splunk.
        • +
      • This location must be a regular directory, and cannot be a symbolic link.
        • +
      • You must have access to the root user or have sudo permissions to install the package.
        • +
      • The package does not create environment variables to access the Splunk Enterprise installation directory. You must set those variables on your own.
        • +
      +

      Note: If you need to install Splunk Enterprise somewhere else, or if you use a symbolic link for /opt/splunk, then use a tar file to install the software.

      +
      • +
    • Installation procedure +
        +
      • +
        Run the dpkg installer with the Splunk Enterprise Debian package name as an argument.
        + 
        dpkg -i splunk_package_name.deb
        +
        +
        • +
      +

      Debian commands for showing installation status

      +
        +
      • Splunk package status: + 
        dpkg --status splunk
        +
        • +
      • List all packages: + 
        dpkg --list
        +
        • +
      +

      Information on expected default shell and caveats for Debian shells

      +
        +
      • Splunk Enterprise expects you to run commands from the bash shell. It expects bash to be available from /bin/sh.
        • +
      • On later versions of Debian Linux (for example, Debian Squeeze), the default shell is the dash shell.
        • +
      • Using the dash shell can result in zombie processes - processes that have completed execution, yet remain in the process table and cannot be killed or removed.
        • +
      • If you run Debian Linux, consider changing your default shell to be bash.
        • +
      +
      • +
    +
    +
    • +
  • Now that you have installed the Splunk Deployment Server: + +
    • +
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Configure HTTPS for Splunk Web.
+

We will now cover the steps to enable and configure the HTTPS on your Splunk Deployment Servers Web console.

+
  • This is a best practice for security. For additional security you can add your own certificate instead of using the default certificates.
+
+
    +
  1. +
    In a separate browser tab, login to your Splunk Indexer(s) with an user that has the admin role.
    +
    2. +
  2. +
    In a separate browser tab, login to your Splunk Deployment Server instance with an user that has the admin role.
    +
    3. +
  3. +
    Navigate to Settings > Server settings > General Settings
    +
    4. +
  4. +
    In the field, Enable SSL (HTTPS) in Splunk Web, click Yes, and click Save:
    +
    5. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Enable Receiver Port on Splunk Deployment Server
+

We will now cover the steps to enable and configure the Receiving Port on your Splunk Indexer(s) using the Splunk Web console.

+
  • You can skip the below steps if you already have the Receiving Port Port enabled on your Splunk Heavy or Gateway Forwarder System.
+
+
    +
  • Configure a receiver using the command line: +
      +
    1. Open a shell prompt
      2. +
    2. Change the path to $SPLUNK_HOME/bin
      3. +
    3. Type:splunk enable listen <port> -auth <username>:<password>.
      +
        +
      • Replace <port> with the port you will specify for your Splunk Universal Forwarders (Default is 9997)
        • +
      • Replace <username> and <password> with the username and password you used when you installed Splunk on this instance.
        • +
      • Example: splunk enable listen 9997 -auth admin:mysecretpassword
        • +
      +
      4. +
    4. Do Not Restart until all the Steps listed in the left panel have been completed.
      5. +
    5. Proceed to the next Preparation Item.
      6. +
    +
    • +
  • OR Configure a receiver port using the Splunk UI: +
      +
    1. +
      Log into Splunk Web on your Splunk Heavy/Gateway Forwarder as a user with the admin role.
      +
      2. +
    2. +
      In Splunk Web, go to Settings > Forwarding and receiving.
      +
      3. +
    3. +
      Select "Configure receiving."
      +
      4. +
    4. +
      Verify if there are existing receiver ports open. You cannot create a duplicate receiver port. The conventional receiver port on indexers is port 9997.
      +
      5. +
    5. +
      Select "New Receiving Port."
      +
      6. +
    6. +
      Add a port number (default is 9997)
      +
      7. +
    7. +
      Click the Save button.
      +
      8. +
    +
    • +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Cloud Credentials App
+

We will now cover the steps to install the Splunk Cloud Credentials Application on the Splunk Deployment Server.

+
    +
  • Click the cloud icon for a Diagram
    • +
  • If you didn't previously download the Splunk Cloud Credentials App Click for instructions.
    • +
  • If you already have the Splunk Cloud Credentials App installed on your Splunk Deployment Server, then skip to this step.
    • +
+
+
    +
  1. In a separate browser tab, login to your Splunk Deployment Server instance with an user that has the admin role.
    2. +
  2. Navigate to Apps menu dropdown > Manage Applications
    3. +
  3. Click Install From File.
    4. +
  4. In the pop directory window, go to the Network Share where you downloaded the Universal Forwarder Credentials application, and click on the splunkclouduf.spl file
    5. +
  5. Click the Upload button to install the Splunk Cloud Credentials application on the Deployment Server Instance.
    6. +
  6. Follow the prompts to complete the installation.
    7. +
  7. Click Restart Later. Don't Restart the Splunk Instance until after you have completed all of the remaining Preparation Tasks listed in the left panel.
    8. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Add-On for Microsoft Windows App
+

We will now cover the steps to install the Splunk Add-On for Microsoft Windows App Application on the Splunk Deployment Server.

+
  • If you already have the Splunk Add-Ons for Microsoft Windows installed on your Splunk Deployment Server, then skip to this step.
+
+
    +
  1. In a separate browser tab, login to your Splunk Deployment Server instance with an user that has the admin role.
    2. +
  2. Navigate to Apps menu dropdown > Manage Applications
    3. +
  3. Click Install From File.
    4. +
  4. In the pop directory window, go to the Network Share where you downloaded the Splunk_TA_windows application, and click on the Splunk_TA_windows.spl file
    5. +
  5. Click the Upload button to install the Splunk Add-On for Microsoft Windows application on the Deployment Server Instance.
    6. +
  6. Follow the prompts to complete the installation.
    7. +
  7. Click Restart Later. Don't Restart the Splunk Instance until after you have completed all of the remaining Preparation Tasks listed in the left panel.
    8. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Configure the licensing for the deployment server
+
+
    +
  1. +
    In a separate browser tab, login to your Splunk Deployment Server instance with an user that has the admin role.
    +
    2. +
  2. +
    From Settings > Licensing use the license to configure the Splunk instance as a deployment server. +
      +
    • If your a current customer then this is the license you requested from Splunk Support in your prerequisites.
      • +
    • If you doing a Proof of Concept then you can skip this step and use the temp license key
      • +
    +
    +
    3. +
  3. Click Restart Later Don't Restart the Splunk Instance until after you have completed all of the remaining Preparation Tasks listed in the left panel.
    4. +
  4. This completes this current Preparation section for the Splunk Deployment Server, proceed to the next Preparation section for this task.
    5. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Pre-Defined TA Configuration: Copy App(s) to the Splunk Deployment Server
+

Complete the below 3 steps, leveraging the table above the steps as a visual map for each step.

+
+
+ + + + + + + + + + + + + + + + +
+ + + + + + + + + + + + + +
+

Downloaded TA Copy Location

+ 		+

Target Splunk Deployment Server Directory

+
+
    +
  • \\Network_Share +
      +
    • ...\ms_ad_obj_ta_examples +
        +
      • ...\Splunk_TA_windows_dc\...
        • +
      • ...\Splunk_TA_windows_admon\...
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • ...\splunk +
      +
    • ...\etc +
        +
      • ...\deployment-apps
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Using a terminal/file explorer, navigate to the \\Network_Share\ms_ad_obj_ta_examples\ directory and copy the Splunk_TA_windows_dc, and Splunk_TA_windows_admon folders and paste them on the Splunk Deployment Server in the /splunk/etc/deployment-apps/ directory.
    2. +
  2. +
    +
    (Optional) Customize the following pre-defined inputs.conf. +
      +
      • +
    • For example, if you created different indexes to store your Windows data than (wineventlog, perfmon, mead, windows), then you will need to update each inputs index = …. setting with your aligned indexes.
      • +
    +
    +
    +
    3. +
+
+
+

+ + + + + + + + + + + + + +
+

Source Splunk Deployment Server Directory

+ 		+

Target Splunk Deployment Server Directory

+
+
    +
  • ...\splunk +
      +
    • ...\etc +
        +
      • ...\apps +
          +
        • ...\Splunk_TA_windows\...
          • +
        +
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • ...\splunk +
      +
    • ...\etc +
        +
      • ...\deployment-apps
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. +
    +
    Using a terminal/file explorer, navigate on the Splunk Deployment Server to ...\splunk\etc\apps\ directory.
    +
    +
    2. +
  2. +
    +
    Copy the Splunk_TA_windows folder and paste it on the same system in the /splunk/etc/deployment-apps/ directory. +
      +
    • If you did not install the Splunk Add-On for Microsoft Windows application on your Splunk Deployment Server, then you can download it here, then extract it and place the Splunk_TA_windows folder into the /splunk/etc/deployment-apps/ on the Splunk Deployment Server.
      • +
    +
    +
    +
    3. +
+
+
+

+ + + + + + + + + + + + + +
+

Downloaded TA Copy Location

+ 		+

Target Splunk Deployment Server Directory

+
+
    +
  • \\Network_Share +
      +
    • ...\ms_ad_obj_ta_examples +
        +
      • ...\Splunk_TA_windows_local_only +
          +
        • ...\local +
            +
          • ...\inputs.conf
            • +
          +
          • +
        +
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • ...\splunk +
      +
    • ...\etc +
        +
      • ...\deployment-apps +
          +
        • ...\Splunk_TA_windows
          • +
        +
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Navigate to the \\Network_Share\ms_ad_obj_ta_examples\Splunk_TA_windows_local_only\ directory.
    2. +
  2. +
    +
    Copy the complete local/ folder and paste it on the Splunk Deployment Server’s in the /splunk/etc/deployment-apps/Splunk_TA_windows/ directory.
    +
    +
    3. +
  3. +
    +
    (Optional) Customize the following pre-defined inputs.conf. +
      +
      • +
    • For example, if you created different indexes to store your Windows data than (wineventlog, perfmon, mead, windows), then you will need to update each inputs index = …. setting in this inputs.conf with your aligned indexes.
      • +
    +
    +
    +
    4. +
+
+
+

+

Validate Configuration: Review the below table to verify the results from the above steps match the listed deployment-apps/ directory.

+ + + + + + + +
+

Target Splunk Deployment Server Results

+
+
+ + + + + + +
+
    +
  • ...\deployment-apps +
      +
    • ...\Splunk_TA_windows +
        +
      • ...\local
        • +
      • ...\appserver\...
        • +
      • ...\bin\...
        • +
      • ...\default\...
        • +
      • ...\metadata\...
        • +
      • ...\README\...
        • +
      • ...\static\...
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • ...\deployment-apps +
      +
    • ...\Splunk_TA_windows_dc +
        +
      • ...\bin\...
        • +
      • ...\default\...
        • +
      • ...\local
        • +
      • ...\README\...
        • +
      • ...\static\...
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • ...\deployment-apps +
      +
    • ...\Splunk_TA_windows_admon +
        +
      • ...\default\...
        • +
      • ...\local
        • +
      • ...\README\...
        • +
      • ...\static\...
        • +
      +
      • +
    +
    • +
+
+
+
+
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Pre-Defined TA Configuration: Create and configure Splunk Deployment Server Classes
+

Complete the 3 configuration steps while leveraging the table above each step for guidance.

+
+
+ + + + + + + + + + + + + + + + +
+ + + + + + + + + + + +
+

Create the Base Windows Deployment Server Class

+
+
    +
  • Server Class Name: Base Windows
    • +
  • Application: Splunk_TA_windows
    +
      +
    • Restart Splunk enabled
      • +
    +
    • +
  • Clients: * or comma separated list of all target windows system
    • +
+
+
+
    +
  1. In a separate browser tab, Login to your Splunk Deployment Server Web UI
    2. +
  2. Navigate to Settings > Forwarder Management
    3. +
  3. Click on the Server Classes tab
    4. +
  4. Click on the create one link, or the New Server Class button, to create and configure the Splunk Deployment Server Classes
    5. +
  5. In the Name box, type Base Windows, or a different custom name for collection all base Windows OS data from all your target Windows Systems.
    6. +
  6. Click Save
    7. +
  7. Click the Add Apps button
    8. +
  8. Click on the Splunk_TA_windows application to add it to the right Selected Apps panel.
    9. +
  9. Click Save
    10. +
  10. In the Apps table, click on the Edit dropdown in the Actions column for the Splunk_TA_windows application.
    11. +
  11. In Edit view, click the option button Restart Splunkd to make sure it is checked.
    12. +
  12. Click Save
    13. +
  13. Click the Add Clients button
    14. +
  14. In the Include (whitelist) box, type in a comma separated list of HostNames, Ip Address and/or wildcards for the targeted Windows Systems for the Server Class.
    +
      +
    • If this is the first time you are creating a Deployment Server Class, you can just put in a * in the Whitelist box for just the Base Windows Server Class.
      • +
    • After your target Windows systems start communicating with the Splunk Deployment Server, you should come back to the Base Windows Server Class and either enter in more specific Host Names, Ip Addresses, etc in the Whitelist, or keep the * and select one of the options from the Filter by Machine Type dropdown.
      • +
    +
    15. +
  15. Click Save
    16. +
+
+
+

+ + + + + + + + + + + +
+

Create the Domain Controllers Deployment Server Class

+
+
    +
  • Server Class Name: Domain Controllers
    • +
  • Application: Splunk_TA_windows_dc
    +
      +
    • Restart Splunk enabled
      • +
    +
    • +
  • Clients: Comma separated list of all target AD Domain Controllers
    • +
+
+
+
    +
  1. Navigate back to Forwarder Management
    2. +
  2. Click on the Server Classes tab
    3. +
  3. Click on the New Server Class button
    4. +
  4. In the Name box, type Domain Controllers
    5. +
  5. Click Save
    6. +
  6. Click the Add Apps button
    7. +
  7. Click on the Splunk_TA_windows_dc application to add it to the right Selected Apps panel.
    8. +
  8. Click Save
    9. +
  9. In the Apps table, click on the Edit dropdown in the Actions column for the Splunk_TA_windows_dc application.
    10. +
  10. In Edit view, click the option button Restart Splunkd to make sure it is checked.
    11. +
  11. Click Save
    12. +
  12. Click the Add Clients button
    13. +
  13. In the Include (whitelist) box, type in a comma separated list of your Domain Controller HostNames, Ip Address and/or wildcards.
    14. +
  14. Click Save
    15. +
+
+
+

+ + + + + + + + + + + +
+

Create the AD admon Monitoring Deployment Server Class

+
+
    +
  • Server Class Name: AD admon Monitoring
    • +
  • Application: Splunk_TA_windows_admon
    +
      +
    • Restart Splunk enabled
      • +
    +
    • +
  • Clients: Single host per AD Domain, or if multiple domains then Comma separated list of the host for each AD Domain.
    • +
+
+
+
    +
  1. Navigate back to Forwarder Management
    2. +
  2. Click on the Server Classes tab
    3. +
  3. Click on the New Server Class button
    4. +
  4. In the Name box, type AD admon Monitoring
    5. +
  5. Click Save
    6. +
  6. Click the Add Apps button
    7. +
  7. Click on the Splunk_TA_windows_admon application to add it to the right Selected Apps panel.
    8. +
  8. Click Save
    9. +
  9. In the Apps table, click on the Edit dropdown in the Actions column for the Splunk_TA_windows_admon application.
    10. +
  10. In Edit view, click the option button Restart Splunkd to make sure it is checked.
    11. +
  11. Click Save
    12. +
  12. Click the Add Clients button
    13. +
  13. In the Include (whitelist) box, type in A single designated Domain Controller's or Domain Member Server's HostName, or Ip Address.
    14. +
  14. Click Save
    15. +
+
+
+

+

Validate Configuration: Review the below table to verify the results from the above steps match the below table.

+ + + + + + + + + + + +
+

Base Windows

+ 		+

Domain Controllers

+ 		+

AD admon Monitoring

+
+
    +
  • Server Class Name: Base Windows
    • +
  • Application: Splunk_TA_windows
    +
      +
    • Restart Splunk enabled
      • +
    +
    • +
  • Clients: * or comma separated list of all target windows system
    • +
+ 		+
    +
  • Server Class Name: Domain Controllers
    • +
  • Application: Splunk_TA_windows_dc
    +
      +
    • Restart Splunk enabled
      • +
    +
    • +
  • Clients: Comma separated list of all target AD Domain Controllers
    • +
+ 		+
    +
  • Server Class Name: AD admon Monitoring
    • +
  • Application: Splunk_TA_windows_admon
    +
      +
    • Restart Splunk enabled
      • +
    +
    • +
  • Clients: Single host per AD Domain, or if multiple domains then Comma separated list of the host for each AD Domain.
    • +
+
+
+
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Heavy Forwarder
+

The Splunk Heavy Forwarder is type of forwarder, which is a Splunk Enterprise instance that sends data to another Splunk Enterprise instance or Splunk Cloud environment.

+
    +
  • You can skip the below steps if you already have the Heavy Forwarder installed in your Splunk environment.
    • +
  • Follow the below Steps for for the OS Type you will be installing the Heavy Forwarder on.
    • +
  • If you didn't download the Splunk Enterprise software in the previous preparation steps, then Click Download to download the Splunk Enterprise software that will be used to install the Splunk Heavy Forwarder.
    • +
  • Do not install on the same machine as a Splunk Universal Forwarder.
    • +
+
+
+ + Install Splunk Heavy Forwarder on Windows +

You can install Splunk Enterprise on Windows with the Graphical User Interface (GUI)-based installer or from the command line. More options, such as silent installation, are available if you install from the command line. See Install on Windows from the command line for the command line installation procedure.

+
    +
  • You cannot install or run the 32-bit version of Splunk Enterprise for Windows on a 64-bit Windows machine. You also cannot install Splunk Enterprise on a machine that runs an unsupported OS. For example, you cannot install Splunk Enterprise on a machine that runs Windows Server 2003. See System requirements. If you attempt to run the installer in such a way, it warns you and prevents the installation.
    • +
  • +
    + + Before you install +
      +
    • Choose the Windows user Splunk should run as +
      • Before installing, see Info to determine which user account Splunk should run as to address your specific needs. The user you choose has ramifications on what you must do prior to installing the software, and more details can be found there.
      +
      • +
    • Disable or limit antivirus software if able +
        +
      • The Splunk Enterprise indexing subsystem requires high disk throughput. Any software with a device driver that intermediates between Splunk Enterprise and the operating system can restrict processing power available to Splunk Enterprise, causing slowness and even an unresponsive system. This includes anti-virus software.
        • +
      • You must configure such software to avoid on-access scanning of Splunk Enterprise installation directories and processes before you start a Splunk installation.
        • +
      +
      • +
    • Consider installing Splunk software into a directory with a short path name +
        +
      • By default, the Splunk MSI file installs the software to \Program Files\Splunk on the system drive (the drive that booted your Windows machine.) While this directory is fine for many Splunk software installations, it might be problematic for installations that run in distributed deployments or that employ advanced Splunk features such as search-head or indexer clustering.
        • +
      • The Windows API has a path limitation of MAX_PATH which Microsoft defines as 260 characters including the drive letter, colon, backslash, 256-characters for the path, and a null terminating character. Windows cannot address a file path that is longer than this, and if Splunk software creates a file with a path length that is longer than MAX_PATH, it cannot retrieve the file later. There is no way to change this configuration.
        • +
      • To work around this problem, if you know that the instance will be a member of a search head or indexer cluster, consider installing the software into a directory with a short path length, for example C:\Splunk or D:\SPL.
        • +
      +
      • +
    +
    +
    • +
  • Begin the installation +
      +
    1. Copy the previously downloaded Splunk Enterprise Software from the Network Share to the target Splunk Heavy Forwarder system.
      2. +
    2. +
      To start the installer, double-click the splunk.msi file. The installer runs and displays the Splunk Enterprise Installer panel. +
      +
      3. +
    3. +
      To continue the installation, check the "Check this box to accept the License Agreement" checkbox. This activates the "Customize Installation" and "Next" buttons. +
        +
      • (Optional) If you want to view the license agreement, click View License Agreement.
        • +
      • +
        + + Next Step - Installation Options +

        The Windows installer gives you two choices: Install with the default installation settings, or configure all settings prior to installing. When you choose to install with the default settings, the installer does the following:

        + `
          +
        • Installs Splunk Enterprise in \Program Files\Splunk on the drive that booted your Windows machine.
          • +
        • Installs Splunk Enterprise with the default management and Web network ports.
          • +
        • Configures Splunk Enterprise to run as the Local System user.
          • +
        • Prompts you to create a Splunk administrator password. You must do this before installation can continue.
          • +
        • Creates a Start Menu shortcut for the software.
          • +
        +
        +
        • +
      +
      +
      4. +
    +
      +
    • +
      + + Continue with Customize Options +
        +
      1. +
        Click Customize Options button.
        +
        2. +
      2. +
        Click Change… to specify a different location to install Splunk Enterprise, or click Next to accept the default value.
        +
        3. +
      3. +
        The installer displays the "Choose the user Splunk Enterprise should run as" panel. Select a user type and click Next. +
          +
        • +
          If you selected the Local System user, proceed to Step 5. Otherwise, the installer displays the Logon Information: specify a username and password panel.
          +
          • +
        +
        +
        4. +
      4. +
        Enter the Windows credentials that Splunk Enterprise uses to run on the machine and click Next. +
        • These credentials are different from the Splunk administrator credentials that you create in the next step.
        +
        +
        5. +
      5. +
        Create credentials for the Splunk administrator user by entering a username and password that meets the minimum eligibility requirements as shown in the panel and click Next. +
        • You must perform this action as the installation cannot proceed without your completing it. If you do not enter a username, the installer creates the admin user during the installation process.
        +
        +
        6. +
      6. +
        The installer displays the installation summary panel. Click Install to proceed with the installation.
        +
        7. +
      7. +
        Click Finish. The installation completes, Splunk Enterprise starts and launches in a supported browser if you checked the appropriate box.
        +
        8. +
      +
      +
      • +
    • +
      + + Or Continue With Default Options +
        +
      1. +
        Click Next
        +
        2. +
      2. +
        Enter the Windows credentials that Splunk Enterprise uses to run on the machine and click Next. +
        • These credentials are different from the Splunk administrator credentials that you create in the next step.
        +
        +
        3. +
      3. +
        The installer displays the installation summary panel. Click Install to proceed with the installation.
        +
        4. +
      4. +
        Click Finish. The installation completes, Splunk Enterprise starts and launches in a supported browser if you checked the appropriate box.
        +
        5. +
      +
      +
      • +
    +
    • +
+
+
+ + Install Splunk Heavy Forwarder on linux +

You can install Splunk Enterprise on Linux using RPM or DEB packages or a tar file, depending on the version of Linux your host runs.

+
    +
  • +
    + + Tar file installation +
      +
    • What to know before installing with a tar file: +
        +
      • >Knowing the following items helps ensure a successful installation with a tar file: +
          +
        • Some non-GNU versions of tar might not have the -C argument available. In this case, to install in /opt/splunk, either cd to /opt or place the tar file in /opt before you run the tar command. This method works for any accessible directory on your host file system.
          • +
        • Splunk Enterprise does not create the splunk user. If you want Splunk Enterprise to run as a specific user, you must create the user manually before you install.
          • +
        • Confirm that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.
          • +
        +
        • +
      +
      • +
    • Installation procedure: +
        +
      1. +
        Expand the tar file into an appropriate directory using the tar command: + 
        tar xvzf splunk_package_name.tgz
        +

        The default installation directory is splunk in the current working directory. To install into /opt/splunk, use the following command:

        + 
        tar xvzf splunk_package_name.tgz -C /opt
        +
        +
        2. +
      +
      • +
    +
    +
    • +
  • +
    + + RedHat RPM installation +
      +
    • RPM packages are available for Red Hat, CentOS, and similar versions of Linux.
      • +
    • The rpm package does not provide any safeguards when you use it to upgrade. While you can use the --prefix flag to install it into a different directory, upgrade problems can occur If the directory that you specified with the flag does not match the directory where you initially installed the software.
      • +
    • After installation, software package validation commands (such as rpm -Vp <rpm_file> might fail because of intermediate files that get deleted during the installation process. To verify your Splunk installation package, use the splunk validate files CLI command instead.
      • +
    +
      +
    1. Confirm that the RPM package you want is available locally on the target host.
      2. +
    2. Verify that the Splunk Enterprise user account that will run the Splunk services can read and access the file.
      3. +
    3. +
      If needed, change permissions on the file. + 
      chmod 644 splunk_package_name.rpm
      +
      +
      4. +
    4. +
      Invoke the following command to install the Splunk Enterprise RPM in the default directory /opt/splunk.
      + 
      rpm -i splunk_package_name.rpm
      +
      +
      5. +
    5. +
      (Optional) To install Splunk in a different directory, use the --prefix flag.
      + 
      rpm -i --prefix=/opt/new_directory splunk_package_name.rpm
      +
      +
      6. +
    +
      +

    • Automate RPM installation with Red Hat Linux Kickstart

      +
        +
      • +
        If you want to automate an RPM install with Kickstart, edit the kickstart file and add the following. + 
        ./splunk start --accept-license
+./splunk enable boot-start
        +
        +

        Note: The enable boot-start line is optional.

        +
        +
        • +
      +
      • +
    +
    +
    + + Debian .DEB installation +
      +
    • Prerequisites to installation +
        +
      • You can install the Splunk Enterprise Debian package only into the default location, /opt/splunk.
        • +
      • This location must be a regular directory, and cannot be a symbolic link.
        • +
      • You must have access to the root user or have sudo permissions to install the package.
        • +
      • The package does not create environment variables to access the Splunk Enterprise installation directory. You must set those variables on your own.
        • +
      +

      Note: If you need to install Splunk Enterprise somewhere else, or if you use a symbolic link for /opt/splunk, then use a tar file to install the software.

      +
      • +
    • Installation procedure +
        +
      • +
        Run the dpkg installer with the Splunk Enterprise Debian package name as an argument.
        + 
        dpkg -i splunk_package_name.deb
        +
        +
        • +
      +

      Debian commands for showing installation status

      +
        +
      • Splunk package status: + 
        dpkg --status splunk
        +
        • +
      • List all packages: + 
        dpkg --list
        +
        • +
      +

      Information on expected default shell and caveats for Debian shells

      +
        +
      • Splunk Enterprise expects you to run commands from the bash shell. It expects bash to be available from /bin/sh.
        • +
      • On later versions of Debian Linux (for example, Debian Squeeze), the default shell is the dash shell.
        • +
      • Using the dash shell can result in zombie processes - processes that have completed execution, yet remain in the process table and cannot be killed or removed.
        • +
      • If you run Debian Linux, consider changing your default shell to be bash.
        • +
      +
      • +
    +
    +
    • +
  • Now that you have installed the Splunk Heavy Forwarder: + +
    • +
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Enable Receiver Port on Splunk Heavy Forwarder
+

We will now cover the steps to enable and configure the Receiving Port on your Splunk Indexer(s) using the Splunk Web console.

+
  • You can skip the below steps if you already have the Receiving Port Port enabled on your Splunk Heavy or Gateway Forwarder System.
+
+
    +
  • Configure a receiver using the command line: +
      +
    1. Open a shell prompt
      2. +
    2. Change the path to $SPLUNK_HOME/bin
      3. +
    3. Type:splunk enable listen <port> -auth <username>:<password>.
      +
        +
      • Replace <port> with the port you will specify for your Splunk Universal Forwarders (Default is 9997)
        • +
      • Replace <username> and <password> with the username and password you used when you installed Splunk on this instance.
        • +
      • Example: splunk enable listen 9997 -auth admin:mysecretpassword
        • +
      +
      4. +
    4. Do Not Restart until all the Steps listed in the left panel have been completed.
      5. +
    5. Proceed to the next Preparation Item.
      6. +
    +
    • +
  • OR Configure a receiver port using the Splunk UI: +
      +
    1. +
      Log into Splunk Web on your Splunk Heavy/Gateway Forwarder as a user with the admin role.
      +
      2. +
    2. +
      In Splunk Web, go to Settings > Forwarding and receiving.
      +
      3. +
    3. +
      Select "Configure receiving."
      +
      4. +
    4. +
      Verify if there are existing receiver ports open. You cannot create a duplicate receiver port. The conventional receiver port on indexers is port 9997.
      +
      5. +
    5. +
      Select "New Receiving Port."
      +
      6. +
    6. +
      Add a port number (default is 9997)
      +
      7. +
    7. +
      Click the Save button.
      +
      8. +
    +
    • +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Cloud Credentials App
+

We will now cover the steps to install the Splunk Cloud Credentials Application on the Splunk Heavy Forwarder.

+
    +
  • Click the cloud icon for a Diagram
    • +
  • If you didn't previously download the Splunk Cloud Credentials App Click for instructions.
    • +
  • If you already have the Splunk Cloud Credentials App installed on your Splunk Heavy Forwarder, then skip to this step.
    • +
+
+
    +
  1. In a separate browser tab, login to your Splunk Heavy Forwarder instance with an user that has the admin role.
    2. +
  2. Navigate to Apps menu dropdown > Manage Applications
    3. +
  3. Click Install From File.
    4. +
  4. In the pop directory window, go to the Network Share where you downloaded the Universal Forwarder Credentials application, and click on the splunkclouduf.spl file
    5. +
  5. Click the Upload button to install the Splunk Cloud Credentials application on the Heavy Forwarder Instance.
    6. +
  6. Follow the prompts to complete the installation.
    7. +
  7. Click Restart Later. Don't Restart the Splunk Instance until after you have completed all of the remaining Preparation Tasks listed in the left panel.
    8. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Install the Splunk Add-On for Microsoft Windows App
+

We will now cover the steps to install the Splunk Add-On for Microsoft Windows App Application on the Splunk Heavy Forwarder.

+
  • If you already have the Splunk Add-Ons for Microsoft Windows installed on your Splunk Heavy Forwarder, then skip to this step.
+
+
    +
  1. In a separate browser tab, login to your Splunk Heavy Forwarder instance with an user that has the admin role.
    2. +
  2. Navigate to Apps menu dropdown > Manage Applications
    3. +
  3. Click Install From File.
    4. +
  4. In the pop directory window, go to the Network Share where you downloaded the Splunk_TA_windows application, and click on the Splunk_TA_windows.spl file
    5. +
  5. Click the Upload button to install the Splunk Add-On for Microsoft Windows application on the Heavy Forwarder Instance.
    6. +
  6. Follow the prompts to complete the installation.
    7. +
  7. Click Restart Later. Don't Restart the Splunk Instance until after you have completed all of the remaining Preparation Tasks listed in the left panel.
    8. +
+
+
+
+
+
+
+ + + + + +
+
+
+
+ + + + + + + +
+
Pre-Defined TA Configuration: Copy App(s) to Network Share for manually deploying to the Splunk Universal Forwarders.
+

Complete the below 5 steps while leveraging the table above each step for guidance.

+
+
+ + + + + + + + + + + + + + + + + + + + + + +
+ + + + + + + + + + + +
+

Network Share - Create Folders

+
+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Base Windows
        • +
      • ...\Domain Controllers
        • +
      • ...\AD admon Monitor
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Using a terminal/file explorer, navigate to the \\Network_Share\ directory
    2. +
  2. Create a new folder with the name Splunk UF TAs
    3. +
  3. Navigate into the Splunk UF TAs Folder.
    4. +
  4. Create the following 3 folders directly under the Splunk UF TAs folder. +
      +
    • Base Windows
      • +
    • Domain Controllers
      • +
    • AD admon Monitor
      • +
    +
    5. +
+
+
+
+ + + + + + + + + + + + + +
+

Downloaded TA Copy Location

+ 		+

\\Network_Share\Splunk UF TAs

+
+
    +
  • ...\Downloaded TA Location +
      +
    • ...\Splunk_TA_windows
      • +
    +
    • +
+ 		+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Base Windows
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Using a terminal/file explorer, navigate to the location where you previously downloaded the Splunk Add-On for Microsoft Windows (Splunk_TA_windows) application.
    2. +
  2. Copy the complete Splunk_TA_windows directory and past it into \\Network_Share\Splunk UF TAs\Base Windows directory.
    3. +
+
    +
  • If you didn't previously download the Splunk Add-On for Microsoft Windows then Click to download it locally
    • +
  • Extract the downloaded file and copy the extracted Splunk_TA_windows to the \\Network_Share\Splunk UF TAs\Base Windows\ directory.
    • +
+
+
+

+ + + + + + + + + + + + + +
+

Downloaded TA Copy Location

+ 		+

\\Network_Share\Splunk UF TAs\Base Windows\Splunk_TA_windows

+
+
    +
  • ...\Downloaded TA Location +
      +
    • ...\ms_ad_obj_ta_examples +
        +
      • ...\Splunk_TA_windows_local_only +
          +
        • ...\local\...
          • +
        +
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Base_Windows +
          +
        • ...\Splunk_TA_windows +
          • +
        +
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Using a terminal/file explorer, navigate to the location where you previously downloaded and extracted the MS AD Windows Objects TA Examples (ms_ad_obj_ta_examples.zip) file.
    2. +
  2. Navigate into the ...\ms_ad_obj_ta_examples\Splunk_TA_windows_local_only\ directory.
    3. +
  3. Copy the complete \local directory
    4. +
  4. Paste it into the \\Network_Share\Splunk UF TAs\Base Windows\Splunk_TA_windows\ directory
    5. +
  5. +
    +
    (Optional) Customize the following pre-defined inputs.conf. +
      +
      • +
    +
    +
    +
    6. +
+
    +
  • If you didn't previously download the Splunk Add-On for Microsoft Windows then Click to download it locally
    • +
  • Extract the downloaded file and copy the extracted Splunk_TA_windows to the \\Network_Share\Splunk UF TAs\Base Windows\ directory.
    • +
+
+
+

+ + + + + + + + + + + + + +
+

\\Network_Share\Splunk UF TAs\Base Windows\Splunk_TA_windows

+ 		+

\\Network_Share\Splunk UF TAs\Domain Controllers\

+
+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Base Windows +
          +
        • ...\Splunk_TA_windows
          • +
        +
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Domain Controllers\
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Navigate into the ...\ms_ad_obj_ta_examples\ directory.
    2. +
  2. Copy the complete Splunk_TA_windows_dc directory.
    3. +
  3. Paste it into the \\Network_Share\Splunk UF TAs\Domain Controllers\ directory.
  4. +
    +
  5. +
    (Optional) Customize the following pre-defined inputs.conf. +
      +
      • +
    +
    +
    6. +
+ + + +
+
+ + + + + + + + + + + + + +
+

Downloaded TA Copy Location

+ 		+

\\Network_Share\Splunk UF TAs\

+
+
    +
  • \\Downloaded TA Copy Location +
      +
    • ...\ms_ad_obj_ta_examples +
        +
      • ...\Splunk_TA_windows_admin
        • +
      +
      • +
    +
    • +
+ 		+
    +
  • \\Network_Share +
      +
    • ...\Splunk UF TAs +
        +
      • ...\Domain Controllers\
        • +
      +
      • +
    +
    • +
+
+
+
    +
  1. Navigate into the ...\ms_ad_obj_ta_examples\ directory.
    2. +
  2. Copy the complete Splunk_TA_windows_admon directory.
    3. +
  3. Paste it into the \\Network_Share\Splunk UF TAs\AD admon Monitoring\ directory.
  4. +
    +
  5. +
    (Optional) Customize the following pre-defined inputs.conf. +
      +
      • +
    +
    +
    6. +
+ + + +
+

+

Validate Configuration: Review the below table to verify the results from the above steps match the listed deployment-apps/ directory.

+ + + + + + + +
+

Target \\Network_Share\Splunk UF TAs\

+
+
+ + + + + + +
+
    +
  • ...\Splunk UF TAs\Base Windows +
      +
    • ...\Splunk_TA_windows
      • +
    +
    • +
+ 		+
    +
  • ...\Splunk UF TAs\Domain Controllers +
      +
    • ...\Splunk_TA_windows
      • +
    • ...\Splunk_TA_windows_dc
      • +
    +
    • +
+ 		+
    +
  • ...\Splunk UF TAs\AD Admon Monitoring +
      +
    • ...\Splunk_TA_windows_admon
      • +
    +
    • +
+
+
+
+
+
+
+
+
+
+
+
+ + + + +
+
+ + + + + + + +
+
Important Upgrade Configuration: Adjust or verify Splunk Knowledge Objects
+

Review the Autocheck Results and follow the below steps to update the appropriate Macro's that are now being leveraged for pointing to specific indexes. This replaces the previous version's use of eventtypes.

+
+ + Auto Check Information: +
    +
  • An autocheck search was executed to check if the defined indexes in the required macros are available (created).
    • +
  • All of the indexes that are defined in the below macro's have been found. Although, it is still recommended to review the table below to make sure the created indexes align with the correct Data Type for each macro.
    • +
  • Review the below Troubleshooting Steps: +
      +
    • If created different index names for your Windows/Active Directory data, then follow the Adjusting the Macros used by the MS AD Windows Objects steps below.
      • +
    • Troubleshooting Steps if you created the recommended indexes (wineventlog,perfmon,msad,windows) +

      Verify Role Index Permissions:

      +
        +
      1. Click Review Roles to open the Roles page
        2. +
      2. Click on the Role(s) that is associated with your account
        3. +
      3. Click on the 3. Indexes Link
        4. +
      4. Verify that the Default box is selected for each of the created indexes (wineventlog,perfmon,msad,windows)
        5. +
      5. Click Save and Click the Rerun Autocheck button below to rerun the autocheck and update the results +
        • If it is still showing errors after running the above, and you are sure you created the default indexes, then you can proceed to the next Preparation item
        +
        6. +
      +
      • +
    • Click Rerun Autocheck to rerun the autocheck if you completed the above troubleshooting, or the below preparation steps below.
      • + +
    +
    • +
+
+
+ + Macro to Index Definitions: +
+
+
+

Adjusting the Macros used by the MS AD Windows Objects

+
    +
  1. +
    Click Macro Settings to open the settings page for the macros or click on the individual macro names below, to adjust the macro definition.
    +
    2. +
  2. +
    Use the below list to match up the custom indexes you created for your windows data with the appropriate macro:
    +
      +
    • Macro: ms__obj_win_events_index +
        +
      • All Windows Event Logs (ie. Security,Application,System,Directory Service,etc)
        • +
      +
      • +
    • Macro: ms__obj_win_perfmon_index +
        +
      • All Windows Performance Count Data (ie. Perfmon:CPU,Perfmon:Memory,etc)
        • +
      +
      • +
    • Macro: ms__obj_win_ad_index +
        +
      • All Active Directory Specific Data (ie. ActiveDirectory,DHCP,DNS,Powershell AD Scripts,etc)
        • +
      +
      • +
    • Macro: ms__obj_win_api_index +
        +
      • All Windows OS Api and Scripts (ie. WinHostMon,WinNetMon,Update Logs,etc)
        • +
      +
      • +
    +
    3. +
  3. +
    Click on the individual macro links to update the definition with your aligned custom indexes (Using OR for mulitple indexes. Ex. index=winosevt OR index=winossecurityevt).
    +
    4. +
  4. +
    Click Save after adjusting each of the above macros.
    +
    5. +
  5. +
    Click Rerun Autocheck to rerun the autocheck search to validate your changes.
    +
    6. +
  6. +
    After adjusting the macros and verifying the changes, proceed to the next Preparation item.
    +
    7. +
+
+
+
+
+
+ + + + +
+
+ + + + + + + + + + +
Download and Compare MS AD Windows Objects TA Examples
- These pre-defined inputs and TA's are configured to help get you started with optimal, recommended, input settings to getting Windows Data into your Splunk Environment.
+

Use the below buttons to view the settings of the downloaded TA Examples, for comparing against currently deployed Windows inputs.

+
    +
  • Base Windows Pre-Defined Inputs: to review the configured settings of the Base Windows Example TA's.
    • +
  • +
  • Active Directory Pre-Defined Inputs: to review the configured settings of the Active Directory Example TA's.
    • +
+
+
+
+
+
+ + + + + + + + + + + + + + + + + +
+
+

Category

+
+ 		+
+

Description

+
+
+
+

Knowledge Objects Update

+
+ 		+

Update the appropriate Macro's that are now being leveraged for pointing to specific indexes. This replaces the previous version's use of eventtypes.

+
+
+

Group Membership (memberOf) Update

+
+ 		+

+
    +
  • To make the underlying searches and lookups more efficient, the memberOf field will no longer be maintained in the AD_Obj_User/AD_Obj_Computer/AD_Obj_Group lookups.
    • +
  • Instead the AD_Obj_Group lookup will maintain the member field, which contains the group membership for the specific group
    • +
  • To retrieve an individual User/Computer/Group group membership, you can use the lookup command to retrieve the objects membership. See the below example search:
    +
      +
    • lookup command: Ex. | inputlookup AD_Obj_User WHERE sAMAccountName="test_user" | lookup AD_Obj_Group member AS dn OUTPUT dn AS memberOf
      • +
    +
    • +
+ +

+
+
+

Lookup Table Updates

+
+ 		+

The MS Windows AD Objects application now uses the KVStore for its lookups tables. Review the below list to see the previous version, which used csv files, to the new version:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Previous csv Lookup
+ 		+
KVStore Lookup
+ 		+
Lookup Table Description
+
+ AD_Domain_Selector + + AD_Obj_Domain + +

This lookup contains the AD Domain(s) DNS, NetBios, Site, Forest information, collected by the [powershell://AD-Health] OR [script://.\bin\runpowershell.cmd nt6-health.ps1] data input on an AD Domain Controller.

+
+ AD_User_LDAP_list + + AD_Obj_User + +

This lookup contains the AD User collected, and updated, Attributes.

+
+ AD_Groups_LDAP_list + + AD_Obj_Group + +

This lookup contains the AD Group collected, and updated, Attributes.

+
+ AD_Computer_LDAP_list + + AD_Obj_Computer + +

This lookup contains the AD Computer collected, and updated, Attributes.

+
+ AD_OU_LDAP_list + + AD_Obj_OU + +

This lookup contains the AD Organizational Unit and Container collected, and updated, Attributes.

+
+ AD_GroupPolicies_LDAP_list + + AD_Obj_GPO + +

This lookup contains the AD Group Policies collected, and updated, Attributes.

+
+ AD_Admin_Audit_list + + AD_Obj_Admin_Audit + +

This lookup contains a list of Administrators, and their AD Attributes. Administrators are determined by source user (src_user) accounts that make changes to AD Objects other than their own account.

+
+
+
+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_hold.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_hold.html new file mode 100644 index 00000000..f9880025 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_hold.html @@ -0,0 +1,12 @@ +
+

Waiting for Preparation Task Selection:

+
+
+
+

+ Click on the View Steps button in the left panel, following the recommended order of tasks to complete.

+
    +
  • After completing all of the required tasks, Click the Next button at the top for advancing to the Deployment Steps
    • +
+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_src.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_src.html new file mode 100644 index 00000000..096aa15e --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_prep_task_src.html @@ -0,0 +1,572 @@ +
+

Preparation Tasks to Complete

+
+
+ + + + +
+
+
+ + + + + + + + + +
+
+
+

+ Preparation Task: Download required Splunk Packages +

+ 		+
+ View Steps +
+
+

+ + +

+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Task: Prepare Splunk® Core Components +

+
+
+
+ + + + + + +
+
+
+ Installing the Splunk Windows TA on the single Splunk Core Instance +

We will now cover the steps to install and verify that the Splunk Add-on for Microsoft Windows is installed on your Splunk® Enterprise Core system.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Installing the Splunk Windows TA on the Distributed Splunk Core Instances +

We will now cover the steps to install and verify that the Splunk Add-on for Microsoft Windows is installed on your Splunk® Enterprise Core Search Head(s) and Indexer(s).

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Installing the Splunk Windows TA in the Splunk Cloud™ environment +

We will now cover the steps to install and verify that the Splunk Add-on for Microsoft Windows is installed in your Splunk Cloud™ environment.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Enable Receiving Port on the Splunk Core System +

We will now cover the steps to enable and configure the Receiving Port on your Splunk Core System using the Splunk Web console.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Enable Receiving Port on the Splunk Indexer(s) +

We will now cover the steps to enable and configure the Receiving Port on your Splunk Indexer(s) using the Splunk Web console.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+
Create and configure the indexes on your Splunk Core system
+
Create and configure the indexes on your Splunk Indexer(s)
+

We will now cover the steps to create the indexes that will store the Windows data sent from your Windows machines.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Create and configure the indexes in your Splunk Cloud™ environment +

We will now cover the steps to create the indexes that will store the Windows data sent from your Windows machines.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Adjust or verify Splunk Knowledge Objects +

We will now cover the steps for adjusting the Splunk Knowledge Objects(Macro's) used by the MS Windows AD Object application for pointing to the indexes where the Windows data is stored.

+ 		+
+ View Steps +
+
+
+
+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Task: Prepare the Splunk Deployment Server component +

+
+
+
+ + + + + + +
+
+
+ Install the Splunk Deployment Server +

The Deployment Server (DS) is an instance of Splunk Enterprise that you install on a Windows or Linux machine and configure pushes Splunk apps to the Splunk Universal Forwarders on your target Windows Systems.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Configure HTTPS for Splunk Web. +

We will now cover the steps to enable and configure the HTTPS on your Splunk Deployment Servers Web console.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Enable Receiver Port on Splunk Deployment Server +

We will now cover the steps to enable and configure the Receiving Port on your Splunk Indexer(s) using the Splunk Web console.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Install the Splunk Cloud Credentials App +

We will now cover the steps to install the Splunk Cloud Credentials Application on the Splunk Deployment Server.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Install the Splunk Add-On for Microsoft Windows App +

We will now cover the steps to install the Splunk Add-On for Microsoft Windows App Application on the Splunk Deployment Server.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Configure the licensing for the deployment server + +
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Pre-Defined TA Configuration: Copy App(s) to the Splunk Deployment Server +

Complete the below 3 steps, leveraging the table above the steps as a visual map for each step.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Pre-Defined TA Configuration: Create and configure Splunk Deployment Server Classes +

Complete the below 3 steps, leveraging the table above the steps as a visual map for each step.

+ 		+
+ View Steps +
+
+
+
+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Task: Prepare the Splunk Heavy Forwarder component +

+
+
+
+ + + + + + +
+
+
+ Install the Splunk Heavy Forwarder +

The Splunk Heavy Forwarder is type of forwarder, which is a Splunk Enterprise instance that sends data to another Splunk Enterprise instance or Splunk Cloud environment.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Enable Receiver Port on Splunk Heavy Forwarder +

We will now cover the steps to enable and configure the Receiving Port on your Splunk Indexer(s) using the Splunk Web console.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Install the Splunk Cloud Credentials App +

We will now cover the steps to install the Splunk Cloud Credentials Application on the Splunk Heavy Forwarder.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Install the Splunk Add-On for Microsoft Windows App +

We will now cover the steps to install the Splunk Add-On for Microsoft Windows App Application on the Splunk Heavy Forwarder.

+ 		+
+ View Steps +
+
+
+
+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Task: Prepare the TA Examples for Deploying to your Splunk Universal Forwarders +

+
+
+
+ + + + + + +
+
+
+ Pre-Defined TA Configuration: Copy App(s) to Network Share for manually deploying to the Splunk Universal Forwarders. +

Complete the 5 configuration steps while leveraging the table above each step for guidance.

+ 		+
+ View Steps +
+
+
+
+
+
+
+ + + + + + + + +
+
+
+

+ Upgrade Preparation Tasks: Verify the required Knowledge Objects, review TA Differences and version updates. +

+
+
+
+ + + + + + +
+
+
+ Important Upgrade Configuration: Adjust or verify Splunk Knowledge Objects +

Review the Autocheck Results and update the appropriate Macro's that are now being leveraged for pointing to specific indexes. This replaces the previous version's use of eventtypes.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Compare Currently Deployed Inputs with Example Pre-Defined TAs +

This step walks through the downloading of the MS Windows AD Object's Pre-Defined TA Examples to compare against currently deployed Windows inputs.

+ 		+
+ View Steps +
+
+
+
+ + + + + + +
+
+
+ Review Changes, configuration notes and more with the latest MS Windows AD Objects version. +

This step walks through the changes in the latest MS Windows AD Object version, including important configuration notes and required implementation changes.

+ 		+
+ View Steps +
+
+
+
+
+
+
+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_scope_tasks.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_scope_tasks.html new file mode 100644 index 00000000..1d956b7f --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_scope_tasks.html @@ -0,0 +1,214 @@ +
+

+ $tok_auto_chk_lbl$ - $tok_state_lbl$ Upcoming Preparation Tasks: +

+
+
+ + + + + + + +
+

Status Msg: $tok_state_completed$

+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Tasks: Download required Splunk Packages +

+
+

+ + +

+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Tasks: Prepare Splunk® Core Components +

+
+

+
This preparation task is for configuring and verifying readiness of your Splunk® Enterprise instance to receive the Windows Data.
 +
This preparation task is for configuring and verifying readiness of your Splunk® Enterprise Search Head(s) and Indexer(s) to receive the Windows Data.
 +
This preparation task is for configuring and verifying readiness of your Splunk Cloud™ environment to receive the Windows Data.
 +

+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Tasks: Prepare the Splunk Deployment Server component +

+
+

+
This preparation task consist of installing the Splunk Deployment Server, preparing the Splunk TA's and Splunk Deployment Server Classes for deployment of the TA's to the aligned Windows Systems.
 +
This preparation task consist of preparing the Splunk TA's and Splunk Deployment Server Classes for deployment of the TA's to the aligned Windows Systems.
 +

+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Tasks: Prepare the Splunk Heavy Forwarder component +

+
+

+
This preparation task consist of installing, and configuring the Splunk Heavy Forwarder designated system.
 +
This preparation task consist of configuring and validating the Splunk Heavy Forwarder.
 +

+
+
+
+ + + + + + + + +
+
+
+

+ Preparation Task: Prepare the TA Examples for Deploying to your Splunk Universal Forwarders +

+
+

+
This preparation task copying the MS Windows AD Objects pre-defined TA Examples to a Network Share and making any necessary adjustments before they get manually deployed to the target Windows Systems.
 +

+
+
+
+ + + + + + + + +
+
+
+

+ Deployment Task: Install the Splunk Universal Forwarders software on the target Windows Systems +

+
+

+
This deployment task walks through the installation of the Splunk Universal Forwarders on your target Windows Systems.
 +

+
+
+
+ + + + + + + + +
+
+
+

+ Deployment Task: Manually Copy the pre-configured Windows TA's to the target windows systems. +

+
+

+
This deployment task walks through the process of copying the previously configured Windows TAs to the aligned windows systems.
 +

+
+
+
+ + + + + + + + +
+
+
+

+ Deployment Task: Install the Splunk Cloud Credentials app on the Splunk Universal Forwarders. +

+
+

+
This deployment task walks through the process of installing the Splunk Cloud Credentials app on the Splunk Universal Forwarders.
 +

+
+
+
+ + + + + + + + +
+
+
+

+ Upgrade Preparation Tasks: Verify the required Knowledge Objects, review TA Differences and version updates. +

+
+

+
This upgrade task walks through the process of Verifying the new Knowledge Objects align with current implementation.
 +

+
+
+
+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_scope_tasks_hold.html b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_scope_tasks_hold.html new file mode 100644 index 00000000..b63f25bf --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/appserver/static/wiz_content/getting_started/ms_ad_obj_gs_scope_tasks_hold.html @@ -0,0 +1,13 @@ +
+

Waiting for Scope Selections:

+
+
+
+

+ Click on the Choice button in the left panel for each of the Questions listed. +
    +
  • After completing the required selections, you will see a list of the upcoming Preparation Tasks that will be completed in the next Part.
    • +
+

+
+
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/app.conf b/deployment-apps/ms_windows_ad_objects/default/app.conf new file mode 100644 index 00000000..6587c801 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/app.conf @@ -0,0 +1,17 @@ +# +# Splunk app configuration file +# +[install] +is_configured = 0 + +[ui] +is_visible = 1 +label = MS Windows AD Objects + +[package] +id = ms_windows_ad_objects + +[launcher] +author = Steve Hogan - Splunk Principal Engineer +description = Splunk Application to build and update AD Object Lookup Files using admon data collected from Splunk Universal Forwarders on a domain controller in the Active Directory environment. +version = 4.1.1 \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/collections.conf b/deployment-apps/ms_windows_ad_objects/default/collections.conf new file mode 100644 index 00000000..946c47da --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/collections.conf @@ -0,0 +1,36 @@ +## MS AD Objects - KV Store Lookups ##AD_Obj_Domain_kv +[AD_Obj_Domain_kv] +enforceTypes = false +field.last_time_utc = time +accelerated_fields.domain = { "domain" : 1 } + +[AD_Obj_User_LDAP_list_kv] +enforceTypes = false +accelerated_fields.dn = { "dn" : 1 } + +[AD_Obj_Group_LDAP_list_kv] +enforceTypes = false +accelerated_fields.dn = { "dn" : 1 } +accelerated_fields.member = { "member" : 1 } + +[AD_Obj_Computer_LDAP_list_kv] +enforceTypes = false +accelerated_fields.dn = { "dn" : 1 } + +[AD_Obj_OU_LDAP_list_kv] +enforceTypes = false +accelerated_fields.dn = { "dn" : 1 } + +[AD_Obj_GPO_LDAP_list_kv] +enforceTypes = false +accelerated_fields.dn = { "cn" : 1 } + +[AD_Obj_Admin_Audit_list_kv] +enforceTypes = false +accelerated_fields.admin_user = { "admin_user" : 1 } + +[AD_Obj_UAC_kv] +enforceTypes = false + +[AD_Obj_Config_State_kv] +enforceTypes = false \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/models/MS_Windows_AD_Changes.json b/deployment-apps/ms_windows_ad_objects/default/data/models/MS_Windows_AD_Changes.json new file mode 100644 index 00000000..0b980326 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/models/MS_Windows_AD_Changes.json @@ -0,0 +1,232 @@ +{ + "modelName": "MS_Windows_AD_Changes", + "displayName": "MS_Windows_AD_Changes", + "description": "", + "objectSummary": { + "Event-Based": 0, + "Transaction-Based": 0, + "Search-Based": 6 + }, + "objects": [ + { + "objectName": "ms_ad_obj_audit_changes", + "displayName": "ms_ad_obj_audit_changes", + "parentName": "BaseSearch", + "comment": "", + "fields": [ + { + "fieldName": "_time", + "owner": "ms_ad_obj_audit_changes", + "type": "timestamp", + "fieldSearch": "_time=*", + "required": true, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "_time", + "comment": "" + }, + { + "fieldName": "EventCode", + "owner": "ms_ad_obj_audit_changes", + "type": "number", + "fieldSearch": "EventCode=*", + "required": true, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "EventCode", + "comment": "" + }, + { + "fieldName": "msad_action", + "owner": "ms_ad_obj_audit_changes", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "msad_action", + "comment": "" + }, + { + "fieldName": "src_user", + "owner": "ms_ad_obj_audit_changes", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "src_user", + "comment": "" + }, + { + "fieldName": "obj_type", + "owner": "ms_ad_obj_audit_changes", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "obj_type", + "comment": "" + } + ], + "calculations": [ + { + "outputFields": [ + { + "fieldName": "signature", + "owner": "ms_ad_obj_audit_changes", + "type": "string", + "fieldSearch": "signature=*", + "required": true, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "signature", + "comment": "", + "lookupOutputFieldName": "signature" + }, + { + "fieldName": "change_action", + "owner": "ms_ad_obj_audit_changes", + "type": "string", + "fieldSearch": "change_action=*", + "required": true, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "change_action", + "comment": "", + "lookupOutputFieldName": "change_action" + }, + { + "fieldName": "change_category", + "owner": "ms_ad_obj_audit_changes", + "type": "string", + "fieldSearch": "change_category=*", + "required": true, + "multivalue": false, + "hidden": false, + "editable": true, + "displayName": "change_category", + "comment": "", + "lookupOutputFieldName": "change_category" + } + ], + "calculationType": "Lookup", + "lookupName": "AD_Audit_Change_EventCodes", + "comment": "", + "lookupInputs": [ + { + "inputField": "EventCode", + "lookupField": "EventCode" + }, + { + "inputField": "obj_type", + "lookupField": "obj_type" + } + ], + "owner": "ms_ad_obj_audit_changes", + "calculationID": "d9nxe8yfh4d", + "editable": true + } + ], + "constraints": [], + "lineage": "ms_ad_obj_audit_changes", + "baseSearch": "`ms_obj_changes_base_all`" + }, + { + "objectName": "ms_ad_obj_audit_group_changes", + "displayName": "ms_ad_obj_audit_group_changes", + "parentName": "ms_ad_obj_audit_changes", + "comment": "", + "fields": [], + "calculations": [], + "constraints": [ + { + "search": "change_category=\"Group\" OR change_category=\"Group Membership\"", + "owner": "ms_ad_obj_audit_changes.ms_ad_obj_audit_group_changes" + } + ], + "lineage": "ms_ad_obj_audit_changes.ms_ad_obj_audit_group_changes", + "baseSearch": "" + }, + { + "objectName": "ms_ad_obj_gpo_changes", + "displayName": "ms_ad_obj_audit_gpo_changes", + "parentName": "ms_ad_obj_audit_changes", + "comment": "", + "fields": [], + "calculations": [], + "constraints": [ + { + "search": "change_category=\"Group Policy\"", + "owner": "ms_ad_obj_audit_changes.ms_ad_obj_gpo_changes" + } + ], + "lineage": "ms_ad_obj_audit_changes.ms_ad_obj_gpo_changes", + "baseSearch": "" + }, + { + "objectName": "ms_ad_obj_audit_user_changes", + "displayName": "ms_ad_obj_audit_user_changes", + "parentName": "ms_ad_obj_audit_changes", + "comment": "", + "fields": [], + "calculations": [], + "constraints": [ + { + "search": "change_category=\"User\"", + "owner": "ms_ad_obj_audit_changes.ms_ad_obj_audit_user_changes" + } + ], + "lineage": "ms_ad_obj_audit_changes.ms_ad_obj_audit_user_changes", + "baseSearch": "" + }, + { + "objectName": "ms_ad_obj_audit_ou_changes", + "displayName": "ms_ad_obj_audit_ou_changes", + "parentName": "ms_ad_obj_audit_changes", + "comment": "", + "fields": [], + "calculations": [], + "constraints": [ + { + "search": "change_category=OU", + "owner": "ms_ad_obj_audit_changes.ms_ad_obj_audit_ou_changes" + } + ], + "lineage": "ms_ad_obj_audit_changes.ms_ad_obj_audit_ou_changes", + "baseSearch": "" + }, + { + "objectName": "ms_ad_obj_audit_computer_changes", + "displayName": "ms_ad_obj_audit_computer_changes", + "parentName": "ms_ad_obj_audit_changes", + "comment": "", + "fields": [], + "calculations": [], + "constraints": [ + { + "search": "change_category=\"Computer\"", + "owner": "ms_ad_obj_audit_changes.ms_ad_obj_audit_computer_changes" + } + ], + "lineage": "ms_ad_obj_audit_changes.ms_ad_obj_audit_computer_changes", + "baseSearch": "" + } + ], + "objectNameList": [ + "ms_ad_obj_audit_changes", + "ms_ad_obj_audit_group_changes", + "ms_ad_obj_gpo_changes", + "ms_ad_obj_audit_user_changes", + "ms_ad_obj_audit_ou_changes", + "ms_ad_obj_audit_computer_changes" + ] +} diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/nav/default.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/nav/default.xml new file mode 100644 index 00000000..ac91a2d7 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/nav/default.xml @@ -0,0 +1,321 @@ + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ad_objects__configuration__getting_data_in.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ad_objects__configuration__getting_data_in.xml new file mode 100644 index 00000000..621c4107 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ad_objects__configuration__getting_data_in.xml @@ -0,0 +1,1948 @@ +
+ + + 0 + 0 + 0 + 0 + 1 + 0 + active + completed + True + enabled + enabled + enabled + enabled + hidden + prep_task_step_title_y + True + Pending + Pending + Pending + Pending + Pending + Pending + Pending + 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 + Pending + Pending + Pending + Pending + Pending + Pending + Pending + display:none; + display:none; + display:none; + display:none; + display:none; + display:none; + display:none; + + + + + + false + display:none; + + + + + + + + + + + + + + + + + | inputlookup ms_ad_obj_cfg_gs + + + $result.form_tok_build_type$ + $result.form_tok_build_type$ + $result.tok_h_load_details$ + $result.tok_h_state_completed$ + $result.tok_h_state_input_1$ + $result.tok_h_state_input_10$ + $result.tok_h_state_input_10_s$ + $result.tok_h_state_input_11$ + $result.tok_h_state_input_12$ + $result.tok_h_state_input_2$ + $result.tok_h_state_input_2_s$ + $result.tok_h_state_input_3$ + $result.tok_h_state_input_4$ + $result.tok_h_state_input_4_s$ + $result.tok_h_state_input_5$ + $result.tok_h_state_input_6$ + $result.tok_h_state_input_6_s$ + $result.tok_h_state_input_7$ + $result.tok_h_state_input_7_hold$ + $result.tok_h_state_input_8$ + $result.tok_h_state_input_8_hold$ + $result.tok_h_state_input_9$ + $result.tok_h_state_input_9_hold$ + $result.tok_h_state_input_9_s$ + $result.tok_inp_hold_diff_sys$ + $result.tok_inp_splk_hf_label$ + $result.tok_input_10_a_i$ + $result.tok_input_10_b_i$ + $result.tok_input_11_a_i$ + $result.tok_input_11_b_i$ + $result.tok_input_12_a_i$ + $result.tok_input_12_b_i$ + $result.tok_input_1_a_i$ + $result.tok_input_1_b_i$ + $result.tok_input_2_a_i$ + $result.tok_input_2_b_i$ + $result.tok_input_3_a_i$ + $result.tok_input_3_b_i$ + $result.tok_input_4_a_i$ + $result.tok_input_4_b_i$ + $result.tok_input_5_a_i$ + $result.tok_input_5_b_i$ + $result.tok_input_6_a_i$ + $result.tok_input_6_b_i$ + $result.tok_input_7_a_i$ + $result.tok_input_7_b_i$ + $result.tok_input_8_a_i$ + $result.tok_input_8_b_i$ + $result.tok_input_9_a_i$ + $result.tok_input_9_b_i$ + $result.tok_t_nav_1_btn_next_st$ + if($result.tok_obj_depl_msg$="empty",NULL,$result.tok_obj_depl_msg$) + if($result.tok_obj_depl_msg$="empty","empty",$result.tok_obj_depl_msg$) + $result.tok_obj_dl_soft_uf$ + $result.tok_obj_dl_ta_cc$ + $result.tok_obj_env_type$ + $result.tok_obj_env_type_arch$ + $result.tok_obj_inp_core_ds_same$ + $result.tok_obj_inp_ds_hf_same$ + $result.tok_obj_inst_ds$ + $result.tok_obj_inst_ds_wta$ + $result.tok_obj_inst_hf$ + $result.tok_obj_inst_hf_cc$ + $result.tok_obj_inst_hf_wta$ + $result.tok_obj_inst_uf$ + $result.tok_obj_inst_uf_wta$ + $result.tok_obj_upg_app$ + $result.tok_obj_use_ds$ + $result.tok_obj_use_hf$ + $result.tok_state_completed$ + $result.tok_state_lbl$ + $result.tok_auto_chk_lbl$ + $result.tok_state_lbl_icon$ + $result.tok_state_lbl_color$ + $result.tok_macro_base_url$ + + + True + + + + + eval holder="$env:is_enterprise$",trigger="$tok_get_first_cfg_chk$" +| search holder="true" last_config="Skip" +| eval user_nm="$env:user$" + + + + Not Enterprise + + + /manager/ms_windows_ad_objects/$result.user_nm$/macros + ent + dl_ta_cc_n + Heavy + Completed + Next + Next + Pending + Pending + + chosen + true + + + + + + eval holder="$env:is_cloud$",trigger="$tok_get_first_cfg_chk$" +| search holder="true" last_config="Skip" + + + + Not Cloud + + + /manager/ms_windows_ad_objects/data/macros + cloud + obj_none + Heavy/Gateway + obj_inp_core_ds_same_n + Completed + Completed + Skip + Next + Next + Skip + Skip + Next + Skip + chosen + + true + + + + + + | `ms_obj_cfg_gs_update("$form.tok_build_type$","$tok_h_load_details$","$tok_h_state_completed$","$tok_h_state_input_1$","$tok_h_state_input_10$","$tok_h_state_input_10_s$","$tok_h_state_input_11$","$tok_h_state_input_12$","$tok_h_state_input_2$","$tok_h_state_input_2_s$","$tok_h_state_input_3$","$tok_h_state_input_4$","$tok_h_state_input_4_s$","$tok_h_state_input_5$","$tok_h_state_input_6$","$tok_h_state_input_6_s$","$tok_h_state_input_7$","$tok_h_state_input_7_hold$","$tok_h_state_input_8$","$tok_h_state_input_8_hold$","$tok_h_state_input_9$","$tok_h_state_input_9_hold$","$tok_h_state_input_9_s$","$tok_inp_hold_diff_sys$","$tok_inp_splk_hf_label$","$tok_input_10_a_i$","$tok_input_10_b_i$","$tok_input_11_a_i$","$tok_input_11_b_i$","$tok_input_12_a_i$","$tok_input_12_b_i$","$tok_input_1_a_i$","$tok_input_1_b_i$","$tok_input_2_a_i$","$tok_input_2_b_i$","$tok_input_3_a_i$","$tok_input_3_b_i$","$tok_input_4_a_i$","$tok_input_4_b_i$","$tok_input_5_a_i$","$tok_input_5_b_i$","$tok_input_6_a_i$","$tok_input_6_b_i$","$tok_input_7_a_i$","$tok_input_7_b_i$","$tok_input_8_a_i$","$tok_input_8_b_i$","$tok_input_9_a_i$","$tok_input_9_b_i$","$tok_obj_depl_msg_val$","$tok_obj_dl_soft_uf$","$tok_obj_dl_ta_cc$","$tok_obj_env_type$","$tok_obj_env_type_arch$","$tok_obj_inp_core_ds_same$","$tok_obj_inp_ds_hf_same$","$tok_obj_inst_ds$","$tok_obj_inst_ds_wta$","$tok_obj_inst_hf$","$tok_obj_inst_hf_cc$","$tok_obj_inst_hf_wta$","$tok_obj_inst_uf$","$tok_obj_inst_uf_wta$","$tok_obj_upg_app$","$tok_obj_use_ds$","$tok_obj_use_hf$","$tok_state_completed$","$tok_state_lbl$","$tok_macro_base_url$","$tok_upd_cfg_def$")` + + + + | `ms_obj_cfg_macro_chk_h("$tok_check_mac_trigger$")` + + + +| makeresults +| eval obj_env_type="$tok_obj_env_type$" +| eval obj_env_type_arch="$tok_obj_env_type_arch$" +| eval hdr_d_top_ta_cc=if("$tok_obj_upg_app$"="obj_upg_app_n" AND obj_env_type=="cloud" AND "$tok_obj_use_hf$"="obj_use_hf_n" AND "$tok_obj_inp_ds_hf_same$"="obj_inp_ds_hf_same_n","hdr_d_top_ta_cc_y","hdr_d_top_ta_cc_n") +| eval hdr_p_top_ds=if("$tok_obj_upg_app$"="obj_upg_app_n" AND ("$tok_obj_use_ds$"="obj_use_ds_y" OR "$tok_obj_inp_ds_hf_same$"="obj_inp_ds_hf_same_y"),"hdr_p_top_ds_y","hdr_p_top_ds_n") +| eval hdr_p_top_dl=if("$tok_obj_upg_app$"="obj_upg_app_n","hdr_p_top_dl_y","hdr_p_top_dl_n") +| eval obj_dl_ent=if(("$tok_obj_inst_hf$"="obj_inst_hf_y" OR "$tok_obj_inst_ds$"="obj_inst_ds_y"),"obj_dl_ent_y","obj_dl_ent_n") +| eval obj_dl_soft=if(obj_dl_ent=="obj_dl_ent_y" OR "$tok_obj_inst_uf$"="obj_inst_uf_y","obj_dl_soft_y","obj_dl_soft_n") +| eval obj_dl_ta_wta=if("$tok_obj_inst_hf_wta$"="obj_inst_hf_wta_n" AND "$tok_obj_inst_uf$"="obj_inst_uf_n" AND "$tok_obj_inst_uf_wta$"="obj_inst_uf_wta_n" AND "$tok_obj_use_ds$"="obj_use_ds_y" AND "$tok_obj_inst_ds$"="obj_inst_ds_n" AND "$tok_obj_inst_hf$"="obj_inst_hf_n","obj_dl_ta_wta_n","obj_dl_ta_wta_y") +| eval obj_dl_ta_cc=if("$tok_obj_env_type$"="ent","obj_dl_ta_cc_n",if(("$tok_obj_inst_ds$"="obj_inst_ds_y" OR "$tok_obj_inst_hf$"="obj_inst_hf_y"),"obj_dl_ta_cc_y",if("$tok_obj_inst_uf$"="obj_inst_uf_y","obj_dl_ta_cc_y","obj_dl_ta_cc_n"))) +| eval obj_inst_core_ta_wta=if("$tok_obj_upg_app$"="obj_upg_app_n" AND obj_dl_ta_wta="obj_dl_ta_wta_n","obj_inst_core_ta_wta_n","obj_inst_core_ta_wta_y") +| eval obj_depl=if(hdr_d_top_ta_cc=="hdr_d_top_ta_cc_y" OR "$tok_obj_inst_uf$"="obj_inst_uf_y" OR "$tok_obj_use_ds$"="obj_use_ds_n","obj_depl_y","obj_depl_n") + + + $result.hdr_d_top_ta_cc$ + $result.hdr_p_top_ds$ + $result.hdr_p_top_dl$ + $result.obj_depl$ + if($result.obj_depl$="obj_depl_n",NULL,"obj_depl_y") + if($result.obj_depl$="obj_depl_n","obj_depl_n",NULL) + if($result.obj_depl$="obj_depl_n","obj_depl_n","empty") + $result.obj_dl_ent$ + $result.obj_dl_soft$ + $result.obj_dl_ta_cc$ + $result.obj_dl_ta_wta$ + $result.obj_inst_core_ta_wta$ + Defined Scope + + + + + | inputlookup AD_Domain_Selector +| eval trigger="$tok_new_cfg$" +| head 2 + + + 0 + disabled + chk_pre_upg_n + Pending Scope Definition: + obj_upg_app_n + Completed + pending + + chosen + pre_check_prev_vers_n + + + 0 + disabled + chk_pre_upg_y + build_all + Upgrade Pre-Check + obj_depl_n + enable + ms_ad_obj_gs_prep.html + obj_upg_app_y + none + none + none + none + no + no + no + no + no + Completed + Not_Required + Not_Required + Skip + Not_Required + Not_Required + Skip + Not_Required + Not_Required + Skip + Skip + Skip + Not_Required + Not_Required + Skip + Skip + Pre-Check - It appears you are upgrading the MS Windows AD Objects application, if not then select Yes on the first question in the left panel.: + completed + chosen + + pre_check_prev_vers_y + + + + + `ms__obj_win_ad_index` eventtype="ms_ad_obj_msad-dc-health" +| eval tok_srch_trigger_rerun_val="$tok_dom_health_trigger$" +| head 2 + + + + chk_dm_health_missing + Warning: MSAD Health data is missing. + Review below troubleshooting steps for checking required macro index definitions and enabling the MSAD Health data collection input on a Domain Controller or Click the Manually Domain Input to manually input the Domain values. Note: You can ignore if you the above Status is "Ok: AD_Obj_Domain Lookup has data". + ms_ad_obj_gs_chk_data_src.html + ms_ad_obj_gs_chk_data_det.html + chk_d_y + chk_d_ko_y + chk_d_dom_health_y + chk_d_man_domain_y + + + chk_dm_health_ok + OK: MSAD Health data is available + MSAD Health Data is being indexed, and will be used to update AD_Obj_Domain lookup. + chk_d_dom_health_n + chk_d_man_domain_n + + + @d + now + + + + | inputlookup AD_Obj_Domain +| eval tok_srch_trigger_rerun_val="$tok_dom_lkup_trigger$" + + + AD_Domain_Selector + + + + + $job.resultCount$ + TRUE + TRUE + F + display:none; + chk_dm_lkp_ok + Ok: AD_Obj_Domain Lookup has data + The AD_Obj_Domain Lookup has data, so if the other data checks are ok then click Next to proceed to the Building Lookup tasks. + TRUE + TRUE + + + + + + + @d + now + + + | inputlookup $tok_sec_domain_attempt$ + + + `ms_obj_admon_bld_domain` + + + + + + ms_obj_admon_migrate_out + + + @d + now + + + |`$tok_third_domain_attempt$(domain,Domain)` + + + `ms_obj_admon_bld_domain` + + + + + $job.resultCount$ + TRUE + TRUE + F + display:none; + chk_dm_lkp_ok + Ok: AD_Obj_Domain Lookup migration completed. + The AD_Obj_Domain Lookup now has data populated by the previous versions lookup AD_Domain_Selector, so if the other data checks are ok then click Next to proceed to the Building Lookup tasks. + TRUE + + + + + + + @d + now + + + $tok_fourth_domain_attempt$ + + + 0 + chk_dm_lkp_missing + Critical: AD_Obj_Domain Lookup is missing data + The AD_Obj_Domain Lookup has not been populated. This is required before proceeding to the next step. Review the below troubleshooting steps and then click the Rerun Autocheck button to attempt to build again. The AD_Obj_Domain lookup has to be populated before attempting to build the other AD_Obj_... lookups. Note: You can also manually populate this lookup using the below manual entry form. + chk_dm_health_missing + Warning: MSAD Health data is missing + MSAD Health data is not being collected, so the AD_Obj_Domain Lookup was not populated. Review the below troubleshooting steps and then click the Rerun Autocheck button to attempt to build again. Note: You can also manually populate this lookup using the below manual entry form. + chk_d_y + chk_d_ko_y + + + + + $job.resultCount$ + TRUE + F + display:none; + TRUE + chk_dm_lkp_ok + Ok: AD_Obj_Domain Lookup has been built + The AD_Obj_Domain Lookup now has data populated by the MSAD Health collected data, so if the other data checks are ok then click Next to proceed to the Building Lookup task. + TRUE + + + + + + @d + now + + + + `ms_obj_admon_get_begin_sync_t_val` +| eval auto_earliest=strptime(Recommended_Sync_Start_Day,"%m/%d/%y") +| eval tok_srch_trigger_rerun_val="$tok_ad_sync_trigger$" + + + + + chk_d_res_admon_y + chk_d_ko_y + chk_admon_sync_missing + Warning: admon Baseline (Sync) data is missing + The baseline admon (ie admonEventType=Sync) has not been collected, macro pointing to sourcetype ActiveDirectory is incorrect. If you collected it more than a year ago, it is recommended to recollect it now. Click the "Resetting admon Baseline" button below and follow the steps. + + + chk_d_res_admon_n + chk_admon_sync_ok + OK: admon Baseline (Sync) data is available + The baseline admon (ie admonEventType=Sync) is available, starting from $result.Last_Sync_Day$. + $result.Recommended_Sync_Start_Day$ + $result.Last_Sync_Day$ + True + $result.auto_earliest$ + $result.auto_earliest$ + admon Last Sync Data ($result.Recommended_Sync_Start_Day$) - total Sync Events ($result.Sync_Count$) + + + 0 + now + + + + | makeresults +| eval async="$tok_chk_d_admon_sync_cls$" +| eval domlkp="$tok_chk_d_dom_lkp_cls$" +| eval warn=if(async=="chk_admon_sync_missing" OR domlkp=="chk_dm_lkp_missing","TRUE","FALSE") +| search warn="TRUE" + + + + + + TRUE + + + + + + | makeresults +| eval trigger="$tok_add_domain_trigger$" +| eval host = "$tok_upd_dm_host$" +| eval DomainDNSName = "$tok_upd_dm_dns$" +| eval DomainNetBIOSName = "$tok_upd_dm_netbios$" +| eval domain = DomainNetBIOSName +| eval ForestName = "$tok_upd_dm_forest$" +| eval Site = "$tok_upd_dm_site$" +| eval time=now() +| eval multi_lkps_enabled="f" +| eval kv_suffix=lower(DomainNetBIOSName) +| eval dc_val=lower(DomainDNSName) +| eval user_lookup="AD_Obj_User",group_lookup="AD_Obj_Group",computer_lookup="AD_Obj_Computer" +| table domain,host,DomainNetBIOSName,DomainDNSName,ForestName,Site,time,multi_lkps_enabled,kv_suffix,dc_val,user_lookup,group_lookup,computer_lookup +| eval _key=host +| outputlookup AD_Obj_Domain append=true + -24h@h + now + + $result.host$ + $result.ForestName$ + $result.DomainDNSName$ + $result.DomainNetBIOSName$ + $result.Site$ + + + + $result.time$ + $result.time$ + $result.time$ + + + + + | inputlookup AD_Obj_UAC | head 5 + + + ms_obj_UAC_new + + + + + + + + | `$load_new_uac_table$` + + + | $tok_start_uac_flg$ +| eval uac_u_vals="$tok_uac_u$" +| eval uac_c_vals="$tok_uac_c$" +| eval userAccountControl=case(uac_u_vals="0" AND uac_c_vals="0","NA",uac_u_vals="0",uac_c_vals,uac_c_vals="0",uac_u_vals,uac_u_vals!="0" AND uac_c_vals!="0",uac_u_vals.",".uac_c_vals) +| makemv delim="," userAccountControl +| mvexpand userAccountControl +| table userAccountControl +| join type=left userAccountControl [|inputlookup AD_Obj_UAC | table userAccountControl,uac_bin_map,uac_details] +| WHERE (isnull(uac_details) OR uac_details="") AND userAccountControl!="NA" +| table userAccountControl +| `ms_obj_uac_to_details` +| table userAccountControl,uac_bin_map,uac_details +| eval _key=userAccountControl +| outputlookup AD_Obj_UAC append=true + + + | makeresults +| eval type_value="build_all,build_individual" +| makemv delim="," type_value +| mvexpand type_value +| eval srt_order=if(type_value=="build_all",1,2) +| eval type_label=if(type_value="build_all","New Build - All","New Build - Individual") +| append [| inputlookup AD_OU_LDAP_list | fields | stats count | eval type_label=if(count>0,"Migrate Previous",NULL),type_value=if(count>0,"build_migrate",NULL),srt_order=0 | table type_label,type_value,srt_order] +| sort srt_order +| where isnotnull(type_value) +| table srt_order,type_value,type_label + + + `$tok_exec_time_helper$` + + Running - Please Wait. + + Pending + Pending + + + + Warning: No Sync admon Events Found. Make sure you have followed the steps for getting the admon baseline data in, and have permission to the index specified in the macro ms__obj_win_ad_index. + Not Found + Not Found + True + + + Review Results - Settings (2. Select Admon Sync Time) + $result.Recommended_Start_Sync_Day$ + $result.Last_Sync_Day$ + True + + + -180d@d + now + + + | `ms_obj_config_st_upd($tok_result_btn_run$)` + + + + | makeresults +| eval flag_status=if("$tok_count_user_build$"="0" OR "$tok_count_computer_build$"="0" OR "$tok_count_group_build$"="0" OR "$tok_count_ou_build$"="0" OR "$tok_count_gpo_build$"="0" OR "$tok_count_gpo_ou_link$"="0" OR "$tok_count_admin_audit_build$"="0","1","0") +| eval completed_trigger="$tok_result_btn_run$" +| eval flag_ok=if(flag_status=="1","0","1") +| eval flag_warn=if(flag_status=="1","1","0") +| table flag_ok,flag_warn + + + + + if($result.flag_ok$=="0",NULL,"True") + if($result.flag_warn$=="0",NULL,"True") + completed + + + + + $tok_exec_user_build$ +| stats count,values(userAccountControl) AS uac_e_val +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" +| table count,flg_compl,uac_e_val,build_type + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + 0 + Warning + 0 + Warning: No User admon events found - Change Sync Time Period + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out(computer,Computer)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(computer,Computer)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.flg_compl$="T",$result.uac_e_val$,0) + if($result.build_type$="build_all","`ms_obj_admon_bld_init_out(computer,Computer)`",if($result.build_type$="build_migrate","|`ms_obj_admon_migrate_out(computer,Computer)`",NULL)) + if($result.build_type$="build_all","Running",if($result.build_type$="build_migrate","Migrating","Next")) + if($result.build_type$="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.flg_compl$="T","Initial Build: AD_Obj_User Lookup - Completed","Warning: No User admon events found - Change Sync Time Period") + if($result.flg_compl$="T","Success","Warning") + if($result.build_type$="build_individual"," ","display:none;") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_computer_build$ +| stats count,values(userAccountControl) AS uac_e_val +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" +| table count,flg_compl,uac_e_val,build_type + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + 0 + makeresults + Warning + 0 + Warning: No Computer admon events found - Change Sync Time Period + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out(group,Group)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(group,Group)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.flg_compl$="T",$result.uac_e_val$,0) + makeresults + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out(group,Group)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(group,Group)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + if($result.flg_compl$=="T","Initial Build: AD_Computer Lookup - Completed","Warning: No Computer admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_group_build$ +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + Warning + 0 + Warning: No Group admon events found - Change Sync Time Period + if($result.build_type$=="build_all","ms_obj_admon_bld_init_out(ou,OU)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(ou,OU)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out(ou,OU)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(ou,OU)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + $result.count$ + if($result.flg_compl$=="T","Initial Build: AD_Obj_Group Lookup - Completed","Warning: No Group admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_ou_build$ +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + Warning + 0 + Warning: No OU admon events found - Change Sync Time Period + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out(gpo,GPO)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(gpo,GPO)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out(gpo,GPO)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(gpo,GPO)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + if($result.flg_compl$=="T","Initial Build: AD_OU Lookup - Completed","Warning: No OU admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_gpo_build$ +| stats count +| eval flg_compl=if(count>0,"T","F") + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + Warning + 0 + Warning: No GPO admon events found - Change Sync Time Period + ms_ad_admon_upd_gpo_wou + ms_ad_admon_upd_ou_wgpo + Running + Executing... Please Wait... + display:none; + + + ms_ad_admon_upd_gpo_wou + ms_ad_admon_upd_ou_wgpo + Running + Executing... Please Wait... + if($result.flg_compl$=="T","Initial Build: AD_GPO Lookup - Completed","Warning: No GPO admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + | `$tok_exec_gpo_ou_link$` +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + Warning + 0 + Warning: No GPO<->OU Links found in AD_Obj_GPO and AD_Obj_OU Lookups + if($result.build_type$=="build_all","`ms_obj_winevt_init_admin_audit`",if($result.build_type$=="build_migrate","| `ms_obj_winevt_migrate_admin_audit`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + + + if($result.build_type$=="build_all","`ms_obj_winevt_init_admin_audit`",if($result.build_type$=="build_migrate","| `ms_obj_winevt_migrate_admin_audit`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + if($result.flg_compl$=="T","Initial Build: AD_Obj_GPO<->AD_Obj_OU Links - Completed","Warning - No GPO and OU Links Found - Change Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_admin_audit_build$ +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + Warning + 0 + if($result.build_type$=="build_migrate","Migrate: No Data - AD_Obj_Admin_Audit_list - Lookup","No Windows Change Events Found - Change Time Period" + completed + display:none; + + + if($result.flg_compl$=="T","Initial Build: AD_Obj_Admin_Audit Lookup - Completed","Warning: No Windows Change Events Found - Change Time Period") + if($result.flg_compl$=="T","Success","Warning") + completed + $result.count$ + display:none; + + + $tok_time_admin.earliest$ + $tok_time_admin.latest$ + + + | makeresults +| eval state="$tok_build_clear_flag$" +| search state="clear" + + + + + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + + + + +
+ + + +
+
+
+
+ + + + + + + + + + +
+ + + + + + + + + + + + +
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + +
+

+ Scope Definition: Select your environment and deployment plans. +

+
+
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+

+ + No Deployment Task Steps are Required:

+
+
+
+
+
    +
  • +
    Based off of $tok_auto_chk_lbl$, there are no Deployment Steps needed.
    +
    • +
  • +
    + Click on the Next button at the top to proceed to the next Part Check Data +
    +
    • +
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+

Check Data - Click Rerun All Autochecks to rerun the validation searches after changes.

+

Use the below table to check that your environment is ready for the next task of Building the AD Object Lookup tables.

+
+
StatusMessage
+ + $tok_chk_d_dom_lkp_lbl$ Rerun Check + $tok_chk_d_dom_lkp_msg$
+ + $tok_chk_d_dom_health_lbl$ Rerun Check + $tok_chk_d_dom_health_msg$
+ + $tok_chk_d_admon_sync_lbl$ Rerun Check + $tok_chk_d_admon_sync_msg$
+ +
+ + 		+
+
+
+ + + + + + + + + + + + + +

Troubleshooting Bar:

+ Resetting admon Baseline + + Macro Settings Check + + + + MSAD Health Input + + Manual Domain Input + + Base OS Pre-Defined Inputs + + AD Pre-Defined Inputs +
+
+
+ + + + + + +
+
+

+ + +
+
Please Wait. $tok_show_build_all_msg$ All the lookups... + +

+
+
+ + +
+
+

+ + + Lookup Build Process Successfully Completed + +

+
+
    +
  • Click the in the Action column to view lookup results
    • +
  • Click the in the Action column to review base search.
    • +
  • You can Now Exit the Getting Started Dashboard or Click Here to open the Overview Dashboard.
    • +
+
+ + +
+
+

+ + + Warning: Build process cancelled or not all of the Lookups were successfully built + +

+
+

Review the below options and troubleshooting steps for more information on successfully building the required lookups.

+
    +
  • Click : Reset above Inputsefresh the settings and try expanding the Sync or Admin Audit Time Period
    • +
  • Click : Troubleshooting Roles and Knowledge Objects.
    • +
  • Click : Refreshing admon Baseline data with current values.
    • +
+
+ + + + + + build_all + build_all + type_label + type_value + + + + + display:none; + display:none; + + True + clear + + + + + display:none; + display:none; + + True + clear + true + + + + display:none; + display:none; + display:none; + clear + + + + + + + + + + -30d@d + now + + + clear + + + + + + -30d@d + now + + + clear + + + +
+

$tok_show_ok_sync_msg$

+
+ + +
+ +

Complete building the individual lookups using the table and action buttons in the right column.

+
+ + + +
+
+ Help and Tips: +

+

    +
  • + Setting the 2. Select Admon Sync Time input:: +
      +
    1. Click Use Sync Time Helper to help you determine what beginning start date to enter above for 2. Select Admon Sync Start Time.
      2. +
    2. It is important that you get the last time the admon baseline was collected, to ensure that all of the AD Objects (User/Group/Computer/OU/GPO) are added to the lookup.
      3. +
    3. Set the TimeSelector Date Range - - Begin From - - Date Value with value in the Recommended_Sync_Start_Day Column and set the End Date for today.
      4. +
    +
    • +
  • Click to view steps for Refreshing admon Baseline data with current values if no Sync data is found.
    • +
+

+
+
+ + Large AD Environments Tip: + +
    +
  • +
    + If you have a large AD Object count environment, and the building process is taking too long, it is recommended follow the steps outlined in the Steps for Recollecting admon Base Line Data to recollect the "Baseline" admon data for the individual Splunk Forwarder that is collecting admon data. +
    +
    • +
  • This will allow you to select a shorter time range for picking up the Sync data used to build the Lookups.
    • +
  • For Advance Users, you can also split out the User, Group, and Computer lookups into separate lookups for each domain. Click Here to review the configuration steps for performing this.
    • +
+
+
+
+ + + + + + + + + + + + + + + + +

Time Helper Results

Message:$tok_time_helper_msg$
First Time for Sync Data:$tok_time_helper_f_time$
Last Time for Sync Data:$tok_time_helper_l_time$
+

Use the table below for seeing the Sync history

+
+ + + Sync History + + table Recommended_Sync_Start_Day,Sync_Count +| sort -Sync_Count + + + + + + + + +
+ + +

Warning - Review the troubleshooting steps below before attempting to build the lookups. Required data is missing or unavailable.

+ +
+

+ Click to Build All AD Lookups + + + Click to Build AD_Obj_User Lookup First + + + Click to Migrate All AD Lookups + + +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
LookupBuild StatusObject CountStatus MessageActions
AD_Obj_Domain + (Success) + $tok_count_domain_build$Initial Build: AD_Obj_Domain Lookup - Completed. + +
AD_Obj_Users + ($tok_status_user_build$) + $tok_count_user_build$$tok_msg_user_build$ + + + + + +
AD_Obj_Computers + ($tok_status_computer_build$) + $tok_count_computer_build$$tok_msg_computer_build$ + + + Build Computer Lookup + + + +
AD_Obj_Group + ($tok_status_group_build$) + $tok_count_group_build$$tok_msg_group_build$ + + + Build Group Lookup + + + +
AD_Obj_OU + ($tok_status_ou_build$) + $tok_count_ou_build$$tok_msg_ou_build$ + + + Build OU Lookup + + + +
AD_Obj_GPO + ($tok_status_gpo_build$) + $tok_count_gpo_build$$tok_msg_gpo_build$ + + + Build GPO Lookup + + + +
AD_Obj_GPO<->AD_Obj_OU Links + ($tok_status_gpo_ou_link$) + $tok_count_gpo_ou_link$$tok_msg_gpo_ou_link$ + + GPO + OU +
AD_Obj_Admin_Audit + ($tok_status_admin_audit_build$) + $tok_count_admin_audit_build$$tok_msg_admin_audit_build$ + + + + + + Build Admin Audit Lookup +
+
+ + + + + + + + + +
+

+ Resulting Values in the $tok_dd_result_lookup$ KVstore Lookup +

+
+ + + + | inputlookup $tok_dd_result_lookup$ + +
+ + + + + Manually Add AD Domain Information into the AD_Obj_Domain lookup + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+

Fill Out the Boxes above, when all of the inputs have been populated, click the Add Above Values to add the Domain Details into the AD_Obj_Domain Lookup.

+

+ Add Above Values +

+
+
+ + + + +

+ + New Domain Information Just Added + +

+ + + + + + + + + + + + + + + + + +
hostdomainDomainDNSNameDomainNetBIOSNameForestNameSite
$tok_n_dm_host$$tok_n_dm_netbios$$tok_n_dm_dns$$tok_n_dm_netbios$$tok_n_dm_forest$$tok_n_dm_site$
+
+ + + Updated Full AD_Obj_Domain Lookup Table + + | inputlookup AD_Obj_Domain +| eval trigger="$tok_post_exec_add_d$" +| sort -time +| table domain,host,DomainNetBIOSName,DomainDNSName,ForestName,Site,user_lookup,group_lookup,computer_lookup + + + + + + + + + + + + + + +
+ + + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/dev_custom_icons.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/dev_custom_icons.xml new file mode 100644 index 00000000..728c1001 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/dev_custom_icons.xml @@ -0,0 +1,97 @@ + + + + Loading Panel + True + + + +

Loading Panel....

+ + + + + + + + index=_* log_level="*" +| fields _time, log_level, sourcetype +| stats max(_time) AS Last_Time by log_level,sourcetype +| eval panel_trigger=now() +| lookup ms_ad_obj_status_icons.csv Status AS log_level OUTPUT Status_Array AS Status +| eval Last_Time=strftime(Last_Time,"%m/%d/%y %I:%M %P") +| table Status,sourcetype,Last_Time,panel_trigger + + 30 + + + True + + + $results.panel_trigger$ + + TRUE + + -24h@h + now + + Status,sourcetype,Last_Time + +
+ + + + + Source Status Lookup - status_icons.csv + + + | inputlookup ms_ad_obj_status_icons.csv + +
+ + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_computer.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_computer.xml new file mode 100644 index 00000000..224cbf1b --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_computer.xml @@ -0,0 +1,602 @@ +
+ + + True + true + + 1000 + 9000 + green + Info: + 1: Select the Domain for the Target Computer. + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + + + + 1000 + 9000 + green + Info: + 1: Select the Domain for the Target Computer. + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + | `ms_obj_ss_filt_pre_lkp("$tok_computer_lkp$","$tok_domain$","$tok_comp_filter$","cn,sAMAccountName,dNSHostName,dn","domain,cn,sAMAccountName,dn,isDeleted,deletedDate,_key")` +| eval dom_srch_trigger="$tok_tgr_bs_dom_comp$",key_val=_key + + + + | fields +| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)` +| eval show_bypass_option=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"true","false") +| eval show_comp_list=if(count>=$tok_bypass_min$,"false","true") +| eval inp_bypass_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"2","false") +| eval inp_comp_lst_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"5","4") +| eval msg_state=if(count>=$tok_bypass_min$,"Warning","Info") +| eval msg_color=if(count>=$tok_bypass_min$,"red","green") +| eval msg=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Computers matched the \"Filter Computer\" ($tok_comp_filter$). Either update the \"Filter User\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow List Results Possible).",if(count>=$tok_results_max$,inp_comp_lst_nmb.": ".count." Total Computers matched the \"Filter User\" ($tok_comp_filter$). Update the \"Filter Computer\" to reduce the matching count.",inp_comp_lst_nmb.": (".count." Computers) Select an individual computer account from the \"Select Computer\" input.")) + + + + if($result.show_bypass_option$=="false",NULL,"true") + if($result.show_comp_list$=="false",NULL,"true") + if($result.show_comp_list$=="false",NULL,"true") + $result.count$ + 3 + $result.inp_bypass_nmb$ + $result.inp_comp_lst_nmb$ + $result.msg_color$ + $result.msg_state$ + $result.msg$ + \26A0\0020Use to reduce Computer list from $result.count$ + + + + $result.count$ + true + \26A0\0020Use to reduce Computer list from $result.count$ + + + + + | makeresults | eval tok_tgr_post_check="$tok_tgr_post_check$",dom_srch_trigger="$tok_tgr_bs_dom_comp$",count=$tok_filt_comp_cnt$ + + + + + + + red + Warning: + 2: No Computer found matching the "Filter Computer" ($tok_comp_filter$) entry. Update the "Filter Computer" to return values. Note: You can use wildcards, (ex. al*), cannot enter ONLY a *. + + + + + + eval trigger_sub_comp_list="$tok_tgr_sub_comp_list$" +| eval label=if(isnull(cn),sAMAccountName." (".domain." )",cn." (".domain." )") +| eval key_val=_key +| stats count by label,key_val +| sort label + + + + | makeresults +| eval exec_trigger="$tok_tgr_sub_comp_list$" +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_comp_filt$\",\"$tok_pre_filt_flds$\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_comp_filt$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`])" +| eval filt_raw_login_text="(host=\"$tok_comp_cn$\" OR host=\"$tok_comp_sam$\" OR host=\"$tok_comp_dnsh$\")" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_comp_filt$\",\"$tok_pre_filt_flds$\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_comp_filt$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`" +| eval filt_link="| search src_nt_host IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_comp_filt$\",\"$tok_pre_filt_flds$\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_comp_filt$\",\"cn,sAMAccountName,dn\",\"link\")`])" +| eval filt_link_r_evt="| search src_nt_host IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_comp_filt$\",\"$tok_pre_filt_flds$\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_comp_filt$\",\"cn,sAMAccountName,dn\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_raw_login_text + + + + + + + + + + + $result.filt_raw_login_text$ + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_raw_text_lbl$ + + + + + + | inputlookup $tok_computer_lkp$ WHERE domain="$tok_domain$" AND $tok_pre_filt_flds$="$tok_sel_comp_filt$" +| makemv delim="|" objectClass +| makemv delim=" " userAccountControl +| makemv delim="####" dSCorePropagationData +| fields * + 0 + now + + + lookup $tok_group_lkp$ member AS dn OUTPUT dn AS memberOf +| lookup $tok_group_lkp$ primaryGroupToken AS primaryGroupID OUTPUT dn AS p_memberOf +| eval memberOf=mvappend(memberOf,p_memberOf) +| fillnull value="" cn,dn,userPrincipalName +| fields * + + $result.dn$ + $result.dNSHostName$ + $result.cn$ + $result.sAMAccountName$ + $result.sAMAccountName$ + `ms_obj_failed_logons("user")` $tok_domain$ $tok_filt_raw_login_txt$ +| fields _time, host,src_host,src_nt_host,src_ip,Workstation_Name,Caller_Computer_Name,user_type,src_nt_domain,dest_nt_domain,user, src_user,status +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_host),if(isnull(src_nt_host),if(isnull(Workstation_Name),if(isnull(Caller_Computer_Name),upper(host),upper(Caller_Computer_Name)),upper(Workstation_Name)),upper(src_nt_host)),upper(src_host)) +| eval Logon_User=if(isnull(user),lower(src_user),lower(user)),status=if(status=="denied","failure",status) +$tok_filt_link$ +| stats max(_time) AS latest, values(src_nt_host) AS src_nt_hosts,values(src_ip) AS src_ips,min(_time) AS earliest, count AS Fail_Count by Logon_User +| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") +| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") +| sort 0 -Fail_Count +| table Logon_User,Fail_Count, First_Attempt, Last_Attempt,src_nt_hosts,src_ips + `ms_obj_win_events_security` +[| inputlookup AD_Audit_Change_EventCodes WHERE change_category="Computer" OR change_category="Group Membership" + | stats values(EventCode) AS EventCode by obj_type + | format + | table search] src_user_type="user" $tok_domain$ $tok_filt_raw_txt$ +| fields _time,EventCode,comp_obj_dn,comp_obj_sam,group_obj_lkp,msad_action,dir_svcs_action,obj_type,signature,change_signature,src_nt_domain,dest_nt_domain,src_user,user,user_obj_lkp,user_type,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,DN,MSADChangedAttributes,MSADChanges,MSADGroupClass,MSADGroupClassID,MSADGroupType,New_DN,Old_DN,change_category,member_obj_cn,member_obj_dn,member_obj_lkp,member_obj_id,member_obj_sam +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| eval member_obj_lkp=trim(member_obj_lkp) +| eval group_obj_val=if(obj_type="group",if(isnull(member_obj_lkp),if(isnull(group_obj_lkp),NULL,trim(group_obj_lkp)),member_obj_lkp),NULL) +| eval computer_obj_lkp=if(obj_type="computer" OR user_type="computer",if(isnull(comp_obj_dn),if(isnull(comp_obj_sam),if(match(user,"\$$"),user,NULL),comp_obj_sam),comp_obj_dn),NULL) +| eval obj_val=mvappend(user_obj_lkp,group_obj_val) +| eval dir_svcs_action=if(isnull(dir_svcs_action),"Unknown",dir_svcs_action) +| table _time,adminuser,src_user,dir_svcs_action,group_obj_lkp,member_obj_lkp,user_obj_lkp,msad_action,obj_type,obj_val,signature,change_signature,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,MSADChangedAttributes,MSADGroupClass,MSADGroupClassID,MSADGroupType,user, user_obj_lkp,comp_obj_dn,comp_obj_sam,dest_nt_domain,src_nt_domain,change_category,Change_Actions,New_DN,Old_DN, +| stats values(*) AS * by _time,src_user,obj_val,msad_action,dir_svcs_action +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| search change_category="Computer" (obj_val IN("$tok_comp_dn$","$tok_comp_cn$","$tok_comp$")) +| `ms_obj_md_group_m_c_change_out("$tok_group_lkp$","$tok_computer_lkp$")` + `ms_obj_changes_base_cat("Group Membership")` $tok_domain$ $tok_filt_raw_txt$ +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| search change_category="Group Membership" (member_obj_lkp IN("$tok_comp_dn$","$tok_user_cn$","$tok_comp$","$tok_comp_dn$")) +| `ms_obj_md_group_m_c_change_out("$tok_group_lkp$","$tok_computer_lkp$")` + + + + | Where match(isDeleted,"(?si)$tok_deleted$") +| eval sAMAccountName=lower(sAMAccountName) +| eval cn=if(deletedDate=="0",cn." ( ".mvindex(domain,0)." )",orig_cn." (Deleted - ".domain.")") +| eventstats count +| stats max(count) AS count by sAMAccountName,cn +| eval add_filter=if(count>9999,"true",if(count<1000,"false","empty")) +| eval count=tostring(count,"commas") +| table count,sAMAccountName,cn,add_filter +| sort cn + + + \0020\26A0\0020\0020 Filter to below 10,000 ( $result.count$ ) + "( ".toString($result.count$,"commas")." ) filtered computers" + ( $result.count$ + red + red + + + + "( ".toString($result.count$,"commas")." ) filtered computers" + green + green + + + + + `ms_obj_failed_logons("user")` $tok_domain$ $tok_filt_raw_login_txt$ +| fields _time, host,src_host,src_nt_host,src_ip,Workstation_Name,Caller_Computer_Name,user_type,src_nt_domain,dest_nt_domain,user, src_user,status +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_host),if(isnull(src_nt_host),if(isnull(Workstation_Name),if(isnull(Caller_Computer_Name),upper(host),upper(Caller_Computer_Name)),upper(Workstation_Name)),upper(src_nt_host)),upper(src_host)) +| eval Logon_User=if(isnull(user),lower(src_user),lower(user)),status=if(status=="denied","failure",status) +$tok_filt_link$ +| stats max(_time) AS latest, values(src_nt_host) AS src_nt_hosts,values(src_ip) AS src_ips,min(_time) AS earliest, count AS Fail_Count by Logon_User +| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") +| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") +| sort 0 -Fail_Count +| table Logon_User,Fail_Count, First_Attempt, Last_Attempt,src_nt_hosts,src_ips + $Time.earliest$ + $Time.latest$ + + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + + + + `ms_obj_win_events_security` +[| inputlookup AD_Audit_Change_EventCodes WHERE change_category="Computer" OR change_category="Group Membership" + | stats values(EventCode) AS EventCode by obj_type + | format + | table search] src_user_type="user" $tok_domain$ $tok_filt_raw_txt$ +| fields _time,EventCode,comp_obj_dn,comp_obj_sam,group_obj_lkp,msad_action,dir_svcs_action,obj_type,signature,change_signature,src_nt_domain,dest_nt_domain,src_user,user,user_obj_lkp,user_type,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,DN,MSADChangedAttributes,MSADChanges,MSADGroupClass,MSADGroupClassID,MSADGroupType,New_DN,Old_DN,change_category,member_obj_cn,member_obj_dn,member_obj_lkp,member_obj_id,member_obj_sam +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| eval member_obj_lkp=trim(member_obj_lkp) +| eval group_obj_val=if(obj_type="group",if(isnull(member_obj_lkp),if(isnull(group_obj_lkp),NULL,trim(group_obj_lkp)),member_obj_lkp),NULL) +| eval computer_obj_lkp=if(obj_type="computer" OR user_type="computer",if(isnull(comp_obj_dn),if(isnull(comp_obj_sam),if(match(user,"\$$"),user,NULL),lower(comp_obj_sam)),lower(comp_obj_dn)),NULL) +| eval obj_val=mvappend(user_obj_lkp,group_obj_val,computer_obj_lkp) +| eval dir_svcs_action=if(isnull(dir_svcs_action),"Unknown",dir_svcs_action) +| table _time,adminuser,src_user,dir_svcs_action,group_obj_lkp,member_obj_lkp,user_obj_lkp,msad_action,obj_type,obj_val,signature,change_signature,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,MSADChangedAttributes,MSADGroupClass,MSADGroupClassID,MSADGroupType,user, user_obj_lkp,comp_obj_dn,comp_obj_sam,dest_nt_domain,src_nt_domain,change_category,Change_Actions,New_DN,Old_DN, +| stats values(*) AS * by _time,src_user,obj_val,msad_action,dir_svcs_action + $Time.earliest$ + $Time.latest$ + + + + search obj_type="group" change_category="Group Membership" (obj_val IN("$tok_comp_dn$","$tok_comp_cn$","$tok_comp$")) +| `ms_obj_md_group_m_c_change_out("$tok_group_lkp$","$tok_computer_lkp$")` + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + + + + search change_category="Computer" (obj_val IN("$tok_comp_dn$","$tok_comp_cn$","$tok_comp$")) +| `ms_obj_md_computer_change_out("$tok_computer_lkp$")` + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + +
+
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + * + + + True + True + + + False + $value$ + domain="$value$" + domain="$value$" AND + True + green + Info: + 2: Enter a computer filter in the "Filter Computer" input. Note: This filter will look through the "CN, sAMAccountName, and distinguishedName" to filter the "Select Computer" dropdown. You can use wildcards, cannot enter ONLY a *. + + + + + + + + + $value$ + True + True + + + + + + + + + + + + + + + No + Yes + False + False + + + + No + Yes + no + no + + + + + + + true + true + + + + + + Select... + sel + sel + + + + label + key_val + + + + + + true + + + + + + true + True + $value$ + _key + search _key="$value$" + + + + true + + + + + + + + @d + now + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + +

Filter and then Select Computer to view Audit Details

+ + + + + + AD LDAP Details for computer ($tok_comp_cn$) + +
+ + + + + Group Membership - Computer + + table memberOf,groupName,primaryGroupID +| stats count by memberOf,primaryGroupID +| lookup $tok_group_lkp$ dn AS memberOf OUTPUT cn AS groupName +| rename memberOf AS groupDN +| table groupDN, groupName, primaryGroupID +| sort primaryGroupID + + + + + + + + + + + +
+ +

Computer Failed Login Activity Search ($tok_comp_login_state$)

+ + +

No Failed Login Activity for Computer ($tok_comp_cn$) + Review Search

+ + + Failed Logon Activity - Computer + + + + + + + + + Computer="$tok_comp$" + + + + +
+ +

Computer Account Changes Search ($tok_comp_cchange_state$)

+ + +

No Account Change Activity for Computer ($tok_comp_cn$) + Review Search

+ + + Computer Account Changes + + table _time,adminuser,user,dest_user_subject,msad_action,Change_Details +| rename msad_action as "Action",user as "Target User",dest_user_subject as "Target User ID",adminuser as "Admin User",Change_Details as "Change Details" + + + + + + +
+ +

Computer Membership Changes Search ($tok_comp_gchange_state$)

+ + +

No Membership Change Activity for Computer ($tok_comp_cn$) + Review Search

+ + + User Group Membership Changes + + table _time,adminuser,group_obj_nm,msad_action,MSADGroupType,MSADGroupClass,Change_Details +| rename group_obj_nm as "Target Group",MSADGroupClass as "GroupClass",msad_action AS "Action",adminuser as "Admin User",MSADGroupType as "GroupType",Change_Details as "Change Details" + + + + + + +
+ + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_gpo.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_gpo.xml new file mode 100644 index 00000000..799e9569 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_gpo.xml @@ -0,0 +1,138 @@ +
+ + + | inputlookup AD_Obj_GPO +| makemv delim="|" objectClass +| makemv delim="####" dSCorePropagationData +| fields * + 0 + + + + search domain="$tok_domain$" cn="$tok_gpo$" +| fields * + + + `ms_obj_changes_base_cat("Group Policy")` (src_nt_domain="$tok_domain$" OR dest_nt_domain="$tok_domain$") ([|`ms_obj_ss_filt_raw_link("$tok_gpo$","cn","AD_Obj_GPO","$tok_domain$","$tok_gpo$","cn,displayName,distinguishedName","raw_txt")`]) +| fields _time, _raw,sourcetype,session_id, src_nt_domain, src_user,Object_Name_Guid,displayName,msad_action,change_action,dir_svcs_action,AttributeLDAPDisplayName,AttributeSyntaxOID,AttributeValue,MSADChangedAttributes,Correlation_ID,signature,Old_DN,New_DN +| eval time_group=strftime(_time,"%m/%d/%y %I:%M %P") +| eval time_group_epoch=strptime(time_group,"%m/%d/%y %I:%M %P") +| eval change_action=if(isnull(change_action),"modified",change_action) +| fillnull value="NA" Correlation_ID,msad_action +| eval adminuser=if(isnull(src_nt_domain),src_user,src_nt_domain."\\".src_user) +| eval Object_Lookup_Name="{".lower(Object_Name_Guid)."}" +| eval change_action=if(isnull(msad_action),change_action,msad_action) +| eval chg_summary=case(change_action="created","|GPO Created:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature,change_action="undeleted","|GPO Undeleted:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature,change_action="deleted","|GPO Deleted:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature,change_action="modified","|GPO Modified:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature) +| lookup AD_Obj_GPO cn AS Object_Lookup_Name OUTPUT displayName,distinguishedName,cn +| eval displayName=if(isnull(displayName),Object_Lookup_Name,displayName) +| stats values(displayName) AS GPO,values(chg_summary) AS chg_summary by time_group,cn,adminuser,msad_action +| makemv delim="|" chg_summary +| search cn IN([|`ms_obj_ss_filt_raw_link("$tok_gpo$","cn","AD_Obj_GPO","$tok_domain$","$tok_gpo$","cn,displayName,distinguishedName","link")`]) +| table time_group,adminuser,msad_action,chg_summary +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",msad_action AS Change_Actions,GPO as "Target_GPO",chg_summary as "Change Summary" + $Time.earliest$ + $Time.latest$ + +
+ + + + | inputlookup AD_Obj_Domain +| stats count by DomainNetBIOSName +| rename DomainNetBIOSName AS domain +| table domain + + Select .... + domain + domain + + + + + + + + + $value$ + True + True + True + + + true + + + + + search domain=$tok_domain$ | stats count by displayName,cn | table displayName,cn | sort displayName + + displayName + cn + true + + + + + @d + now + + +
+ + + +
+ + + + + Linked Containers + + | inputlookup AD_Obj_GPO +| search domain="$tok_domain$" cn="$tok_gpo$" +| rename displayName AS gpo_name +| table gpo_name, lc +| mvexpand lc +| rename lc as "Linked Containers" + $Time.earliest$ + $Time.latest$ + + + + + + +
+ + Group Policy - Changes + + + + + + + + +
+ + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_group.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_group.xml new file mode 100644 index 00000000..5bc01fec --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_group.xml @@ -0,0 +1,629 @@ +
+ + + True + true + + 1000 + 9000 + green + Info: + 1: Select the Domain for the Target Group + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + + + + + + + 1000 + 9000 + green + Info: + 1: Select the Domain for the Target Group. + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + | `ms_obj_ss_filt_pre_lkp("$tok_group_lkp$","$tok_domain$","$tok_group_filter$","cn,sAMAccountName,dn","domain,cn,sAMAccountName,dn,isDeleted,membercount,deletedDate,_key")` +| eval dom_srch_trigger="$tok_tgr_bs_dom_group$",key_val=_key + + + + | fields +| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)` +| eval show_bypass_option=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"true","false") +| eval show_group_list=if(count>=$tok_bypass_min$,"false","true") +| eval inp_bypass_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"2","false") +| eval inp_grp_lst_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"5","4") +| eval msg_state=if(count>=$tok_bypass_min$,"Warning","Info") +| eval msg_color=if(count>=$tok_bypass_min$,"red","green") +| eval msg=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,inp_grp_lst_nmb.": ".count." Total Groups matched the \"Filter Group\" ($tok_group_filter$). Either update the \"Filter Group\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow List Results Possible).",if(count>=$tok_results_max$,inp_grp_lst_nmb.": ".count." Total Groups matched the \"Filter User\" ($tok_group_filter$). Update the \"Filter User\" to reduce the matching count.",inp_grp_lst_nmb.": (".count." Groups) Select an individual group account from the \"Select Group\" input.")) + + + + if($result.show_bypass_option$=="false",NULL,"true") + if($result.show_group_list$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + $result.count$ + 3 + $result.inp_bypass_nmb$ + $result.inp_grp_lst_nmb$ + $result.msg_color$ + $result.msg_state$ + $result.msg$ + \26A0\0020Use to reduce Group list from $result.count$ + + + + $result.count$ + true + \26A0\0020Use to reduce Group list from $result.count$ + + + + + | makeresults | eval tok_tgr_post_check="$tok_tgr_post_check$",dom_srch_trigger="$tok_tgr_bs_dom_group$",count=$tok_filt_group_cnt$ + + + + + + + red + Warning: + 2: No Groups found matching the "Filter Group" ($tok_group_filter$) entry. Update the "Filter Group" to return values. Note: You can use wildcards, (ex. al*), cannot enter ONLY a *. + + + + + + search isDeleted="$tok_deleted$" +| eval trigger_sub_group_list="$tok_tgr_sub_group_list$" +| eval label=if(isnull(cn),sAMAccountName,cn) +| eval srt_field=case(isDeleted="TRUE" AND membercount="0",0,isDeleted="TRUE" AND membercount!="0",1,isDeleted="FALSE" AND membercount="0",2,isDeleted="FALSE" AND membercount!="0",3) +| eval label=if(isDeleted="TRUE","Deleted: ".label." (".membercount.")",label." (".membercount.")") +| eval key_val=_key +| stats count by label,key_val,srt_field +| sort srt_field + + + + | inputlookup $tok_group_lkp$ WHERE domain="$tok_domain$" AND $tok_pre_filt_flds$="$tok_sel_group_filt$" +| makemv delim="|" objectClass +| makemv delim=" " userAccountControl +| makemv delim="####" dSCorePropagationData +| fields * + 0 + now + + true + + + + lookup $tok_group_lkp$ member AS dn OUTPUT dn AS memberOf +| lookup $tok_group_lkp$ primaryGroupToken AS primaryGroupID OUTPUT dn AS p_memberOf +| eval memberOf=mvappend(memberOf,p_memberOf) +| eval dn=lower(dn) +| eval group_name=if(isnull(cn),sAMAccountName,cn) +| fillnull value="" cn,dn,sAMAccountName +| fields * + + $result.dn$ + $result.cn$ + $result.group_name$ + $result.sAMAccountName$ + `ms_obj_changes_base_cat("Group")` $tok_domain$ $tok_filt_raw_txt$ +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| search obj_type="group" change_category="Group Membership" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$")) +| `ms_obj_md_group_change_out("$tok_group_lkp$")` + `ms_obj_changes_base_cat("Group Membership")` $tok_domain$ $tok_filt_raw_txt$ +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| search obj_type="group" change_category="Group Membership" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$")) +| `ms_obj_md_group_m_change_out("$tok_group_lkp$","$tok_user_lkp$","$tok_computer_lkp$")` + + + + + | makeresults +| eval exec_trigger="$tok_tgr_sub_group_list$" +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`" +| eval filt_link="| search Logon_User IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"link\")`])" +| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_group_filt$\",\"$tok_pre_filt_flds$\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_group_filt$\",\"cn,sAMAccountName,dn\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl + + + + + + + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_r_evt$ + $result.filt_raw_text_lbl$ + + + + + fields member +| mvexpand member +| lookup $tok_user_lkp$ dn AS member OUTPUT sAMAccountName AS u_sAMAccountName,dn AS u_dn,cn AS u_cn,domain AS u_domain +| lookup $tok_group_lkp$ dn AS member OUTPUT sAMAccountName AS g_sAMAccountName,dn AS g_dn,cn AS g_cn,domain AS g_domain +| lookup $tok_computer_lkp$ dn AS member OUTPUT sAMAccountName AS c_sAMAccountName,dn AS c_dn,cn AS c_cn,domain AS c_domain +| table member,u_sAMAccountName,g_sAMAccountName,c_sAMAccountName,u_dn,g_dn,c_dn,u_cn,g_cn,c_cn,u_domain,g_domain,c_domain + + + fields u_sAMAccountName,u_dn,u_cn,u_domain +| search u_sAMAccountName=* +| sort u_domain,u_cn, u_sAMAccountName,u_dn +| table u_domain,u_cn, u_sAMAccountName,u_dn + + + True + + + + True + + + + + + fields g_sAMAccountName,g_dn,g_cn,g_domain +| search g_sAMAccountName=* +| sort g_domain,g_cn, g_sAMAccountName,g_dn +| table g_domain,g_cn, g_sAMAccountName,g_dn + + + True + + + + True + + + + + + fields c_sAMAccountName,c_dn,c_cn,c_domain +| search c_sAMAccountName=* +| sort c_domain,c_cn, c_sAMAccountName,c_dn +| table c_domain,c_cn, c_sAMAccountName,c_dn + + + True + + + + True + + + + + + search isDeleted="$tok_deleted$" +| eval sAMAccountName=lower(sAMAccountName) +| eval cn=if(deletedDate=="0",cn." ( ".mvindex(domain,0)." )",orig_cn." (Deleted - ".domain.")") +| eventstats count +| stats max(count) AS count by sAMAccountName,cn +| eval add_filter=if(count>9999,"true",if(count<1000,"false","empty")) +| eval count=tostring(count,"commas") +| table count,sAMAccountName,cn,add_filter +| sort cn + + + \0020\26A0\0020\0020 Filter to below 10,000 ( $result.count$ ) + "( ".toString($result.count$,"commas")." ) filtered groups" + ( $result.count$ + red + red + + + + "( ".toString($result.count$,"commas")." ) filtered groups" + green + green + + + + + | inputlookup $tok_group_lkp$ WHERE member="$tok_group_dn$" +| fields cn,dn,sAMAccountName,MSADGroupClass,MSADGroupType +| eval memberOf_group=if(isnull(cn),sAMAccountName,cn." (".sAMAccountName.")") +| eval memberOf_group_dn=dn,memberOf_group_class=MSADGroupClass,memberOf_group_type=MSADGroupType +| table memberOf_group,memberOf_group_dn,memberOf_group_class,memberOf_group_type + + + True + + + + True + + + + + + + `ms_obj_win_events_security` +[| inputlookup AD_Audit_Change_EventCodes WHERE change_category="Group" OR change_category="Group Membership" + | stats values(EventCode) AS EventCode by obj_type + | format + | table search] src_user_type="user" $tok_domain$ $tok_filt_raw_txt$ +| fields _time,EventCode,comp_obj_dn,comp_obj_sam,group_obj_lkp,msad_action,dir_svcs_action,obj_type,signature,change_signature,src_nt_domain,dest_nt_domain,src_user,user,user_obj_lkp,user_type,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,DN,MSADChangedAttributes,MSADChanges,MSADGroupClass,MSADGroupClassID,MSADGroupType,New_DN,Old_DN,change_category,member_obj_cn,member_obj_dn,member_obj_lkp,member_obj_id,member_obj_sam +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| eval member_obj_lkp=trim(member_obj_lkp) +| eval group_obj_val=if(obj_type="group",if(isnull(member_obj_lkp),if(isnull(group_obj_lkp),NULL,trim(group_obj_lkp)),member_obj_lkp),NULL) +| eval user_obj_lkp=if(obj_type="user",if(isnull(user),if(isnull(user_obj_dn),if(isnull(user_obj_email),if(isnull(DN),if(isnull(Old_DN),if(isnull(New_DN),lower(user),lower(New_DN)),lower(Old_DN)),lower(DN)),lower(user_obj_email)),lower(user_obj_dn)),lower(user)),NULL) +| eval obj_val=mvappend(user_obj_lkp,group_obj_val) +| eval dir_svcs_action=if(isnull(dir_svcs_action),"Unknown",dir_svcs_action) +| table _time,adminuser,src_user,dir_svcs_action,group_obj_lkp,member_obj_lkp,user_obj_lkp,msad_action,obj_type,obj_val,signature,change_signature,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,MSADChangedAttributes,MSADGroupClass,MSADGroupClassID,MSADGroupType,user, user_obj_lkp,comp_obj_dn,comp_obj_sam,dest_nt_domain,src_nt_domain,change_category,Change_Actions,New_DN,Old_DN, +| stats values(*) AS * by _time,src_user,obj_val,msad_action,dir_svcs_action + $Time.earliest$ + $Time.latest$ + + + + search obj_type="group" change_category="Group Membership" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$")) +| `ms_obj_md_group_m_change_out("$tok_group_lkp$","$tok_user_lkp$","$tok_computer_lkp$")` + + + + + $job.dispatchState$ + Trueshow_group_gmchange_msg + blue + + + + + + True + + + + + True + + + + + + + search obj_type="group" change_category="Group" (group_obj_lkp IN("$tok_group_dn$","$tok_group_cn$","$tok_group$")) +| `ms_obj_md_group_change_out("$tok_group_lkp$")` + + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + +
+
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + + False + $value$ + domain="$value$" + domain="$value$" AND + True + green + Info: + 2: Enter a group filter in the "Filter Group" input. Note: This filter will look through the "CN, sAMAccountName, and distinguishedName" to filter "Select Group" dropdown list. You can use wildcards, cannot enter ONLY a "*". + + + + + + + + + $value$ + True + True + + + + + + + + + + + + + + + No + Yes + False + False + + + + No + Yes + no + no + + + + + + + true + true + + + + + + Select... + sel + sel + + + + label + key_val + + + + + true + + + + + + $value$ + _key + search _key="$value$" + + + + + + + + + + + @d + now + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + +

Use the above Filters to create a list of Groups and then Select an individual Group to view Audit Details

+ + + + + + AD LDAP Details for Group ($tok_group_nm$) + +
+ + + + +
+

No User Account Members in the Group ($tok_group_nm$)

+
+ + + $tok_group_nm$ - Group Membership - User Accounts + + rename u_domain AS "Member Domain",u_cn AS Member, u_sAMAccountName AS "Member Account", u_dn AS "Member DN" + + + + + + +
+ +
+

No Embedded Group Members in the Group ($tok_group_nm$)

+
+ + + $tok_group_nm$ - Group Membership - Embedded Groups + + rename g_domain AS "Member Domain",g_cn AS Member, g_sAMAccountName AS "Member Account", g_dn AS "Member DN" + + + + + + +
+ +
+

No Computer Account Members in the Group ($tok_group_nm$)

+
+ + + $tok_group_nm$ - Group Membership - Computers + + rename c_domain AS "Member Domain",c_cn AS Member, c_sAMAccountName AS "Member Account", c_dn AS "Member DN" + + + + + + +
+ +
+

This Group ($tok_group_nm$) is not Embedded in any other Groups

+
+ + + Groups that the Group ($tok_group_nm$) are a memberOf + + + + + + + + +
+ +

Group Membership Changes Search ($tok_group_gmchange_state$)

+ + +

No Group Membership Changes found for Group ($tok_group_nm$) + Review Search

+ + + Group Membership Changes + + table _time,adminuser,group_obj_nm,msad_action,MSADGroupType,MSADGroupClass,Change_Details +| rename group_obj_nm as "Target Group",MSADGroupClass as "GroupClass",msad_action AS "Action",adminuser as "Admin User",MSADGroupType as "GroupType",Change_Details as "Change Details" + + + + + + +
+ +

Group Changes Search ($tok_group_gchange_state$)

+ + +

No Group Changes found for Group ($tok_group_nm$) + Review Search

+ + + Group Changes + + table _time,adminuser,group_obj_nm,msad_action,MSADGroupType,MSADGroupClass,Change_Details +| rename group_obj_nm as "Target Group",MSADGroupClass as "GroupClass",msad_action AS "Action",adminuser as "Admin User",MSADGroupType as "GroupType",Change_Details as "Change Details" + + + + + + +
+ + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_ou.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_ou.xml new file mode 100644 index 00000000..6ce5fd55 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_ou.xml @@ -0,0 +1,123 @@ +
+ + + search domain="$ldaprecord.nt_domain$" distinguishedName="$ldaprecord.ouobject$" +| rename gPLink AS gpoLink +| rename Linked_GPO as gPLink +|fields * + + + | inputlookup AD_Obj_OU +| makemv delim="|" objectClass +| makemv delim="####" dSCorePropagationData +| fields * + 0 + now + +
+ + + + + stats count by domain | sort domain + + domain + domain + true + + + + + + + + + + + | WHERE match(dn,"$value$") + + + + + + + search domain="$ldaprecord.nt_domain$" $tok_ou_filt$ +| eval type=if(match(objectClass,"container"),"(CN)","(OU)") +| eval ou_spec=replace(distinguishedName,"^(OU|CN)\=","") +| eval ou_spec=type." ".replace(ou_spec,",(OU|CN|DC)\=",".") +| table distinguishedName,ou_spec +| sort 0 -ou_spec + + ou_spec + distinguishedName + true + + + + + -15m + now + + +
+ + + +
+ + + + + Group Policy Links + + table name,dn,description,Linked_GPO +| rename Linked_GPO as "Linked GPO", dn as distinguishedName, name as Name + + +
+ + OU Change History + + `ms_obj_changes_base_cat("OU")` dn="$ldaprecord.ouobject$" OR DN="$ldaprecord.ouobject$" +| eval dest_ou_dn=if(isnull(New_DN),DN,New_DN) +| rex field=dest_ou_dn "(?i)ou\=(?<ou_name>[^\,]+)" +| rex field=Value max_match=0 "\{(?<chg_gp_guid>[^\}]+)" +| fillnull value="NA" chg_gp_guid,dir_svcs_action,signature,LDAP_Display_Name,gpo_name,DN,Old_DN,New_DN,Correlation_ID +| mvexpand chg_gp_guid +| eval chg_gplink=if(LDAP_Display_Name=="gPLink","{".chg_gp_guid."}","") +| eval Value=if(isnull(Value),AttributeValue,Value) +| join type=left chg_gplink [| inputlookup AD_Obj_GPO | fields cn,displayName | rex field=cn "^(?<chg_gplink>[^(\s|$)]+)" | dedup chg_gplink | table chg_gplink, displayName | rename displayName AS gpo_name] +| table _time,ou_name,dest_ou_dn,src_nt_domain,src_user,LDAP_Display_Name,dir_svcs_action, chg_gp_guid,gpo_name,EventCode,signature,DN,Old_DN,New_DN,Value,msad_action,Correlation_ID +| eval mod_summary=if(LDAP_Display_Name=="gPLink" AND isnotnull(gpo_name),"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name."| - Target Linked GPO: ".gpo_name."| - Target Linked GPO ID: ".chg_gp_guid,"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name."| - Target Attribute Value: ".Value) +| eval chg_summary=case(EventCode=5137,"OU Created:| - Event Correlation ID: ".Correlation_ID."| - DN: ".DN,EventCode=5138,"OU Undeleted:| - Event Correlation ID: ".Correlation_ID." - ",EventCode=5139,"OU Moved:| - Event Correlation ID: ".Correlation_ID."| - From: ".Old_DN."| - To: ".New_DN,EventCode=5141,"OU Deleted:| - Event Correlation ID: ".Correlation_ID,EventCode=5136 OR EventCode=4662,"OU Modified: | - Event Correlation ID: ".Correlation_ID."|".mod_summary) +| table _time,msad_action,src_user,EventCode,chg_summary +| makemv delim="|" chg_summary +| rename msad_action AS "OU Action",src_user AS "Admin User",chg_summary AS "Change Details" + $Time.earliest$ + $Time.latest$ + + +
+ + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_user.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_user.xml new file mode 100644 index 00000000..dcae44c9 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_audit_user.xml @@ -0,0 +1,648 @@ +
+ + + True + true + + 1000 + 5000 + green + Info: + 1: Select the Domain for the Target User. + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + \0020\0020 Use to filter User List. + FALSE + + + + + + + + 1000 + 5000 + green + Info: + 1: Select the Domain for the Target User. + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + \0020\0020 Use to filter User List. + FALSE + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + | `ms_obj_ss_filt_pre_lkp("$tok_user_lkp$","$tok_domain$","$tok_user_filter$","cn,sAMAccountName,userPrincipalName,dn","domain,cn,sAMAccountName,userPrincipalName,dn,isDeleted,deletedDate,orig_cn,_key")` +| eval dom_srch_trigger="$tok_tgr_bs_dom_user$",key_val=_key +| search isDeleted="$tok_deleted$" + + + + | fields +| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)` +| eval show_bypass_option=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"true","false") +| eval show_user_list=if(count>=$tok_bypass_min$,"false","true") +| eval inp_bypass_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"2","false") +| eval inp_usr_lst_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"5","4") +| eval inp_usr_lst_msg=if(count>=$tok_bypass_min$,"(\0020\26A0\0020\0020 ".toString(count,"commas")." ) filtered users","( ".toString(count,"commas")." ) filtered users") +| eval inp_usr_filt_msg=if(count>=$tok_results_max$,"(\0020\2297\0020\0020 ".toString(count,"commas")." filtered users) - Must Adjust Filter",if(count>=$tok_bypass_min$,"(\0020\26A0\0020\0020 ".toString(count,"commas")." filtered users) - Suggest Adjusting Filter","(\0020\0020 ".toString(count,"commas")." filtered users) - Adjusting Filter Optional")) +| eval msg_state=if(count>=$tok_bypass_min$,"Warning","Info") +| eval msg_color=if(count>=$tok_bypass_min$,"red","green") +| eval msg=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Either update the \"Filter User\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow List Results Possible).",if(count>=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Update the \"Filter User\" to reduce the matching count below the Max ($tok_results_max$ filtered users).",inp_usr_lst_nmb.": (".count." Users) Select an individual user account from the \"Select User\" input.")) + + + if($result.show_bypass_option$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + $result.count$ + 3 + $result.inp_bypass_nmb$ + $result.inp_usr_lst_nmb$ + $result.msg_color$ + $result.msg_state$ + $result.msg$ + $result.inp_usr_filt_msg$ + \0020\26A0\0020\0020 $result.inp_usr_lst_msg$ + $result.inp_usr_lst_msg$ + $result.msg_color$ + + + + $result.count$ + true + \0020\2717\0020\0020 No Matching Users Found - Adjust Filter + red + + + + + | makeresults | eval tok_tgr_post_check="$tok_tgr_post_check$",dom_srch_trigger="$tok_tgr_bs_dom_user$",count=$tok_filt_user_cnt$ + + + + + + + red + Warning: + 2: No Users found matching the "Filter User" ($tok_user_filter$) entry. Update the "Filter User" to return values. Note: You can use wildcards, (ex. al*), cannot enter ONLY a *. + + + + + + eval sAMAccountName=lower(sAMAccountName) +| eval trigger_sub_user_list="$tok_tgr_sub_user_list$" +| eval label=if(deletedDate=="0",if(isnull(cn),sAMAccountName." (".domain." )",cn." (".domain." )"),orig_cn." (Deleted - ".domain.")") +| eval key_val=_key +| stats count by label,key_val +| sort label + + + + | makeresults +| eval exec_trigger="$tok_tgr_sub_user_list$" +| eval filt_link_add="| join type=left Logon_User [|inputlookup $tok_user_lkp$ WHERE [|`ms_obj_ss_filt_pre_base(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\")`] | eval Logon_User=cn.\"|\".sAMAccountName.\"|\".userPrincipalName | makemv delim=\"|\" Logon_User | stats values(uac_details) AS uac_details by Logon_User | eval uac_details=mvjoin(uac_details,\":\")| table Logon_User, uac_details] +| eval uac_details=if(isnull(uac_details),\"Not Available\",uac_details) +| makemv delim=\":\" uac_details" +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`" +| eval filt_link="| search Logon_User IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl + + + + + + + + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_raw_text_lbl$ + + + + + + | inputlookup $tok_user_lkp$ WHERE domain="$tok_domain$" AND $tok_pre_filt_flds$="$tok_sel_user_filt$" +| makemv delim="|" objectClass +| makemv delim=" " userAccountControl +| makemv delim="####" dSCorePropagationData +| fields * + 0 + now + + + lookup $tok_group_lkp$ member AS dn OUTPUT dn AS memberOf +| lookup $tok_group_lkp$ primaryGroupToken AS primaryGroupID OUTPUT dn AS p_memberOf +| eval memberOf=mvappend(memberOf,p_memberOf) +| fillnull value="" cn,dn,userPrincipalName +| fields * + + $result.dn$ + $result.cn$ + $result.sAMAccountName$ + $result.userPrincipalName$ + `ms_obj_failed_success_logons("user")` $tok_domain$ ("$tok_user_dn$" OR "$tok_user_cn$" OR "$tok_user$" OR "$tok_user_email$") +| fields _time, host,src_host,src_nt_host,src_ip,Workstation_Name,Caller_Computer_Name,user_type,src_nt_domain,dest_nt_domain,user, src_user,status +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_host),if(isnull(src_nt_host),if(isnull(Workstation_Name),if(isnull(Caller_Computer_Name),host,Caller_Computer_Name),Workstation_Name),src_nt_host),src_host) +| eval Logon_User=if(isnull(user),src_user,user) +| stats count by _time,status,src_nt_host,Logon_User,src_ip +| search (Logon_User IN("$tok_user_dn$","$tok_user_cn$","$tok_user$","$tok_user_email$")) +| stats max(_time) AS latest, min(_time) AS earliest, count AS sesscount, dc(src_nt_host) AS Source_Host_Count, count(eval(status="success")) AS Success_Count, count(eval(status="failure")) AS Fail_Count by Logon_User +| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") +| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") +| eval Total_Attempts=Fail_Count+Success_Count +| eval Success_Percent=round((Success_Count/sesscount)*100,2) +| sort 0 -Success_Percent, -Total_Attempts +| table Logon_User,Source_Host_Count, Total_Attempts, Fail_Count, Success_Count, Success_Percent, First_Attempt, Last_Attempt + `ms_obj_win_events_security` EventCode=4740 $tok_domain$ ("$tok_user_dn$" OR "$tok_user_cn$" OR "$tok_user$" OR "$tok_user_email$") +| fields _time,host,dest_nt_domain,src_host,src_nt_host,src_ip,Caller_Computer_Name,Workstation_Name,signature,user +| search (user IN("$tok_user_dn$","$tok_user_cn$","$tok_user$","$tok_user_email$")) +| eval src_host=if(isnull(src_host),if(isnull(src_nt_host),if(isnull(Workstation_Name),if(isnull(Caller_Computer_Name),host,Caller_Computer_Name),Workstation_Name),src_nt_host),src_host) +| eval user=if(isnull(dest_nt_domain),user,dest_nt_domain."\\".user) +| table _time,host,src_host,src_nt_host,src_ip,Caller_Computer_Name,Workstation_Name,signature,user + `ms_obj_changes_base_cat("User")` $tok_domain$ $tok_filt_raw_txt$ +| fields _time,user,user_obj_lkp,src_user,src_nt_domain,dest_nt_domain,user_type,msad_action,signature,change_category,Correlation_ID,MSADChangedAttributes,AttributeLDAPDisplayName,AttributeValue,DN,dir_svcs_action,user_obj_dn,Old_DN,New_DN +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| search (user_obj_lkp IN("$tok_user_dn$","$tok_user_cn$","$tok_user$","$tok_user_email$")) +| `ms_obj_md_user_change_out("$tok_user_lkp$")` + `ms_obj_changes_base_cat("Group Membership")` $tok_domain$ $tok_filt_raw_txt$ +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| search (member_obj_lkp IN("$tok_user_dn$","$tok_user_cn$","$tok_user$","$tok_user_email$")) +| `ms_obj_md_group_m_u_change_out("$tok_group_lkp$","$tok_user_lkp$")` + + + + + `ms_obj_win_events_security` +[| inputlookup AD_Audit_Change_EventCodes WHERE change_category="User" OR change_category="Group Membership" + | stats values(EventCode) AS EventCode by obj_type + | format + | table search] src_user_type="user" $tok_domain$ $tok_filt_raw_txt$ +| fields _time,EventCode,comp_obj_dn,comp_obj_sam,group_obj_lkp,msad_action,dir_svcs_action,obj_type,signature,change_signature,src_nt_domain,dest_nt_domain,src_user,user,user_obj_lkp,user_type,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,DN,MSADChangedAttributes,MSADChanges,MSADGroupClass,MSADGroupClassID,MSADGroupType,New_DN,Old_DN,change_category,member_obj_cn,member_obj_dn,member_obj_lkp,member_obj_id,member_obj_sam +| eval change_category=if(obj_type="group",if(isnull(member_obj_lkp),"Group","Group Membership"),if(obj_type=="user",if(match(user,"(\$$)$$"),"Computer","User"),change_category)) +| eval member_obj_lkp=trim(member_obj_lkp) +| eval group_obj_val=if(obj_type="group",if(isnull(member_obj_lkp),if(isnull(group_obj_lkp),NULL,trim(group_obj_lkp)),member_obj_lkp),NULL) +| eval user_obj_lkp=if(obj_type="user",if(isnull(user),if(isnull(user_obj_dn),if(isnull(user_obj_email),if(isnull(DN),if(isnull(Old_DN),if(isnull(New_DN),lower(user),lower(New_DN)),lower(Old_DN)),lower(DN)),lower(user_obj_email)),lower(user_obj_dn)),lower(user)),NULL) +| eval obj_val=mvappend(user_obj_lkp,group_obj_val) +| eval dir_svcs_action=if(isnull(dir_svcs_action),"Unknown",dir_svcs_action) +| table _time,adminuser,src_user,dir_svcs_action,group_obj_lkp,member_obj_lkp,user_obj_lkp,msad_action,obj_type,obj_val,signature,change_signature,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,MSADChangedAttributes,MSADGroupClass,MSADGroupClassID,MSADGroupType,user, user_obj_lkp,comp_obj_dn,comp_obj_sam,dest_nt_domain,src_nt_domain,change_category,Change_Actions,New_DN,Old_DN, +| stats values(*) AS * by _time,src_user,obj_val,msad_action,dir_svcs_action + $Time.earliest$ + $Time.latest$ + + + + search obj_type="group" change_category="Group Membership" (member_obj_lkp IN("$tok_user_dn$","$tok_user_cn$","$tok_user$","$tok_user_email$")) +| `ms_obj_md_group_m_u_change_out("$tok_group_lkp$","$tok_user_lkp$")` + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + + + + search obj_type="user" change_category="User" (user_obj_lkp IN("$tok_user_dn$","$tok_user_cn$","$tok_user$","$tok_user_email$")) +| `ms_obj_md_user_change_out("$tok_user_lkp$")` + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + +
+
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + * + + + True + True + + + False + $value$ + domain="$value$" + domain="$value$" AND + True + green + Info: + 2: Enter a user filter in the "Filter User" input. Note: This filter will look through the "CN, sAMAccountName, and userPrincipalName" for matches for the "Select User" dropdown. You can use wildcards, cannot enter ONLY a *. + + + + + + no + no + sel + sel + + + + + + + + + $value$ + True + True + + + + + + + + + sel + sel + + + + + + No + Yes + False + False + + + + No + Yes + no + no + + + + + + + true + true + + + + + + Select... + sel + sel + + + + label + key_val + + + + + + true + + + + + + true + True + $value$ + _key + search _key="$value$" + + + + true + + + + + + + + @d + now + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + +

Filter and then Select User to view Audit Details

+ + + + + + AD LDAP Details for user ($tok_user_cn$) + +
+ + + + + Group Membership - User + + table memberOf,groupName,primaryGroupID +| stats count by memberOf,primaryGroupID +| lookup $tok_group_lkp$ dn AS memberOf OUTPUT cn AS groupName +| rename memberOf AS groupDN +| table groupDN, groupName, primaryGroupID +| sort primaryGroupID + + + + + + + + + + + +
+ +

User Login Activity Search ($tok_user_lockout_state$)

+ + +

No Lockout Activity for User ($tok_user_cn$) + Review Search

+ + + Account Lockout Activity - User + + `ms_obj_win_events_security` EventCode=4740 $tok_domain$ ("$tok_user_dn$" OR "$tok_user_cn$" OR "$tok_user$" OR "$tok_user_email$") +| fields _time,host,dest_nt_domain,src_host,src_nt_host,src_ip,Caller_Computer_Name,Workstation_Name,signature,user +| search (user IN("$tok_user_dn$","$tok_user_cn$","$tok_user$","$tok_user_email$")) +| eval src_host=if(isnull(src_host),if(isnull(src_nt_host),if(isnull(Workstation_Name),if(isnull(Caller_Computer_Name),host,Caller_Computer_Name),Workstation_Name),src_nt_host),src_host) +| eval user=if(isnull(dest_nt_domain),user,dest_nt_domain."\\".user) +| table _time, user, src_host, signature +| rename src_host as Workstation,signature as "Reason" + $Time.earliest$ + $Time.latest$ + + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + + + + + + + user="$tok_user$" + + + + +
+ +

User Login Activity Search ($tok_user_login_state$)

+ + +

No Login Activity for User ($tok_user_cn$) + Review Search

+ + + Logon Activity - User (Click to Drilldown) + + `ms_obj_failed_success_logons("user")` $tok_domain$ $tok_filt_raw_txt$ +| fields _time, host,src_host,src_nt_host,src_ip,Workstation_Name,Caller_Computer_Name,user_type,src_nt_domain,dest_nt_domain,user, src_user,status +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_host),if(isnull(src_nt_host),if(isnull(Workstation_Name),if(isnull(Caller_Computer_Name),host,Caller_Computer_Name),Workstation_Name),src_nt_host),src_host) +| eval Logon_User=if(isnull(user),src_user,user) +| stats count by _time,status,src_nt_host,Logon_User,src_ip +$tok_filt_link$ +| stats max(_time) AS latest, min(_time) AS earliest, count AS sesscount, dc(src_nt_host) AS Source_Host_Count, count(eval(status="success")) AS Success_Count, count(eval(status="failure")) AS Fail_Count by Logon_User +| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") +| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") +| eval Total_Attempts=Fail_Count+Success_Count +| eval Success_Percent=round((Success_Count/sesscount)*100,2) +| sort 0 -Success_Percent, -Total_Attempts +| eval dd_filt="Domain_Account|$tok_sel_domain$|".Logon_User."|$tok_user_lkp$" +| table Source_Host_Count, Total_Attempts, Fail_Count, Success_Count, Success_Percent, First_Attempt, Last_Attempt,dd_filt + $Time.earliest$ + $Time.latest$ + + + + + $job.dispatchState$ + True + blue + + + + + + True + + + + + True + + + + + + + + + Source_Host_Count, Total_Attempts, Fail_Count, Success_Count, Success_Percent, First_Attempt, Last_Attempt + + + + + +
+ +

User Account Changes Search ($tok_user_uchange_state$)

+ + +

No Account Change Activity for User ($tok_user_cn$) + Review Search

+ + + User Account Changes + + table _time,adminuser,user,dest_user_subject,msad_action,Change_Details +| rename msad_action as "Action",user as "Target User",dest_user_subject as "Target User ID",adminuser as "Admin User",Change_Details as "Change Details" + + + + + + +
+ +

User Membershipt Changes Search ($tok_user_gchange_state$)

+ + +

No Membership Change Activity for User ($tok_user_cn$) + Review Search

+ + + User Group Membership Changes + + table _time,adminuser,group_obj_nm,msad_action,MSADGroupType,MSADGroupClass,Change_Details +| rename group_obj_nm as "Target Group",MSADGroupClass as "GroupClass",msad_action AS "Action",adminuser as "Admin User",MSADGroupType as "GroupType",Change_Details as "Change Details" + + + + + + +
+ + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_chg_gpo.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_chg_gpo.xml new file mode 100644 index 00000000..df9cdd00 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_chg_gpo.xml @@ -0,0 +1,104 @@ +
+ + + `ms_obj_changes_base_cat("Group Policy")` (src_nt_domain="$tok_domain$" OR dest_nt_domain="$tok_domain$") +| fields _time, session_id, src_nt_domain, src_user,Object_Name_Guid,displayName,dir_svcs_action,AttributeLDAPDisplayName,AttributeValue,MSADChangedAttributes,Correlation_ID,signature,msad_action,Old_DN,New_DN +| fillnull value="NA" Correlation_ID,msad_action +| eval adminuser=if(isnull(src_nt_domain),src_user,src_nt_domain."\\".src_user) +| eval Object_Lookup_Name="{".lower(Object_Name_Guid)."}" +| `ms_obj_msad-changed-attributes` +| stats max(_time) AS last_time, min(_time) AS start_time,list(MSADChanges) AS MSADChanges,values(Correlation_ID) AS Correlation_IDs by session_id,Object_Lookup_Name,adminuser,signature,msad_action,src_user +| eval signature=mvdedup(signature) +| join type=left Object_Lookup_Name [| inputlookup AD_Obj_GPO | fields cn, displayName | eval Object_Lookup_Name=trim(lower(cn)) | table Object_Lookup_Name, displayName] +| eval displayName=if(isnull(displayName),"NotFound: ".Object_Lookup_Name,displayName) +| eval MSADChanges=mvjoin(MSADChanges, "########") +| eval MSADChanges=case(isnull(signature) AND isnull(MSADChanges),"Unknown Changes",isnull(signature),MSADChanges,isnotnull(MSADChanges),"Signature: ".signature."########".MSADChanges) +| eval Session_Time="Session ID (".session_id.")|Start: ".strftime(start_time,"%m/%d/%y %I:%M:%S %P")."|End: ".strftime(last_time,"%m/%d/%y %I:%M:%S %P") +| makemv delim="########" MSADChanges +| makemv delim="|" Session_Time +| table displayName,src_user,adminuser,Session_Time,msad_action,Correlation_IDs,MSADChanges + $Time.earliest$ + $Time.latest$ + +
+ + + + | inputlookup AD_Obj_Domain | stats count by domain |sort domain | table domain + + domain + domain + true + + + + + stats count by src_user,adminuser | sort adminuser | table src_user,adminuser + + adminuser + src_user + true + All + all + all + + + + + + src_user="$value$" + + + + + + + search $tok_src_user_search$ | stats count by displayName | sort displayName | table displayName + + displayName + displayName + true + All + all + all + + + + + + displayName="$value$" + + + + + + + -60m@m + now + + +
+ + + + Group Policy Edits + + search $tok_src_user_search$ $tok_src_gpo_search$ +| rename adminuser as "Administrator",msad_action as "Action",displayName as "GPO Name",MSADChanges as "Changes" + + + + + + + + + + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_computer_chg.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_computer_chg.xml new file mode 100644 index 00000000..54faa81d --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_computer_chg.xml @@ -0,0 +1,417 @@ +
+ + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + `ms_obj_changes_base_cat("Computer")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) +| `ms_obj_md_computer_change_cmb("$tok_computer_lkp$")` +| eval domain="$tok_domain$" +| lookup $tok_computer_lkp$ lookup_cmp AS comp_obj_lkp,domain AS domain OUTPUT cn,sAMAccountName,orig_cn,dn,lookup_cmp +| eval computer_obj_lkp=if(isnull(orig_cn) OR orig_cn="",if(isnull(sAMAccountName) OR sAMAccountName="",if(isnull(cn) OR cn="",lower(comp_obj_lkp),lower(cn)),lower(sAMAccountName)),lower(orig_cn)) +| table time_group,adminuser,computer_obj_lkp,msad_action,Correlation_IDs,Change_Actions,Change_Summary,Change_Details,lookup_cmp + $Time.earliest$ + $Time.latest$ + + + + + True + + + + + + + True + red + Warning: + 2. No Change Events for Selected Time Range. Adjust Time Range to view change results. + + True + + + + True + True + True + green + Info: + 3+4: Select a Group or Filter the Group List + + True + + + + + + | makeresults +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn\",\"raw_txt\")`" +| eval filt_link="| search computer_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn\",\"link\")`])" +| eval filt_link_r_evt="| search computer_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn\",\"link\")`])" +| eval filt_link_admon="| search computer_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_link_admon + + + + + + + + `ms_obj_changes_base_cat_act("Computer","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_compute_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","raw_txt")`]) +| search comp_obj_sam IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_group("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","raw_txt")`]) +| eval computer_obj_lkp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +| search computer_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","link")`]) + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_link_admon$ + $result.filt_raw_text_lbl$ + `ms_obj_changes_base_cat_act("Computer","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_compute_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","raw_txt")`]) +| search comp_obj_sam IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_group("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","raw_txt")`]) +| eval computer_obj_lkp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +| search computer_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,dn","link")`]) + + + + + + search msad_action=$tok_msad_action$ +$tok_filt_link$ + + + + + True + + + True + True + + + + + + + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_computer("$tok_dc_val$"),ms_obj_admon_base_a_type)` $tok_filt_raw_txt$ +| fields admonEventType,_time,_raw + + + + + True + + + + + + + + True + + + + True + True + + True + + + $Time.earliest$ + $Time.latest$ + + + + fields admonEventType +| stats count by admonEventType +| table admonEventType + + + + search admonEventType=$tok_admon_action$ +$tok_filt_link_admon$ + +
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + True + green + Info: + 1: Select the Target Domain to run the report against. + + + True + False + $value$ + True + green + Info: + 2: Select Time Range for Change Activity. + + + + + + + @d + now + + + + strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p") + strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p") + + + + + + * + * + + + | search lookup_cmp="$value$" + + + + + + + + + All + all + all + + stats values(lookup_cmp) AS lookup_cmp by computer_obj_lkp $tok_obj_list_filter$ + | sort computer_obj_lkp + + computer_obj_lkp + computer_obj_lkp + + + + + + + + + $value$ + + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + Windows-Security-Relevant Changes - (From: $set_time_from$ To: $set_time_to$) + + + All + all + all + + |stats count by msad_action +| eval label=case(msad_action="enabled","Enabled",msad_action="created","Created",msad_action="disabled","Disabled",msad_action="modified" OR msad_action="changed","Modified",msad_action="deleted","Deleted",msad_action="moved","Moved") +| eval label=if(isnull(label),msad_action,label) +| table msad_action,label +| sort msad_action + + label + msad_action + + + * + + + $value$ + + + + + + WinEvent Summary + WinEvent Details + Change_Summary + Change_Summary + + + + True + Change_Summary + + + + True + Change_Details + + + + +
+

+ Searching for Windows Change Events

+
+ + + + table time_group,adminuser,computer_obj_lkp,Change_Actions,$tok_tbl_res_flds$ +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",computer_obj_lkp AS "Target_Computer",Change_Details as "Change Details",Change_Summary as "Change Summary" + + + + + + + + + + + +
+ +
+ + View Raw Events -

Click to open a new window with raw events for All Windows Change activities

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Windows Change Events found within Time Period (From: $set_time_from$ To: $set_time_to$) +
+

+ + Search Raw Events +

Click to search for All Windows Change activities

+
+ + + + Directory Record Changes - (From: $set_time_from$ To: $set_time_to$) + + + All + all + all + + eval trigger="$show_admon_results$" + + label + admonEventType + + + * + + + $value$ + + + + +
+

+ Searching for Directory Change Events

+
+ + + + + + + + + + + + + +
+ + View Raw Events -

Click to open a new window with raw admon events for All Admon Change activities

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Admon Change Events found within Time Period (From: $set_time_from$ To: $set_time_to$) +
+

+ + Search Admon Events +

Click to search for All Admon Change activities:

+ +
    +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_computer_reports.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_computer_reports.xml new file mode 100644 index 00000000..81130d5c --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_computer_reports.xml @@ -0,0 +1,714 @@ +
+ + + `ms_obj_changes_base_cat("Computer")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) +| `ms_obj_md_computer_change_cmb("$tok_computer_lkp$")` +| table time_group,adminuser,comp_obj_lkp,msad_action,Correlation_IDs,Change_Actions,Change_Summary,Change_Details,lookup_cmp + $field3.earliest$ + $field3.latest$ + + + stats values(comp_obj_lkp) AS computers by msad_action +| eval chg_trigger="$tok_chg_trigger$" +| eval label=case(msad_action="enabled","Enabled",msad_action="created","Created",msad_action="disabled","Disabled",msad_action="modified","Modified",msad_action="deleted","Deleted",msad_action="moved","Moved",msad_action="added","Added",msad_action="removed","Removed") +| eval label=if(isnull(label),msad_action,label) +| eval obj_lnk_filt="| search sAMAccountName IN(\"".mvjoin(computers,"\",\"")."\")" +| table msad_action,obj_lnk_filt,label +| sort msad_action + + + + True + red + Warning: + 3. No Drilldown Change Events Available for Selected Time Range. Adjust Time Range to view change results. + + + True + True + green + Info: + 4. Select MSAD Action. + + + + + + $tok_report$($tok_computer_lkp$,$tok_domain$,"$set_time_from$","$set_time_to$")` +| eval whenChanged=strftime(strptime(whenChanged,"%I:%M.%S %P, %a %m/%d/%Y"),"%m/%d/%Y %a, %I:%M %P") +| eval whenCreated=strftime(strptime(whenCreated,"%I:%M.%S %P, %a %m/%d/%Y"),"%m/%d/%Y %a, %I:%M %P") +| sort -$tok_time_srt$ +| eval time_trigger="$tok_time_trigger$" + $field3.earliest$ + $field3.latest$ + + + + True + red + Warning: + 3. No $tok_time_label$ Events for Selected Time Range. Adjust Time Range to view $tok_time_label$ results. + + + True + green + Info: + 3. Adjust Time Range for $tok_time_label$. + True + + + + + + $tok_active_rep$ + $field3.earliest$ + $field3.latest$ + + + True + red + Warning: + 3. No $tok_time_label$ Events for Selected Time Range. Adjust Time Range to view $tok_time_label$ results. + + + True + green + Info: + 3. Adjust Time Range for $tok_time_label$. + + + + + + | makeresults +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"raw_txt\")`" +| eval filt_link="| search comp_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"link\")`])" +| eval filt_link_r_evt="| search comp_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"link\")`])" +| eval filt_link_admon="| search token IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_cmp\",\"$tok_computer_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_link_admon + + + + + + + `ms_obj_changes_base_cat("Computer")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID,orig_cn,sAMAccountName","raw_txt")`]) +| eval comp_obj_lkp=if(isnull(ComputerName),if(isnull(comp_obj_dn),if(isnull(comp_obj_sam),if(isnull(comp_obj_id),if(isnull(comp_obj_lkp),if(isnull(DN),if(isnull(Old_DN),if(isnull(New_DN),lower(user),lower(New_DN)),lower(Old_DN)),lower(DN)),lower(comp_obj_lkp)),lower(comp_obj_id)),lower(comp_obj_sam)),lower(comp_obj_dn)),lower(ComputerName)) +| search comp_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,objGUID,orig_cn,sAMAccountName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_computer("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID","raw_txt")`]) +| eval token=if(isnull(cn),if(isnull(dn),"$tok_sel_obj$",lower(dn)),lower(cn)) +| search token IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,orig_cn,dn,objGUID","link")`]) + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_r_evt$ + $result.filt_link_admon$ + $result.filt_raw_text_lbl$ + `ms_obj_changes_base_cat("Computer")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID,orig_cn,sAMAccountName","raw_txt")`]) +| eval comp_obj_lkp=if(isnull(ComputerName),if(isnull(comp_obj_dn),if(isnull(comp_obj_sam),if(isnull(comp_obj_id),if(isnull(comp_obj_lkp),if(isnull(DN),if(isnull(Old_DN),if(isnull(New_DN),lower(user),lower(New_DN)),lower(Old_DN)),lower(DN)),lower(comp_obj_lkp)),lower(comp_obj_id)),lower(comp_obj_sam)),lower(comp_obj_dn)),lower(ComputerName)) +| search comp_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,objGUID,orig_cn,sAMAccountName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_computer("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID","raw_txt")`]) +| eval token=if(isnull(cn),if(isnull(dn),"$tok_sel_obj$",lower(dn)),lower(cn)) +| search token IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_cmp","$tok_computer_lkp$","$tok_domain$","$tok_sel_obj$","cn,orig_cn,dn,objGUID","link")`]) + + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + search msad_action=$tok_action$ +$tok_filt_link$ + + + + + True + + + True + True + True + + + + + + + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_computer("$tok_dc_val$"),ms_obj_admon_base_a_type)` $tok_filt_raw_txt$ +| eval token=if(isnull(cn),if(isnull(dn),"$tok_sel_obj$",lower(dn)),lower(cn)) +$tok_filt_link_admon$ + + + + + True + + + True + True + + + + $field3.earliest$ + $field3.latest$ + +
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + True + green + Info: + 1: Select the Target Domain to run the report against. + + + True + False + $value$ + True + green + Info: + 2: Select the Target Report from the "Select Report" dropdown. + + + + + + Select Report... + All Computers + New Computers + Unused + Disabled + Domain Controllers + Deleted + Changed + Trusted Computers + Active + Inactive + Managed + Not Managed + sel + sel + + + + + + + + + + + + + + + + $label$ + True + |`ms_obj_md_secrpt-all-computers("$tok_computer_lkp$","$tok_domain$")` + + + + + + + + + + + + + $label$ + new_computers + New Computers + whenCreated_epoch + |`ms_obj_md_secrpt-new-computers + True + + created + Created + 4 + cn,sAMAccountName,dNSHostName,whenCreated,uac_details,operatingSystem,operatingSystemServicePack,dn + 4. Select Event Result Type + green + Info: + + + + + + + + + + + $label$ + True + |`ms_obj_md_secrpt-unused-computers($tok_computer_lkp$,$tok_domain$)` + + + + + + + + + + + + + + $label$ + True + |`ms_obj_md_secrpt-disabled-computers($tok_computer_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + $label$ + deleted_computers + Deleted Computers + whenDeleted_epoch + |`ms_obj_md_secrpt-deleted-computers + True + + deleted + Deleted + 4 + orig_cn,cn,sAMAccountName,dNSHostName,whenDeleted,uac_details, userAccountControl,operatingSystem,operatingSystemServicePack + 4. Select Event Result Type + green + Info: + + + + + + + + + + + + + $label$ + changed_computers + whenChanged_epoch + Changed Computers + |`ms_obj_md_secrpt-changed-computers + + True + changed_computers + * + All Changes + 5 + cn, sAMAccountName, dNSHostName,uac_details,operatingSystem,operatingSystemServicePack,whenCreated,whenChanged,whenDeleted,dn + 5. Select Event Result Type + green + Info: + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-all-domain-controllers($tok_computer_lkp$,$tok_domain$)` + + + + + + + + + + + + + $label$ + Active Computers + True + True + cn,dNSHostName,uac_details,operatingSystem,operatingSystemServicePack,lastLogonTime + `ms_obj_md_secrpt-active-computers($tok_computer_lkp$,$tok_domain$)` + True + green + Info: + 3. Adjust Time to search for Activity + + + + + + + + + + + Inactive Computers + $label$ + True + True + cn,dNSHostName,uac_details,operatingSystem,operatingSystemServicePack + | `ms_obj_md_secrpt-inactive-computers($tok_computer_lkp$,$tok_domain$)` + True + green + Info: + 3. Adjust Time to search for InActivity + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-trusted-computers($tok_computer_lkp$,$tok_domain$)` + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-managed-computers($tok_computer_lkp$,$tok_domain$)` + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-unmanaged-computers($tok_computer_lkp$,$tok_domain$)` + + + + + + + + + + + + + + -4h@m + now + + + + + strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p") + strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p") + + + + + All + + + + all + all + label + obj_lnk_filt + + + + + + * + All Changes + + + + + + + $value$ + lower($label$) + $label$ + + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + WinEvent Summary + WinEvent Details + Admon Events + Change_Summary + Change_Summary + + + + True + Change_Summary + + + + True + Change_Details + + + + True + + + + +

+ + + $tok_res_message_state$ $tok_res_message$ + +

+ + + + + + + $tok_report_label$ - Computers + + $tok_report$ +| eval whenChanged=strftime(strptime(whenChanged,"%I:%M.%S %P, %a %m/%d/%Y"),"%m/%d/%Y %a, %I:%M %P") +| eval whenCreated=strftime(strptime(whenCreated,"%I:%M.%S %P, %a %m/%d/%Y"),"%m/%d/%Y %a, %I:%M %P") +| rename operatingSystem as "Operating System",operatingSystemServicePack as "Service Pack" + $field3.earliest$ + $field3.latest$ + + + + + + +
+ + $tok_report_label$ - Computers - (From: $set_time_from$ To: $set_time_to$) + + $tok_chg_cmp_filt$| table $fields_time_rep$ +| rename operatingSystem as "Operating System",operatingSystemServicePack as "Service Pack" + + + + + + + + + + + True + True + $row.sAMAccountName$ + Change_Summary + Change_Summary + Change_Summary + True + +
+ +

+ + + Click on a Computer in the above table to view $tok_action_lbl$ Event Details. + +

+ + + $tok_report_label$ - Computers - (From: $set_time_from$ To: $set_time_to$) + + table $fields_time_rep$ +| rename operatingSystem as "Operating System",operatingSystemServicePack as "Service Pack" + + + + + + +
+ + + + "$tok_sel_obj$" - $tok_action_lbl$ Change Events - (From: $set_time_from$ To: $set_time_to$) + + table time_group,adminuser,comp_obj_lkp,Change_Actions,$tok_tbl_res_flds$ +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",comp_obj_lkp as "Computer_Name",Change_Details as "Change Details",Change_Summary as "Change Summary" + + + + + + + + + + + +
+ +
+ + View Raw Events -

Click to open a new window with raw events for All Windows Change activities with Computer ($tok_sel_obj$) within Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No $tok_action_lbl$ events found for Computer ($tok_sel_obj$) +
+

+ + Search Raw Events +

Click to search for All Windows Change activities with Computers:

+ +
    +
  • + Computers: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + + "$tok_sel_obj$" - admon Events - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + +
+ + View Raw Events -

Click to open a new window with raw admon events for All Admon Change activities with Computer ($tok_sel_obj$) within Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Admon events found for Computer ($tok_sel_obj$) +
+

+ + Search Admon Events +

Click to search for All Admon Change activities with Group:

+ +
    +
  • + Computers: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_gpo_reports.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_gpo_reports.xml new file mode 100644 index 00000000..0df8c532 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_gpo_reports.xml @@ -0,0 +1,575 @@ +
+ + chg_summary + + `ms_obj_changes_base_cat("Group Policy")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) +| fields _time, _raw,sourcetype,session_id, src_nt_domain, src_user,Object_Name_Guid,displayName,msad_action,change_action,dir_svcs_action,AttributeLDAPDisplayName,AttributeSyntaxOID,AttributeValue,MSADChangedAttributes,Correlation_ID,signature,Old_DN,New_DN +| eval time_group=strftime(_time,"%m/%d/%y %I:%M %P") +| eval time_group_epoch=strptime(time_group,"%m/%d/%y %I:%M %P") +| eval change_action=if(isnull(change_action),"modified",change_action) +| fillnull value="NA" Correlation_ID,msad_action +| eval adminuser=if(isnull(src_nt_domain),src_user,src_nt_domain."\\".src_user) +| eval Object_Lookup_Name="{".lower(Object_Name_Guid)."}" +| rex "(?msi)(?:([\r\n]+))(?<msad_attribute>Attribute\:.*)(?:([\r\n]+)Operation\:)" +| rex "(?msi)(?<msad_operation>Operation\:.*)(?:(([\r\n]+)\S+|$))" +| eval MSADStdChanges=if(isnull(msad_attribute),if(isnull(msad_operation),NULL,"| - ".mvjoin(replace(msad_operation,"(?msi)([\r\n]+)","| "),"|")),if(isnull(msad_operation),"| - ".mvjoin(replace(msad_attribute,"(?msi)([\r\n]+)","| "),"|"),"| - ".mvjoin(replace(msad_attribute,"(?msi)([\r\n]+)","| "),"| ")."| - ".mvjoin(replace(msad_operation,"(?msi)([\r\n]+)","| "),"|"))) +| eval MSADXMLChanges=if(sourcetype=="XmlWinEventLog","Attribute:| - AttributeLDAPDisplayName: ".AttributeLDAPDisplayName."| - AttributeSyntaxOID: ".AttributeSyntaxOID."| - AttributeValue: ".AttributeValue,NULL) +| eval change_action=if(isnull(msad_action),change_action,msad_action) +| eval chg_summary=case(change_action="created","|GPO Created:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature,change_action="undeleted","|GPO Undeleted:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature,change_action="deleted","|GPO Deleted:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature,change_action="modified","|GPO Modified:| - Object_Lookup_Name: ".Object_Lookup_Name."| - Action: ".change_action."| - signature: ".signature) +| eval chg_details=if(isnull(MSADStdChanges),if(isnull(MSADXMLChanges),chg_summary,chg_summary."| - Time: ".strftime(_time,"%m/%d/%y %I:%M:%S %P")."".MSADXMLChanges),chg_summary."| - Time: ".strftime(_time,"%m/%d/%y %I:%M:%S %P")."".MSADStdChanges) +| lookup AD_Obj_GPO cn AS Object_Lookup_Name OUTPUT displayName,distinguishedName,cn +| eval displayName=if(isnull(displayName),Object_Lookup_Name,displayName) +| stats values(displayName) AS GPO,values(chg_details) AS chg_details,values(chg_summary) AS chg_summary by time_group,cn,msad_action +| makemv delim="|" chg_summary +| makemv delim="|" chg_details +| eval chg_details=mvfilter(NOT match(chg_details,"(\-\s+$|^\s+$)")) + $field3.earliest$ + $field3.latest$ + + + search msad_action="$tok_action$" +| eval chg_trigger="$tok_sel_obj$" + + + + True + red + Warning: + 3. No Change Events for Selected Time Range. Adjust Time Range to view change results. + True + + + + + True + green + Info: + 3. Adjust Time Range and 4. Select MSAD Action. + True + + + + + | `ms_obj_secrpt-$tok_time_report_val$-lkp-gpo("$tok_domain$","$set_time_from$","$set_time_to$")` + + + + + True + | `ms_obj_secrpt-$tok_time_report_val$-lkp-gpo("$tok_domain$","$set_time_from$","$set_time_to$")` + + + + True + green + Info: + 3. Adjust Time Range for $tok_time_label$. + True + + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + + search domain="$tok_domain$" +| eval dc_val=if(isnull(dc_val),"$tok_domain$",dc_val) + + + * + + + $result.dc_val$ + + + + + + | makeresults +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"cn\",\"AD_Obj_GPO\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"cn\",\"AD_Obj_GPO\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"raw_txt\")`" +| eval filt_link="| search gpo_name IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"cn\",\"AD_Obj_GPO\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"link\")`])" +| eval filt_link_r_evt="| search gpo_name IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"cn\",\"AD_Obj_GPO\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"link\")`])" +| eval filt_link_admon="| search gpo_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"cn\",\"AD_Obj_GPO\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_link_admon + + + + + + + + `ms_obj_changes_base_cat_act("Group Policy","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| eval Object_Lookup_Name="{".lower(Object_Name_Guid)."}" +| search Object_Lookup_Name IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_gpo("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName,objectGUID","raw_txt")`]) +| search cn IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_link_admon$ + $result.filt_raw_text_lbl$ + `ms_obj_changes_base_cat_act("Group Policy","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| eval Object_Lookup_Name="{".lower(Object_Name_Guid)."}" +| search Object_Lookup_Name IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_gpo("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName,objectGUID","raw_txt")`]) +| search cn IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + + + + + + search cn IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + + True + True + green + Info: + 4. Select Event Result Type + True + + + + + + True + + + True + True + + + + + + + `ms_obj_admon_flt_obj_type(ms_obj_admon_gpo,ms_obj_admon_base_a_type)` $tok_domain$ ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| search cn IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","cn","AD_Obj_GPO","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName,objectGUID","link")`]) + + + + + True + + + True + True + + + + $field3.earliest$ + $field3.latest$ + + + + $tok_report$ + $field3.earliest$ + $field3.latest$ + + + + + + + + True + + + + + + + + True + + + +
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + True + green + Info: + 1: Select the Target Domain to run the report against. + + + True + False + $value$ + True + green + Info: + 2: Select the Target Report from the "Select Report" dropdown. + + + + + + Select Report... + All + Created + Deleted + Changed + Disabled + OU Linked + Not OU Linked + sel + sel + + + + + + + + + + + + + + + + + + + + $label$ + |`ms_obj_secrpt-all-group-policies($tok_domain$)` + + + + + + + + + + + + $label$ + True + New OUs + new + True + created + created + Created + 4 + Created + + + + + + + + + + + $label$ + True + Deleted OUs + deleted + True + deleted + Deleted + 4 + Deleted + + + + + + + + + + $label$ + True + Changed OUs + changed + True + modified + Changed + 4 + Changed + + + + + + + + $label$ + | `ms_obj_secrpt-disabled-group-policies($tok_domain$)` + + + + + + + + + + + + $label$ + True + | `ms_obj_secrpt-gpo-linked($tok_domain$)` + + + + + + + + + + + + $label$ + | `ms_obj_secrpt-gpo-not-linked($tok_domain$)` + + + + + + + + + + + + + -4h@m + now + + + + + strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p") + strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p") + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + +

+ + Warning: No $tok_report_label$ GPO Results found for selected Time Range. Adjust Time Range or Click to review the search. + +

+ + +

+ + Warning: $tok_report_label$ GPO Report did not return any data. Click to review the search. + +

+ + + + + + WinEvent Summary + WinEvent Details + Admon Events + Change_Summary + Change_Summary + + + + True + chg_summary + + + + True + chg_details + + + + True + + + + +

+ + + $tok_res_message_state$ $tok_res_message$ + +

+ + + + + + + $tok_report_label$ - GPOs + + + + + + + + +
+ + $tok_report_label$ - GPOs - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + + + + True + True + $row.cn$ + $row.GPO$ + +
+ +

+ + + Click on a GPO in the above table to view $tok_action_lbl$ Event Details. + +

+ + + + + "$tok_sel_obj_label$" - $tok_fld_act$ Events - (From: $set_time_from$ To: $set_time_to$) + + table time_group,adminuser,msad_action,$tok_tbl_res_flds$ +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",msad_action AS Change_Actions,GPO as "Target_GPO",chg_summary as "Change Summary",chg_details as "Change Details" + + + + + + + + + + + +
+ +
+ + View Raw Events -

Click to open a new window with raw events for All Windows Eventlog Change activities with GPO ($tok_sel_obj_label$)

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No $tok_fld_act$ events found for GPO ($tok_sel_obj_label$) +
+

+ + Search Raw Events +

Click to search for All Windows Change activities with GPO:

+ +
    +
  • + GPO: $tok_sel_obj_label$ ($tok_sel_obj$)
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + + "$tok_sel_obj_label$" - admon Events - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + +
+ + View Raw Events -

Click to open a new window with raw admon events for All Admon Change activities with GPO ($tok_sel_obj_label$)

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Admon events found for GPO ($tok_sel_obj_label$) +
+

+ + Search Admon Events +

Click to search for All Admon Change activities with GPO:

+ +
    +
  • + GPO: $tok_sel_obj_label$ ($tok_sel_obj$)
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_group_reports.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_group_reports.xml new file mode 100644 index 00000000..37a9f4a8 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_group_reports.xml @@ -0,0 +1,628 @@ +
+ + + `ms_obj_changes_base_cat("Group*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) +| `ms_obj_md_group_change_cmb("$tok_group_lkp$")` +| lookup $tok_group_lkp$ lookup_grp AS group OUTPUT cn,sAMAccountName,orig_cn,dn +| eval lookup_grp=if(isnull(sAMAccountName),lower(group),mvappend(lower(dn),lower(cn),lower(sAMAccountName),lower(orig_cn))) +| table time_group,adminuser,group,msad_action,Correlation_IDs,Change_Actions,Change_Summary,Change_Details,lookup_grp + $field3.earliest$ + $field3.latest$ + + + stats values(lookup_grp) AS groups by msad_action +| eval chg_trigger="$tok_chg_trigger$" +| eval label=case(msad_action="enabled","Enabled",msad_action="created","Created",msad_action="disabled","Disabled",msad_action="modified","Modified",msad_action="deleted","Deleted",msad_action="moved","Moved",msad_action="added","Added",msad_action="removed","Removed") +| eval label=if(isnull(label),msad_action,label) +| eval obj_lnk_filt="| search sAMAccountName IN(\"".mvjoin(groups,"\",\"")."\")" +| table msad_action,obj_lnk_filt,label +| sort msad_action + + + + True + red + Warning: + 3. No Drilldown Change Events Available for Selected Time Range. Adjust Time Range to view change results. + + + True + True + green + Info: + 4. Select MSAD Action. + + + + + + $tok_report$($tok_group_lkp$,$tok_domain$,"$set_time_from$","$set_time_to$")` +| eval whenChanged_epoch=strptime(whenChanged,"%m/%d/%y %a %I:%M %P") +| eval whenCreated_epoch=strptime(whenCreated,"%m/%d/%y %a %I:%M %P") +| eval whenDeleted_epoc=strptime(whenDeleted,"%m/%d/%y %a %I:%M %P") +| sort -$tok_time_srt$ +| eval time_trigger="$tok_time_trigger$" + $field3.earliest$ + $field3.latest$ + + + + True + red + Warning: + 3. No $tok_time_label$ Events for Selected Time Range. Adjust Time Range to view $tok_time_label$ results. + + + True + green + Info: + 3. Adjust Time Range for $tok_time_label$. + True + + + + + + | makeresults +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_grp\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_grp\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"raw_txt\")`" +| eval filt_link="| search lookup_grp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_grp\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"link\")`])" +| eval filt_link_r_evt="| search lookup_grp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_grp\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"link\")`])" +| eval filt_link_admon="| search lookup_grp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_grp\",\"$tok_group_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,dn,objGUID,orig_cn\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_link_admon + + + + + + + `ms_obj_changes_base_cat("Group*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID,orig_cn,sAMAccountName","raw_txt")`]) +| search group_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,objGUID,orig_cn,sAMAccountName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_group("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID","raw_txt")`]) +| eval token=if(isnull(cn),if(isnull(dn),"$tok_sel_obj$",lower(dn)),lower(cn)) +| search token IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,orig_cn,dn,objGUID","link")`]) + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_r_evt$ + $result.filt_link_admon$ + $result.filt_raw_text_lbl$ + `ms_obj_changes_base_cat("Group*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID,orig_cn,sAMAccountName","raw_txt")`]) +| search group_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,objGUID,orig_cn,sAMAccountName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_group("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,dn,orig_cn,objGUID","raw_txt")`]) +| eval token=if(isnull(cn),if(isnull(dn),"$tok_sel_obj$",lower(dn)),lower(cn)) +| search token IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_grp","$tok_group_lkp$","$tok_domain$","$tok_sel_obj$","cn,orig_cn,dn,objGUID","link")`]) + + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + search msad_action=$tok_action$ +$tok_filt_link$ + + + + + True + + + True + True + True + + + + + + + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_group("$tok_dc_val$"),ms_obj_admon_base_a_type)` $tok_filt_raw_txt$ +| eval lookup_grp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +$tok_filt_link_admon$ + + + + + True + + + True + True + + + + $field3.earliest$ + $field3.latest$ + +
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + True + green + Info: + 1: Select the Target Domain to run the report against. + + + True + False + $value$ + True + green + Info: + 2: Select the Target Report from the "Select Report" dropdown. + + + + + + Select Report... + All Groups + New Groups + No Members + Deleted + Changed + Large Groups + Nested + Managed + Not Managed + sel + sel + + + + + + + + + + + + + + + + $label$ + True + |`ms_obj_md_secrpt-all-groups("$tok_group_lkp$","$tok_domain$")` + + + + + + + + + + + + $label$ + new_groups + New Groups + whenCreated_epoch + |`ms_obj_md_secrpt-new-groups + True + + created + Created + 4 + Group_Name,Type,whenCreated,distinguishedName,"# Members",whenChanged + 4. Select Event Result Type + green + Info: + + + + + + + + + + $label$ + True + |`ms_obj_md_secrpt-empty-groups($tok_group_lkp$,$tok_domain$)` + + + + + + + + + + + + + + $label$ + deleted_groups + Deleted Groups + whenDeleted_epoch + |`ms_obj_md_secrpt-deleted-groups + True + + deleted + Deleted + 4 + Group_Name,orig_cn,whenDeleted,distinguishedName,Type_Name,"Last Member Count",memberOf,whenCreated,whenChanged + 4. Select Event Result Type + green + Info: + + + + + + + + + + + + $label$ + changed_groups + whenChanged_epoch + Changed Groups + |`ms_obj_md_secrpt-changed-groups + + True + changed_groups + * + All Changes + 5 + Group_Name,Type,distinguishedName,"# Members",whenCreated,whenChanged,whenDeleted + 5. Select Event Result Type + green + Info: + + + + + + + $label$ + + True + True + green + Info: + 3. Enter the minimum Member Count to filter for large groups + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-nested-groups($tok_group_lkp$,$tok_domain$)` + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-managed-groups($tok_group_lkp$,$tok_domain$)` + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-unmanaged-groups($tok_group_lkp$,$tok_domain$)` + + + + + + + + + + + + + -4h@m + now + + + + + strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p") + strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p") + + + + + All + + + + all + all + label + obj_lnk_filt + + + + + + * + All Changes + + + + + + + $value$ + lower($label$) + $label$ + + + + + + 200 + 200 + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + WinEvent Summary + WinEvent Details + Admon Events + Change_Summary + Change_Summary + + + + True + Change_Summary + + + + True + Change_Details + + + + True + + + + +

+ + + $tok_res_message_state$ $tok_res_message$ + +

+ + + + + + + $tok_report_label$ - Groups + + $tok_report$ + $field3.earliest$ + $field3.latest$ + + + + + + +
+ + $tok_report_label$ - Groups - (From: $set_time_from$ To: $set_time_to$) + + $tok_chg_grp_filt$| table $fields_time_rep$ + + + + + + + + + + + True + True + $row.Group_Name$ + Change_Summary + Change_Summary + Change_Summary + True + +
+ +

+ + + Click on a Group in the above table to view $tok_action_lbl$ Event Details. + +

+ + + $tok_report_label$ - Groups - (Minimum Member Count: $tok_min_m_count$) + + | `ms_obj_md_secrpt-large-groups($tok_group_lkp$,$tok_domain$,"$tok_min_m_count$")` + + + + + +
+ + + + "$tok_sel_obj$" - $tok_action_lbl$ Change Events - (From: $set_time_from$ To: $set_time_to$) + + table time_group,adminuser,group,Change_Actions,$tok_tbl_res_flds$ +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",group as "Group_Name",Change_Details as "Change Details",Change_Summary as "Change Summary" + + + + + + + + + + + +
+ +
+ + View Raw Events -

Click to open a new window with raw events for All Windows Change activities with Group ($tok_sel_obj$) within Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No $tok_action_lbl$ events found for Group ($tok_sel_obj$) +
+

+ + Search Raw Events +

Click to search for All Windows Change activities with Group:

+ +
    +
  • + Group: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + + "$tok_sel_obj$" - admon Events - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + +
+ + View Raw Events -

Click to open a new window with raw admon events for All Admon Change activities with Group ($tok_sel_obj$) within Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Admon events found for Group ($tok_sel_obj$) +
+

+ + Search Admon Events +

Click to search for All Admon Change activities with Group:

+ +
    +
  • + Group: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_ou_chg.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_ou_chg.xml new file mode 100644 index 00000000..85960e7a --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_ou_chg.xml @@ -0,0 +1,70 @@ +
+ + + `ms_obj_changes_base_cat(OU)` +| eval dest_ou_dn=if(isnull(New_DN),DN,New_DN) +| rex field=dest_ou_dn "(?i)ou\=(?<ou_name>[^\,]+)" +| rex field=Value max_match=0 "\{(?<chg_gp_guid>[^\}]+)" +| fillnull value="NA" chg_gp_guid,dir_svcs_action,signature,LDAP_Display_Name,gpo_name,DN,Old_DN,New_DN,Correlation_ID +| mvexpand chg_gp_guid +| eval chg_gplink=if(LDAP_Display_Name=="gPLink","{".chg_gp_guid."}","") +| eval Value=if(isnull(Value),AttributeValue,Value) +| join type=left chg_gplink [| inputlookup AD_Obj_GPO | fields cn,displayName | rex field=cn "^(?<chg_gplink>[^(\s|$)]+)" | dedup chg_gplink | table chg_gplink, displayName | rename displayName AS gpo_name] +| table _time,ou_name,dest_ou_dn,src_nt_domain,src_user,LDAP_Display_Name,dir_svcs_action, chg_gp_guid,gpo_name,EventCode,signature,DN,Old_DN,New_DN,Value,msad_action,Correlation_ID +| eval mod_summary=if(LDAP_Display_Name=="gPLink" AND isnotnull(gpo_name),"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name."| - Target Linked GPO: ".gpo_name."| - Target Linked GPO ID: ".chg_gp_guid,"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name."| - Target Attribute Value: ".Value) +| eval chg_summary=case(EventCode=5137,"OU Created:| - Event Correlation ID: ".Correlation_ID."| - DN: ".DN,EventCode=5138,"OU Undeleted:| - Event Correlation ID: ".Correlation_ID." - ",EventCode=5139,"OU Moved:| - Event Correlation ID: ".Correlation_ID."| - From: ".Old_DN."| - To: ".New_DN,EventCode=5141,"OU Deleted:| - Event Correlation ID: ".Correlation_ID,EventCode=5136 OR EventCode=4662,"OU Modified: | - Event Correlation ID: ".Correlation_ID."|".mod_summary) +| table _time,ou_name,dest_ou_dn,msad_action,EventCode,signature,src_nt_domain,src_user,chg_summary +| makemv delim="|" chg_summary + $tok_time.earliest$ + $tok_time.latest$ + 1 + +
+ + + All + Moved + Created + Deleted + Modified + * + * + + + + All + * + * + src_user + src_user + + | dedup src_user | sort src_user + + + + + + @d + now + + +
+ + + Change Events Results + + + search msad_action="$tok_chg_type$" src_user="$tok_admin$" +| rename msad_action AS "OU Action",src_nt_domain AS "Admin Domain",src_user AS "Admin User",ou_name AS OU,dest_ou_dn AS "OU DN",chg_summary AS "Change Details" + + + + + + + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_ou_reports.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_ou_reports.xml new file mode 100644 index 00000000..25b6762c --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_ou_reports.xml @@ -0,0 +1,591 @@ +
+ + chg_summary + + `ms_obj_changes_base_cat("OU")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) +| fields _time,chg_gp_guid,dir_svcs_action,signature,LDAP_Display_Name,gpo_name,ou_obj_dn,DN,Old_DN,New_DN,Correlation_ID,AttributeValue,Value,LDAP_Display_Name,chg_gp_guid,src_user,src_nt_domain,EventCode,msad_action +| eval time_group=strftime(_time,"%m/%d/%y %I:%M %P") +| eval time_group_epoch=strptime(time_group,"%m/%d/%y %I:%M %P") +| eval dest_ou_dn=if(isnull(New_DN),DN,New_DN),adminuser=if(isnull(src_nt_domain),lower(src_user),src_nt_domain."\\".lower(src_user)) +| rex field=dest_ou_dn "(?i)ou\=(?<ou_name>[^\,]+)" +| rex field=Value max_match=0 "\{(?<chg_gp_guid>[^\}]+)" +| fillnull value="NA" chg_gp_guid,dir_svcs_action,signature,LDAP_Display_Name,gpo_name,DN,Old_DN,New_DN,Correlation_ID +| mvexpand chg_gp_guid +| eval gpo_link=if(LDAP_Display_Name=="gPLink",lower(chg_gp_guid),"") +| eval Value=if(isnull(Value),lower(AttributeValue),lower(Value)) +| lookup AD_Obj_GPO gpo_link, domain AS src_nt_domain OUTPUT displayName AS gpo_name +| eval mod_details="| - Target Attribute Value: ".mvjoin(Value,"| - ")."| - Event Correlation ID: ".Correlation_ID."| - DN: ".DN +| eval mod_summary=if(LDAP_Display_Name=="gPLink" AND isnotnull(gpo_name),"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name."| - Target Linked GPO: ".gpo_name."| - Target Linked GPO ID: ".chg_gp_guid,"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name) +| eval chg_summary=case(EventCode=5137,"|OU Created:| - signature: ".signature,EventCode=5138,"|OU Undeleted:| - signature: ".signature,EventCode=5139,"|OU Moved:| - signature: ".signature."| - From: ".Old_DN."| - To: ".New_DN,EventCode=5141,"|OU Deleted:| - signature: ".signature,EventCode=5136 OR EventCode=4662,"|OU Modified:| - signature: ".signature."|".mod_summary) +| eval chg_details=if(isnull(Value),chg_summary,chg_summary."".mod_details) +| stats max(time_group_epoch) AS l_time,values(chg_summary) AS chg_summary,values(chg_details) AS chg_details by time_group,adminuser,src_nt_domain,msad_action,ou_name,dest_ou_dn +| makemv delim="|" chg_summary +| makemv delim="|" chg_details + + $field3.earliest$ + $field3.latest$ + + + search msad_action="$tok_action$" +| eval chg_trigger="$tok_sel_obj$" + + + + True + red + Warning: + 3. No Change Events for Selected Time Range. Adjust Time Range to view change results. + True + + + + + True + green + Info: + 3. Adjust Time Range and 4. Select MSAD Action. + True + + + + + | `ms_obj_secrpt-$tok_time_report_val$-lkp-orgunits("$tok_domain$","$set_time_from$","$set_time_to$")` + + + + + True + | `ms_obj_secrpt-$tok_time_report_val$-lkp-orgunits("$tok_domain$","$set_time_from$","$set_time_to$")` + + + + True + green + Info: + 3. Adjust Time Range for $tok_time_label$. + True + + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + + search domain="$tok_domain$" +| eval dc_val=if(isnull(dc_val),"$tok_domain$",dc_val) + + + * + + + $result.dc_val$ + + + + + + | makeresults +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_ou\",\"AD_Obj_OU\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_ou\",\"AD_Obj_OU\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"raw_txt\")`" +| eval filt_link="| search ou_name IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_ou\",\"AD_Obj_OU\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"link\")`])" +| eval filt_link_r_evt="| search ou_name IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_ou\",\"AD_Obj_OU\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"link\")`])" +| eval filt_link_admon="| search ou_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_ou\",\"AD_Obj_OU\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,displayName,distinguishedName\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_link_admon + + + + + + + + `ms_obj_changes_base_cat_act("OU","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| eval dest_ou_dn=if(isnull(New_DN),lower(DN),lower(New_DN)) +| search dest_ou_dn IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_ou("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| eval dest_ou_dn=if(isnull(New_DN),lower(DN),lower(New_DN)) +| search ou_name IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_link_admon$ + $result.filt_raw_text_lbl$ + `ms_obj_changes_base_cat_act("OU","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| eval dest_ou_dn=if(isnull(New_DN),lower(DN),lower(New_DN)) +| search dest_ou_dn IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_ou("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| eval dest_ou_dn=if(isnull(New_DN),lower(DN),lower(New_DN)) +| search dest_ou_dn IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + + + + + search ou_name IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","link")`]) + + True + True + green + Info: + 4. Select Event Result Type + True + + + + + + True + + + True + True + + + + + + + `ms_obj_admon_flt_obj_type(ms_obj_admon_ou,ms_obj_admon_base_a_type)` $tok_domain$ ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","cn,displayName,distinguishedName","raw_txt")`]) +| eval ou_obj_lkp=if(isnull(distinguishedName),if(isnull(displayName),lower(objectGUID),lower(displayName)),lower(distinguishedName)) +| search ou_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_ou","AD_Obj_OU","$tok_domain$","$tok_sel_obj$","displayName,distinguishedName,objectGUID","link")`]) + + + + + True + + + True + True + + + + $field3.earliest$ + $field3.latest$ + + + + $tok_report$ + $field3.earliest$ + $field3.latest$ + + + + + + + + True + + + + + + + + True + + + +
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + True + green + Info: + 1: Select the Target Domain to run the report against. + + + True + False + $value$ + True + green + Info: + 2: Select the Target Report from the "Select Report" dropdown. + + + + + + Select Report... + All + Created + Deleted + Changed + Moved + GPO Linked + Not Managed + Managed + sel + sel + + + + + + + + + + + + + + + + + + + + $label$ + |`ms_obj_secrpt-all-orgunits($tok_domain$)` + + + + + + + + + + + + $label$ + True + New OUs + new + True + created + created + Created + 4 + Created + + + + + + + + + + + $label$ + True + Deleted OUs + deleted + True + deleted + Deleted + 4 + Deleted + + + + + + + + + + $label$ + True + Changed OUs + changed + True + modified + Changed + 4 + Changed + + + + + + + + $label$ + | `ms_obj_secrpt-moved-orgunits($tok_domain$)` + + + + + + + + + + + + $label$ + True + | `ms_obj_secrpt-gpolinked-orgunits($tok_domain$)` + + + + + + + + + + + + $label$ + | `ms_obj_secrpt-unmanaged-orgunits($tok_domain$)` + + + + + + + + + + + + $label$ + | `ms_obj_secrpt-managed-orgunits($tok_domain$)` + + + + + + + + + + + + + -4h@m + now + + + + + strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p") + strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p") + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + +

+ + Warning: No $tok_report_label$ OU Results found for selected Time Range. Adjust Time Range or Click to review the search. + +

+ + +

+ + Warning: $tok_report_label$ OU Report did not return any data. Click to review the search. + +

+ + + + + + WinEvent Summary + WinEvent Details + Admon Events + Change_Summary + Change_Summary + + + + True + chg_summary + + + + True + chg_details + + + + True + + + + +

+ + + $tok_res_message_state$ $tok_res_message$ + +

+ + + + + + + $tok_report_label$ - OUs + + + + + + + + +
+ + $tok_report_label$ - OUs - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + + + True + True + $row.distinguishedName$ + Change_Summary + Change_Summary + chg_summary + +
+ +

+ + + Click on an OU in the above table to view $tok_action_lbl$ Event Details. + +

+ + + + + "$tok_sel_obj$" - $tok_fld_act$ Events - (From: $set_time_from$ To: $set_time_to$) + + table time_group,adminuser,msad_action,$tok_tbl_res_flds$ +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",msad_action AS Change_Actions,ou_name as "Target_OU",chg_summary as "Change Summary",chg_details as "Change Details" + + + + + + + + + + + +
+ +
+ + View Raw Events -

Click to open a new window with raw events for All Windows Eventlog Change activities with OU ($tok_sel_obj$)

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No $tok_fld_act$ events found for OU ($tok_sel_obj$) +
+

+ + Search Raw Events +

Click to search for All Windows Change activities with OU:

+ +
    +
  • + OU: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + + "$tok_sel_obj$" - admon Events - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + +
+ + View Raw Events -

Click to open a new window with raw admon events for All Admon Change activities with OU ($tok_sel_obj$)

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Admon events found for OU ($tok_sel_obj$) +
+

+ + Search Admon Events +

Click to search for All Admon Change activities with OU:

+ +
    +
  • + OU: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_by_group_logons.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_by_group_logons.xml new file mode 100644 index 00000000..6afbf9de --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_by_group_logons.xml @@ -0,0 +1,874 @@ +
+ + + + sel + + green + Info: + 1: Select the AD Domain for the target Group. + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + | makeresults +| eval cmb_tokens="$tok_group_lkp$ $tok_group_filter$" + + + + | inputlookup $tok_group_lkp$ where domain="$tok_domain$" AND membercount!="0" AND (cn="$tok_group_filter$" OR sAMAccountName="$tok_group_filter$") +| eval srt_field=case(isDeleted="TRUE" OR isRecycled="TRUE",1,isDeleted="FALSE",2) +| eval cn=if(isDeleted="TRUE","Deleted: ".sAMAccountName." (".membercount.")",cn." (".membercount.")") +| fields cn,sAMAccountName,distinguishedName,member, srt_field + + + + + | makeresults +| eval cmb_tokens="$tok_kv_suffix$ $tok_user_lkp$ $tok_domain$ $tok_group$" + + + + `ms_obj_md_admon_group($tok_dc_val$)` + `ms_obj_failed_success_logons("user")` +| fields _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type,host,status,Failure_Reason +| eval Failure_Reason=if(isnull(Failure_Reason),if(isnull(signature),"Unknown",signature),Failure_Reason) +| eval src_ip=if(isnull(src_ip) OR src_ip=="127.0.0.1" OR src_ip=="::1" OR src_ip=="-","",src_ip) +| eval src_nt_host=if(isnull(src_nt_host),if(isnull(srch_host),upper(host),upper(src_host)),replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| eventstats values(src_nt_host) AS src_nt_host,count by user,_time +| eval user=lower(user) +| fillnull value="Not In Event" src_nt_host +| table _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type,host,status,Failure_Reason + `ms_obj_failed_success_logons("user")` + [| `ms_obj_md_filter_lkup_group_members("$tok_group_lkp$","$tok_user_lkp$","$tok_domain$","$tok_group$")` + | `ms_obj_ss_filt_flds_raw("cn,sAMAccountName,userPrincipalName")`] +| fields _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type,host,status,Failure_Reason +| eval Failure_Reason=if(isnull(Failure_Reason),if(isnull(signature),"Unknown",signature),Failure_Reason) +| search user IN( + [| `ms_obj_md_filter_lkup_group_members("$tok_group_lkp$","$tok_user_lkp$","$tok_domain$","$tok_group$")` + | `ms_obj_ss_filt_flds_in("cn,sAMAccountName,userPrincipalName")`]) +| eval src_ip=if(isnull(src_ip) OR src_ip=="127.0.0.1" OR src_ip=="::1" OR src_ip=="-","",src_ip) +| eval src_nt_host=if(isnull(src_nt_host),if(isnull(srch_host),upper(host),upper(src_host)),replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| eventstats values(src_nt_host) AS src_nt_host,count by user,_time +| eval user=lower(user) +| fillnull value="Not In Event" src_nt_host + | `ms_obj_md_filter_lkup_group_members("$tok_group_lkp$","$tok_user_lkp$","$tok_domain$","$tok_group$")` +| table cn,sAMAccountName, userPrincipalName,memberOf,domain +| eval User_Logon_Search_Values=if(userPrincipalName="",if(cn="",sAMAccountName,sAMAccountName."|".cn),sAMAccountName."|".cn."|".userPrincipalName) +| makemv delim="|" User_Logon_Search_Values +| stats values(User_Logon_Search_Values) AS User_Logon_Search_Values by domain,cn,sAMAccountName,userPrincipalName + + + + + fields User_Logon_Search_Values,sAMAccountName +$tok_user_filt$ +| stats values(User_Logon_Search_Values) AS user_filter +| eval raw_filter="\"".mvjoin(user_filter,"\" OR \"")."\"" +| eval user_filter="\"".mvjoin(user_filter,"\",\"")."\"" +| table user_filter, raw_filter + + + `ms_obj_failed_success_logons("user")` ($result.raw_filter$) +| fields _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type,host,status,Failure_Reason +| eval Failure_Reason=if(isnull(Failure_Reason),if(isnull(signature),"Unknown",signature),Failure_Reason) +| search user IN($result.user_filter$) +| eval src_ip=if(isnull(src_ip) OR src_ip=="127.0.0.1" OR src_ip=="::1" OR src_ip=="-","",src_ip) +| eval src_nt_host=if(isnull(src_nt_host),if(isnull(srch_host),upper(host),upper(src_host)),replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| eventstats values(src_nt_host) AS src_nt_host,count by user,_time +| eval user=lower(user) +| fillnull value="Not In Event" src_nt_host + + + + fields user +| stats values(user) AS user +| eval user=if(mvcount(user)>1,"\"".mvjoin(user,"\",\"")."\"","\"".user."\"") + + + $result.user$ + + + +
+
+ + + + + + -24h@h + now + + + + + Select Domain... + sel + sel + + sort domain + + domain + domain + + + + + + + + + + sel + sel + green + Info: + 1: Select the AD Domain for the target Group + + + + + + + + + + sel + sel + True + green + Info: + 2: Enter a AD Group Name or Wildcard filter (Ex. admin*) to filter the AD Group List. (Case Sensitive) + + + + + + + + + $value$ + + + + + + + + + + + Select Group... + sel + sel + + stats count by sAMAccountName, cn,distinguishedName, srt_field | sort -srt_field, sAMAccountName | table cn, distinguishedName + + cn + distinguishedName + + + + + green + Info: + 3: Select the target AD Group to search for login activity for the its members. + + + $value$ + $label$ + + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + All + + | fields cn,sAMAccountName,User_Logon_Search_Values +| WHERE User_Logon_Search_Values IN($tok_user_logins$) +| eval user_filt="\"".mvjoin(User_Logon_Search_Values,"\",\"")."\"" +| table cn,user_filt + + all + all + cn + user_filt + + + + + + | search user IN($value$) + + + + + + All Logons + Succesful + Failed + All + All + + + True + True + True + | stats count(eval(status="failure")) AS Failed_Attempts,count(eval(status="success")) AS Successful_Attempts, count AS Total_Attempts by user,src_nt_domain + | streamstats count as total_members + | sort -Total_Attempts + | stats count(eval(status="failure")) AS Failed_Attempts,count(eval(status="success")) AS Successful_Attempts, count AS Total_Attempts by src_nt_host, src_ip + | sort -Total_Attempts + | stats count AS Total_Attempts, count(eval(status="failure")) AS f_cnt, count(eval(status="success")) AS s_cnt by src_nt_host,src_ip,user,Failure_Reason +| eventstats sum(f_cnt) AS uf_cnt,sum(s_cnt) AS us_cnt by user,src_nt_host +| eventstats sum(f_cnt) AS sf_cnt by Failure_Reason,src_nt_host +| sort -uf_cnt -us_cnt -sf_cnt +| eval Top_Failed_Users=if(uf_cnt>0,"(".tostring(uf_cnt,"commas").") ".user,""),Failure_Reason=if(sf_cnt>0,"(".tostring(sf_cnt,"commas").") ".Failure_Reason,""),Top_Success_Users=if(us_cnt>0,"(".tostring(us_cnt,"commas").") ".user,"") +| stats sum(Total_Attempts) AS Total_Attempts, list(Top_Failed_Users) AS Top_Failed_Users, list(Failure_Reason) AS Failure_Reason,list(Top_Success_Users) AS Top_Success_Users,values(src_ip) AS src_ip by src_nt_host +| eval Top_Success_Users=if(isnull(Top_Success_Users),"NA",mvindex(mvdedup(Top_Success_Users),0,9)),Top_Failed_Users=if(isnull(Top_Failed_Users),"NA",mvindex(mvdedup(Top_Failed_Users),0,9)),Failure_Reason=mvdedup(Failure_Reason) +| sort -Total_Attempts +| rename signature AS "Top_Failure_Reasons", src_nt_host AS "Source System", src_ip AS "Source IP" + + + True + | WHERE status="success" + | streamstats count as total_members + | stats count AS Successful_Attempts by user,src_nt_domain + | sort -Successful_Attempts + | WHERE status="success" + | stats count AS Successful_Attempts by src_nt_host, src_ip + | sort -Successful_Attempts + | WHERE status="success" + | stats count AS Total_Attempts, count(eval(status="success")) AS s_cnt,values(src_ip) AS src_ip by src_nt_host,user + | sort -s_cnt + | eval eval Top_Success_Users=if(s_cnt>0,"(".tostring(s_cnt,"commas").") ".user,NULL) + | stats sum(Total_Attempts) AS Total_Successful_Attempts, list(Top_Success_Users) AS Top_Success_Users,values(src_ip) AS src_ip by src_nt_host + | eval Top_Success_Users=if(isnull(Top_Success_Users),"NA",mvindex(mvdedup(Top_Success_Users),0,9)) + | sort -Total_Successful_Attempts + | rename src_nt_host AS "Source System", src_ip AS "Source IPs" + + + + + True + | WHERE status="failure" + | stats count AS Failed_Attempts by user,src_nt_domain + | streamstats count as total_members + | sort -Failed_Attempts + | WHERE status="failure" + | stats count AS Failed_Attempts by src_nt_host, src_ip + | sort -Failed_Attempts + | WHERE status="failure" + | stats count AS Total_Attempts, count(eval(status="failure")) AS f_cnt,values(src_ip) AS src_ip by src_nt_host,user,Failure_Reason + | eventstats sum(f_cnt) AS uf_cnt by user,src_nt_host + | eventstats sum(f_cnt) AS sf_cnt by Failure_Reason,src_nt_host + | sort -uf_cnt -sf_cnt + | eval Top_Failed_Users=if(uf_cnt>0,"(".tostring(uf_cnt,"commas").") ".user,""),Failure_Reason=if(sf_cnt>0,"(".tostring(sf_cnt,"commas").") ".Failure_Reason,"") + | stats sum(Total_Attempts) AS Total_Attempts, list(Top_Failed_Users) AS Top_Failed_Users, list(Failure_Reason) AS Failure_Reason,values(src_ip) AS src_ips by src_nt_host + | eval Top_Failed_Users=if(Top_Failed_Users=="","NA",mvindex(mvdedup(Top_Failed_Users),0,9)),Failure_Reason=mvdedup(Failure_Reason) + | sort -Total_Attempts + | rename Failure_Reason AS "Top_Failure_Reasons", src_nt_host AS "Source System", src_ip AS "Source IP" + + + + + + +

+ + + Info: Use the above inputs to filter the Returned Results. + +

+ + + + + + +
+

+
+
+
+ + +
+

No AD Domain information in the AD_Obj_Domain lookup. Click for more Troubleshooting Steps.

+

No AD Groups in the $tok_group_lkp$ lookup match the filter $tok_group_filter$ First, try using different Case for the filter or Click for more Troubleshooting Steps.

+

None of the Group Members in the $tok_group$ AD Group are AD User Accounts.

+

Login Search Failed

+

No Login Results returned for members of the group ($tok_group_label$). Expand the Search Time Period, or select a different AD Group

Click Open Base Search to view base login data Or Click Open Filtered Search to view filtered login data.

+
+ + + + + + + + + + $tok_logon_type$ Logins by User Accounts + + $tok_user_filt$ +$tok_logon_srch_top$ +|rename user as "Username", src_nt_domain as "Domain" + + toString($job.resultCount$,"commas") + + + + + + + + + [#65A637,#D93F3C] + 1 + + + [#D93F3C,#65A637] + 1 + +
+ + $tok_logon_type$ Logins by Source System + + $tok_user_filt$ +$tok_logon_srch_src$ +| rename src_nt_host as "Workstation",src_ip as "IP Address" + + + + + + + + [#65A637,#D93F3C] + 1 + + + + + + [#D93F3C,#65A637] + 1 + +
+ + + + Top 10 Users by System - $tok_logon_type$ Logins + + $tok_user_filt$ $tok_logon_srch_sum$ + + + + + + +
+ + + + + + All Logins by Users - Over Time + + $tok_user_filt$ +| eval user=lower(user) +| timechart count by user + + + + + + + + + Failed Logins by Users - Over Time + + $tok_user_filt$ +| WHERE status="failure" +| eval user=lower(user) +| timechart count by user + + + + + + + + + Success Logins by Users - Over Time + + $tok_user_filt$ +| WHERE status="success" +| eval user=lower(user) +| timechart count by user + + + + + + + + + + + + + Filtered Users Lists + "User Domain","User Name","User Account",userPrincipalName,User_Logon_Search_Values + + eval user=User_Logon_Search_Values $tok_user_filt$ +| sort cn +| rename domain AS "User Domain", cn AS "User Name", sAMAccountName AS "User Account" + + + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+

Type

+
+ 		+
+

Search Text

+
+ 		+
+

Action

+
+
+
Group List
+ 		+ 
+$tok_srch_ad_group_list$
+
+ 		+
+ + Open Search + +
+
+
Group Members List
+ 		+ 
+$tok_srch_ad_user_list$
+
+ 		+
+ + Open Search + +
+
+
Base Logon Search
+ Dynamic
+ Dynamic uses the subsearch and is the type leveraged by this dashboard +
+ 		+ 
+$tok_srch_logon$
+
+ 		+
+ + Open Search + +
+
+
Base Logon Search
+ Non-Dynamic
+ Non-Dynamic uses only the values retrieved from the configured subsearch. +
+ 		+ 
+$tok_srch_logon_nond$
+
+ 		+
+ + Open Search + +
+
+ + + + + + + + + + + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_by_ou_logons.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_by_ou_logons.xml new file mode 100644 index 00000000..0a3a49de --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_by_ou_logons.xml @@ -0,0 +1,1141 @@ +
+ + + 5000 + 500 + 300 + 600 + 0 + orange + 0 + orange + + + + + + sAMAccountName + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + | inputlookup $tok_user_lkp$ WHERE domain="$tok_domain$" +| fields dn_path,cn,sAMAccountName,userPrincipalName +| where match(dn_path,"(?i)$tok_ou_filter$") +| rename dn_path AS distinguishedName +| stats count as user_count by distinguishedName +| lookup AD_Obj_OU distinguishedName OUTPUT deletedDate +| fillnull value="0" deletedDate +| rex field=distinguishedName max_match=0 "(?i)(ou\=|cn\=)(?<levels>[^(\,|$)]+)" +| eval displayName=if(deletedDate=0 OR isnull(deletedDate),"(".user_count.") ".mvjoin(levels," > ")." ...","DELETED-(".user_count.") ".mvjoin(levels," > ")." ...") +| sort distinguishedName +| table user_count,displayName,distinguishedName + 0 + + + + 0 + red + 0 + red + True + none + + + True + + + + + True + display:none + + + + + + search distinguishedName="$tok_ou$" +| eval exec_user_srch_trigger=if(user_count>=$tok_bypass_min$,"false","true") +| eval show_user_list=if(user_count>=$tok_bypass_min$,"false","true") +| eval show_user_filt=if(user_count>=$tok_bypass_min$,"true","false") +| eval inp_usr_lst_nmb=if(user_count>=$tok_bypass_min$ AND count<=$tok_results_max$,"6","4") +| eval msg_state=if(user_count>=$tok_bypass_min$,"Warning","Info") +| eval msg_color=if(user_count>=$tok_bypass_min$,"red","green") +| eval msg=if(user_count>=$tok_bypass_min$ AND user_count<=$tok_results_max$,inp_usr_lst_nmb.": ".user_count." Total Users are in the \"OU Path\" ($tok_ou$). Optionally use the Filter User List input to reduce the matching count, or enter * to view the full list of Users. (Slow Dropdown Possible).",if(user_count>=$tok_results_max$,inp_usr_lst_nmb.": ".user_count." Total Users are in the \"OU Path\" ($tok_ou$). Use the \"Filter User\" input to reduce the matching count.","4: Info (".user_count." Users) Either select a individual matching user account or \"All\" from the \"Select User\" input.")) + + + + if($result.show_user_filt$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + true + + + $result.count$ + $result.inp_usr_lst_nmb$ + $result.msg_color$ + $result.msg_state$ + $result.msg$ + + + + + $result.count$ + true + true + + + + + | inputlookup $tok_user_lkp$ WHERE domain=$tok_domain$ AND dn_path="$tok_ou$" $tok_user_filter$ +| eval exec_trigger="$tok_tgr_sub_user_list$" +| fields * + + 0 + + + + 0 + True + 0 + red + + + + + True + True + $job.resultCount$ + green + display:none; + + + + + + + | fields +| eval subchk_trigger="$tok_tgr_sub_chk$" +| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)` +| eval show_bypass_option=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"true","false") +| eval show_user_list=if(count>=$tok_bypass_min$,"false","true") +| eval inp_usr_lst_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"6","5") +| eval msg_state=if(count>=$tok_bypass_min$,"Warning","Info") +| eval msg_color=if(count>=$tok_bypass_min$,"red","green") +| eval msg=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter_bs$). Either update the \"Filter User\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow Search Possible).",if(count>=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter_bs$). Update the \"Filter User\" to reduce the matching count.",inp_usr_lst_nmb.": (".count." Users) Either select a individual matching user account or \"All\" from the \"Select User\" input.")) + + + + if($result.show_bypass_option$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + $result.count$ + $result.inp_usr_lst_nmb$ + $result.msg_color$ + $result.msg_state$ + $result.msg$ + + + + $result.count$ + true + + + + + $tok_base_search$ ([$tok_srch_u_raw$]) +| fields _time,action,domain,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type,host,status,Failure_Reason +| eval Failure_Reason=if(isnull(Failure_Reason),if(isnull(signature),"Unknown",signature),Failure_Reason) +| eval exec_logon_search="$tok_tgr_exec_logon$" +| search user IN([$tok_srch_u_link$]) +| eval src_ip=if(isnull(src_ip) OR src_ip=="127.0.0.1" OR src_ip=="::1","-",src_ip) +| eval src_nt_host=if(isnull(src_nt_host),if(isnull(srch_host),upper(host),upper(src_host)),replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| eventstats values(src_nt_host) AS src_nt_host by user,_time +| eval user=lower(user),Failed_Attempts=if(status="failure",1,0),Successful_Attempts=if(status="success",1,0) +| fillnull value="Not In Event" src_nt_host + $time_field.earliest$ + $time_field.latest$ + + + $job.dispatchState$." ".toString($job.eventCount$,"commas") + blue + $job.dispatchState$ + $job.doneProgress$ + $job.eventCount$ + $tok_base_search$ ([$tok_srch_u_raw$]) +| fields _time,action,domain,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type,host,status,Failure_Reason +| eval Failure_Reason=if(isnull(Failure_Reason),if(isnull(signature),"Unknown",signature),Failure_Reason) +| search user IN([$tok_srch_u_link$]) +| eval src_ip=if(isnull(src_ip) OR src_ip=="127.0.0.1" OR src_ip=="::1","-",src_ip) +| eval src_nt_host=if(isnull(src_nt_host),if(isnull(srch_host),upper(host),upper(src_host)),replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| eventstats values(src_nt_host) AS src_nt_host by user,_time +| eval user=lower(user),Failed_Attempts=if(status="failure",1,0),Successful_Attempts=if(status="success",1,0) +| fillnull value="Not In Event" src_nt_host +| stats sum(Failed_Attempts) AS Failed_Attempts,sum(Successful_Attempts) AS Successful_Attempts, sum(count) AS Total_Attempts by user,src_nt_domain + + + + + + True + earliest=$time_field.earliest$latest=$time_field.latest$ + 0 + red + True + $job.dispatchState$ + $job.resultCount$ + + + + + True + earliest=$time_field.earliest$latest=$time_field.latest$ + green + True + $job.dispatchState$ + $job.resultCount$ + display:none; + + + + +
+
+ + + + + + -24h@h + now + + + + + Select Domain... + sel + sel + + sort domain + + domain + domain + + + + + + + + + + sel + sel + green + Info: + 1: Select the AD Domain for the target Group + + + + + + + + + + + + + + + + + sel + sel + + + no + no + sel + sel + True + green + Info: + 2: Enter a AD OU Name or part of an OU Name. Do not use a Wildcard, entered value will be used for any part of the OU Name by default. + + + + + + + + + + + + + + + + $value$ + True + + + no + no + sel + sel + sel + sel + green + Info: + 3: Select and OU Path for the target Users. + + + + + + + + + + + + + + + + Select OU... + + stats count by displayName,distinguishedName +| sort 0 displayName +| table displayName, distinguishedName + + displayName + distinguishedName + + + pending + + + + + active + + + + + + + + + + + + + no + no + sel + sel + $value$ + $label$ + true + + + + active + | inputlookup $tok_usr_lookup$ WHERE domain=$tok_domain$ +| fields cn,sAMAccountName, distinguishedName +| WHERE match(distinguishedName, "$tok_ou$") +| stats count by dn_path,cn,sAMAccountName + ([| inputlookup AD_Obj_User WHERE domain=$tok_domain$ +| fields sAMAccountName, distinguishedName +| WHERE match(distinguishedName, "$tok_ou$") +| stats values(sAMAccountName) AS search +| eval search="\"".mvjoin(search,"\" OR \"")."\"" +| table search]) + | search ([| inputlookup AD_Obj_User WHERE domain=$tok_domain$ +| fields sAMAccountName, distinguishedName +| WHERE match(distinguishedName, "$tok_ou$") +| stats values(sAMAccountName) AS search +| eval search="user IN(\"".mvjoin(search,"\",\"")."\")" +| table search]) + true + + + + + + + + + + + + + sel + + + + + + + + + active + sel + sel + AND (cn="$value$" OR sAMAccountName="$value$" OR userPrincipalName="$value$") + true + + + + + + No + Yes + no + no + + + + + + + sel + sel + + + + true + true + sel + sel + + + + + + Select User + All + + | eval tgt_field=sAMAccountName | table cn,tgt_field + + sel + sel + cn + tgt_field + + + + True + + + + true + + + + active + True + $tok_user_filter$ + $tok_user_filter$ + | inputlookup $tok_user_lkp$ WHERE domain=$tok_domain$ AND dn_path="$tok_ou$" $tok_user_filter$ +| fields cn,sAMAccountName,userPrincipalName +| `ms_obj_ss_filt_flds_raw("cn,sAMAccountName,userPrincipalName")` + | inputlookup $tok_user_lkp$ WHERE domain=$tok_domain$ AND dn_path="$tok_ou$" $tok_user_filter$ +| fields cn,sAMAccountName,userPrincipalName +| `ms_obj_ss_filt_flds_in("cn,sAMAccountName,userPrincipalName")` + True + + + + True + + + + active + AND sAMAccountName="$value$" + AND sAMAccountName="$value$" + True + | inputlookup $tok_user_lkp$ WHERE domain=$tok_domain$ AND dn_path="$tok_ou$" AND sAMAccountName="$value$" +| fields cn,sAMAccountName,userPrincipalName +| `ms_obj_ss_filt_flds_raw("cn,sAMAccountName,userPrincipalName")` + | inputlookup $tok_user_lkp$ WHERE domain=$tok_domain$ AND dn_path="$tok_ou$" AND sAMAccountName="$value$" +| fields cn,sAMAccountName,userPrincipalName +| `ms_obj_ss_filt_flds_in("cn,sAMAccountName,userPrincipalName")` + True + + + + + + Standard Index + Authentication DM + Authentication DM(With Summary) + standard + standard + + + `ms_obj_failed_success_logons("user")` + standard + $tok_base_srch_filt$ + search + | table search | format + + + | `ms_obj_srch_auth_model_basic("true")` + model + | join user + user + | table user,cn,dn,sAMAccountName,dn_path + + + + + | `ms_obj_srch_auth_model_basic("false")` + model + | join user + user + | table user,cn,dn,sAMAccountName,dn_path + + + + + + +

+ + + $tok_message_state$: $tok_message$. + +

+ + + + + + All Logons + Succesful + Failed + All + All + + + True + True + True + | stats sum(Failed_Attempts) AS Failed_Attempts,sum(Successful_Attempts) AS Successful_Attempts, count AS Total_Attempts by user,src_nt_domain +| sort -Total_Attempts + | stats sum(Failed_Attempts) AS Failed_Attempts,sum(Successful_Attempts) AS Successful_Attempts, count AS Total_Attempts by src_nt_host, src_ip +| sort -Total_Attempts + | stats sum(Failed_Attempts) AS f_cnt,sum(Successful_Attempts) AS s_cnt, count AS Total_Attempts by src_nt_host, src_ip,user,signature +| eventstats sum(f_cnt) AS uf_cnt,sum(s_cnt) AS us_cnt by user,src_nt_host +| eventstats sum(f_cnt) AS sf_cnt by signature,src_nt_host +| sort -uf_cnt -us_cnt -sf_cnt +| eval Top_Failed_Users=if(uf_cnt>0,"(".tostring(uf_cnt,"commas").") ".user,""),signature=if(sf_cnt>0,"(".tostring(sf_cnt,"commas").") ".signature,""),Top_Success_Users=if(us_cnt>0,"(".tostring(us_cnt,"commas").") ".user,"") +| stats sum(Total_Attempts) AS Total_Attempts, list(Top_Failed_Users) AS Top_Failed_Users, list(signature) AS signature,list(Top_Success_Users) AS Top_Success_Users,values(src_ip) AS src_ips by src_nt_host +| eval Top_Success_Users=mvindex(mvdedup(Top_Success_Users),0,9),Top_Failed_Users=if(Top_Failed_Users=="","NA",mvindex(mvdedup(Top_Failed_Users),0,9)),signature=mvdedup(signature) +| sort -Total_Attempts +| rename signature AS "Top_Failure_Reasons", src_nt_host AS "Source System", src_ip AS "Source IP" + + + True + | WHERE status="success" +| stats sum(Successful_Attempts) AS Successful_Attempts by user,src_nt_domain +| sort -Successful_Attempts + | WHERE status="success" +| stats sum(Successful_Attempts) AS Successful_Attempts by src_nt_host, src_ip +| sort -Successful_Attempts + | WHERE status="success" +| stats count AS Total_Attempts, sum(Successful_Attempts) AS s_cnt,values(src_ip) AS src_ip by src_nt_host,user +| sort -s_cnt +| eval eval Top_Success_Users=if(s_cnt>0,"(".tostring(s_cnt,"commas").") ".user,NULL) +| stats sum(Total_Attempts) AS Total_Successful_Attempts, list(Top_Success_Users) AS Top_Success_Users,values(src_ip) AS src_ip by src_nt_host +| eval Top_Success_Users=mvindex(Top_Success_Users,0,9) +| sort -Total_Successful_Attempts +| rename src_nt_host AS "Source System", src_ip AS "Source IPs" + + + + + True + | WHERE status="failure" +| stats sum(Failed_Attempts) AS Failed_Attempts by user,src_nt_domain +| sort -Failed_Attempts + | WHERE status="failure" +| stats sum(Failed_Attempts) AS Failed_Attempts by src_nt_host, src_ip +| sort -Failed_Attempts + | WHERE status="failure" +| stats count AS Total_Attempts, sum(Failed_Attempts) AS f_cnt,values(src_ip) AS src_ip by src_nt_host, user,signature +| eventstats sum(f_cnt) AS uf_cnt by user,src_nt_host +| eventstats sum(f_cnt) AS sf_cnt by signature,src_nt_host +| sort -uf_cnt -sf_cnt +| eval Top_Failed_Users=if(uf_cnt>0,"(".tostring(uf_cnt,"commas").") ".user,""),signature=if(sf_cnt>0,"(".tostring(sf_cnt,"commas").") ".signature,"") +| stats sum(Total_Attempts) AS Total_Attempts, list(Top_Failed_Users) AS Top_Failed_Users, list(signature) AS signature,values(src_ip) AS src_ips by src_nt_host +| eval Top_Failed_Users=if(Top_Failed_Users=="","NA",mvindex(mvdedup(Top_Failed_Users),0,9)),signature=mvdedup(signature) +| sort -Total_Attempts +| rename signature AS "Top_Failure_Reasons", src_nt_host AS "Source System", src_ip AS "Source IP" + + + + + + + + + + + + + + + + + +

+
+ + + + Warning - No AD OU's available in the AD_Obj_OU lookup. See below for troubleshooting steps. + + + +
+

+ + + + + + + + + + + + + + + + + +
+
+ +
+ 		+

+

    +

    + Review and Verify collected admon: +

    +
      +
    • + + + Click Here + to verify that the admon baseline steps have been implemented correctly. + +
      • +
    +
+

+
+
+ +
+ 		+

+

    +

    + Verify collected admon (eventtype=ms_ad_obj_msad_data admonEventType=Sync) data for target AD Objects - Groups, Users, Computers, OU's and GPO's: +

    +
      +
    • + + + Click Here + to verify that the admon baseline steps have been implemented correctly. + +
      • +
    • + Note: This dashboard leverages the admon data for objectClass's ("top|person|organizationalPerson|user" and "top|orginizational") +
      • +
    +
+

+
+
+ +
+ 		+

+

    +

    + After verifying admon data has been collected, open the Build AD Lookp Lists - Main dashboard to build AD Object Lookups: +

    + +
+

+
+
+ +
+ 		+

+

    +

    + Re-open this dashboard to pickup the newly created, required, lookups: +

    + +
+

+
+ + + + + + +

+
+ + + + Warning - No AD Users available in the selected $tok_ou_label$ OU.
+ Select an AD OU that has Users, or if you recently added a user to the $tok_ou_label$ ou, then perform the below steps. + + + +
+

+ + + + + + + + + + + + + +
+
+ +
+ 		+

+

    +

    + Update the AD OU Lookup with the latest AD OU changes (Default schedule: run every 15 minutes): +

    +
      +
    • + + + Click Here + to run the AD Group Sync saved search to pick up the latest AD OU changes. + +
      • +
    +
+

+
+
+ +
+ 		+

+

    +

    + Update the AD User Lookup with the latest AD OU changes (Default schedule: run every 15 minutes): +

    +
      +
    • + + + Click Here + to run the AD User Sync saved search to pick up the latest AD Group changes. + +
      • +
    +
+

+
+
+ +
+ 		+

+

    +

    + Re-open this dashboard to pickup the updated AD Groups and User lookups: +

    + +
+

+
+ + + + + + + Filtered Users Lists in or under OU or Container ( $tok_ou$ ) + + eval "User_Source_Field(sAMAccountName,cn,userPrincipalName)"=sAMAccountName.",".cn.",".userPrincipalName +| fields domain,cn,dn_path,"User_Source_Field(sAMAccountName,cn,userPrincipalName)" +| sort cn +| rename domain AS "User Domain", cn AS "User Name", dn_path AS "Object Path" + + + + + + +
+ + + + + +

+
+ + + No Login Results returned for Users within the directory ($tok_ou_label$). +
    +
  • Expand the Search Time Period, select a different AD OU Part/Path, or review the searches in the Search Info tab to verify login data.
    • +
+ + + +
+

+ + + $tok_logon_type$ Logins by User Accounts + + $tok_logon_srch_top$ +|rename user as "Username", src_nt_domain as "Domain" + + + 0 + + + toString($job.resultCount$,"commas") + + + + + + + + + + [#65A637,#D93F3C] + 1 + + + [#D93F3C,#65A637] + 1 + +
+ + $tok_logon_type$ Logins by Source System + + $tok_logon_srch_src$ +| rename src_nt_host as "Workstation",src_ip as "IP Address" + + + + + + + + [#65A637,#D93F3C] + 1 + + + + + + [#D93F3C,#65A637] + 1 + +
+ + + + Top 10 Users by System - $tok_logon_type$ Logins + + $tok_logon_srch_sum$ + + + + + + +
+ + + + + +

+
+ + + No Login Results returned for members of the group ($tok_ou_label$). + + +
+

+ + + All Logins by Users - Over Time + + timechart count by user + + + + + + + + + Failed Logins by Users - Over Time + + WHERE status="failure" +| timechart count by user + + + + + + + + + Success Logins by Users - Over Time + + WHERE status="success" +| timechart count by user + + + + + + + + + + + + +

+
+ + Below are the base searches for this dashboard.
+ (Note the resulting logon search has two types, Dynamic and Non-Dynamic. Dynamic uses the subsearch, where Non-Dynamic uses only the values from the configured subsearch.) + +
+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+

Type

+
+ 		+
+

Search Text

+
+ 		+
+

Action

+
+
+

+
+ + + + Warning - No AD OU's available in the AD_Obj_OU lookup. Verify admon data collection and Lookups have been built. + Open Getting Started Dashboard + + + + +
+

+
+
OU List
+ 		+ 
+| inputlookup $tok_user_lkp$ | fields dn_path |stats count by dn_path
+
+ 		+
+ + Open Search + +
+
+

+
+ + + + Warning - No AD OU Users available in the selected $tok_ou_label$ Directory.
+ Select an AD OU Part or Path that has users, or if you recently added a user to the $tok_ou_label$ directory, then wait up to 15minutes for the next scheduled pickup and update of the new Users admon data. + + + +
+

+
+
Filtered OU - User List
+ 		+ 
+$tok_srch_u_raw$
+
+ 		+
+ + Open Search + +
+
+
+ + + No Login Results returned for Users within the directory ($tok_ou_label$). +
    +
  • Expand the Search Time Period, select a different AD OU Part/Path, or review the searches below to verify login data.
    • +
+ + + +
+
+
Base Logon Search
+ Dynamic +
+ 		+ 
+$tok_srch_logon$
+
+ 		+
+ + Open Search + +
+
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_chg.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_chg.xml new file mode 100644 index 00000000..c10e09f1 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_chg.xml @@ -0,0 +1,426 @@ +
+ + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + `ms_obj_changes_base_cat("User")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) user_type!="computer" user_type!="system" +| `ms_obj_md_user_change_cmb("$tok_user_lkp$")` +| table time_group,adminuser,user,msad_action,dest_user_subject,Correlation_IDs,Change_Actions,Change_Summary,Change_Details +| lookup $tok_user_lkp$ lookup_usr AS user OUTPUT domain,whenChanged,userAccountControl,uac_details AS userAccountControl_Details,userPrincipalName,distinguishedName,lookup_usr + $Time.earliest$ + $Time.latest$ + + + + + True + + + + + + + True + red + Warning: + 2. No Change Events for Selected Time Range. Adjust Time Range to view change results. + + True + + + + True + True + True + green + Info: + 3+4: Select a User or Filter the User List + + True + + + + + + | makeresults +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName,dn\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`" +| eval filt_link="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| eval filt_link_admon="| search user_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName,dn\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_link_admon + + + + + + + + `ms_obj_changes_base_cat_act("User","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| search user IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_user("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| eval user_obj_lkp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +| search user_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_link_admon$ + $result.filt_raw_text_lbl$ + `ms_obj_changes_base_cat_act("User","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| search user IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_user("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| eval user_obj_lkp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +| search user_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + + + + + + search msad_action=$tok_msad_action$ +$tok_filt_link$ + + + + + True + + + True + True + + + + + + + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_user("$tok_dc_val$"),ms_obj_admon_base_a_type)` $tok_filt_raw_txt$ +| fields admonEventType,_time,_raw + + + + + True + + + + + + + + True + + + + True + True + + True + + + $Time.earliest$ + $Time.latest$ + + + + fields admonEventType +| stats count by admonEventType +| table admonEventType + + + + search admonEventType="$tok_admon_action$" +$tok_filt_link_admon$ + + + + + True + + + True + True + + + + +
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + True + green + Info: + 1: Select the Target Domain to run the report against. + + + True + False + $value$ + True + green + Info: + 2: Select Time Range for Change Activity. + + + + + + + @d + now + + + + strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p") + strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p") + + + + + + * + * + + + | search lookup_usr="$value$" + + + + + + + + + All + all + all + + stats values(lookup_usr) AS lookup_usr by user $tok_obj_list_filter$ + | sort cn + + user + user + + + + + + + + + $value$ + + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + Windows-Security-Relevant Changes - (From: $set_time_from$ To: $set_time_to$) + + + All + all + all + + |stats count by msad_action +| eval label=case(msad_action="enabled","Enabled",msad_action="created","Created",msad_action="disabled","Disabled",msad_action="modified" OR msad_action="changed","Modified",msad_action="deleted","Deleted",msad_action="moved","Moved") +| eval label=if(isnull(label),msad_action,label) +| table msad_action,label +| sort msad_action + + label + msad_action + + + * + + + $value$ + + + + + + WinEvent Summary + WinEvent Details + Change_Summary + Change_Summary + + + + True + Change_Summary + + + + True + Change_Details + + + + +
+

+ Searching for Windows Change Events

+
+ + + + table time_group,adminuser,user,Change_Actions,$tok_tbl_res_flds$ +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",user as "Target_User",Change_Details as "Change Details",Change_Summary as "Change Summary" + + + + + + + + + + + +
+ +
+ + View Raw Events -

Click to open a new window with raw events for All Windows Change activities

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Windows Change Events found within Time Period (From: $set_time_from$ To: $set_time_to$) +
+

+ + Search Raw Events +

Click to search for All Windows Change activities

+
+ + + + Directory Record Changes - (From: $set_time_from$ To: $set_time_to$) + + + All + all + all + + eval type=admonEventType,trigger="$show_admon_results$"| stats count by type + + type + type + + + * + + + $value$ + + + + +
+

+ Searching for Directory Change Events

+
+ + + search admonEventType="$tok_admon_action$" + + + + + + + + + +
+ + View Raw Events -

Click to open a new window with raw admon events for All Admon Change activities

Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Admon Change Events found within Time Period (From: $set_time_from$ To: $set_time_to$) +
+

+ + Search Admon Events +

Click to search for All Admon Change activities:

+ +
    +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_reports.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_reports.xml new file mode 100644 index 00000000..008bd67a --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_ad_user_reports.xml @@ -0,0 +1,907 @@ +
+ + + `ms_obj_changes_base_cat("User")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) user_type!="computer" user_type!="system" +| `ms_obj_md_user_change_cmb("$tok_user_lkp$")` +| table time_group,adminuser,user,msad_action,dest_user_subject,Correlation_IDs,Change_Actions,Change_Summary,Change_Details +| eval domain="$tok_domain$" +| lookup $tok_user_lkp$ lookup_usr AS user, domain AS domain OUTPUT domain,whenChanged,userAccountControl,uac_details AS userAccountControl_Details,userPrincipalName,distinguishedName + $field3.earliest$ + $field3.latest$ + + + search msad_action="$tok_action$" +| fillnull value="" whenChanged,userAccountControl,userAccountControl_Details,userPrincipalName,distinguishedName +| eval chg_trigger="$tok_chg_trigger$" +| eval time_group_epoch=strptime(time_group,"%m/%d/%y %I:%M %P") +| eval whenChanged_epoch=strptime(whenChanged,"%I:%M.%S %P, %a %m/%d/%Y") +| stats max(time_group_epoch) AS l_time,max(whenChanged_epoch) AS whenChanged_epoch,count,values(userAccountControl_Details) AS userAccountControl_Details by user,userAccountControl,userPrincipalName,distinguishedName +| eval whenChanged=if(whenChanged=="",strftime(l_time,"%m/%d/%y %a %I:%M %P"),strftime(whenChanged_epoch,"%m/%d/%y %a %I:%M %P")) +| table user,whenChanged,userAccountControl,userAccountControl_Details,userPrincipalName,distinguishedName + + + + True + red + Warning: + 3. No Change Events for Selected Time Range. Adjust Time Range to view change results. + True + + + True + + True + green + Info: + 3. Adjust Time Range and 4. Select MSAD Action. + True + + + + + + $tok_report$($tok_user_lkp$,$tok_domain$,"$set_time_from$","$set_time_to$")` +| eval whenChanged=strftime(strptime(whenChanged,"%I:%M.%S %P, %a %m/%d/%Y"),"%m/%d/%y %a %I:%M %P") +| eval whenCreated=strftime(strptime(whenCreated,"%I:%M.%S %P, %a %m/%d/%Y"),"%m/%d/%y %a %I:%M %P") +| eval time_trigger="$tok_time_trigger$" + $field3.earliest$ + $field3.latest$ + + + + True + red + Warning: + 3. No $tok_time_label$ Events for Selected Time Range. Adjust Time Range to view $tok_time_label$ results. + + + True + green + Info: + 3. Adjust Time Range for $tok_time_label$. + True + + + + + + | makeresults +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName,dn\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`" +| eval filt_link="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| eval filt_link_admon="| search user_obj_lkp IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_obj$\",\"lookup_usr\",\"$tok_user_lkp$\",\"$tok_domain$\",\"$tok_sel_obj$\",\"cn,sAMAccountName,userPrincipalName,dn\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl,filt_link_admon + + + + + + + + `ms_obj_changes_base_cat_act("User","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| search user IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_user("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| eval user_obj_lkp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +| search user_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_link_admon$ + $result.filt_raw_text_lbl$ + `ms_obj_changes_base_cat_act("User","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| search user IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_user("$tok_dc_val$"),ms_obj_admon_base_a_type)` ([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","raw_txt")`]) +| eval user_obj_lkp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +| search user_obj_lkp IN([|`ms_obj_ss_filt_raw_link("$tok_sel_obj$","lookup_usr","$tok_user_lkp$","$tok_domain$","$tok_sel_obj$","cn,sAMAccountName,userPrincipalName","link")`]) + + + + + + | makeresults +| eval filt_active_start=relative_time(now(), "-$tok_active_days$d@d") +| eval filt_active_from=strftime(filt_active_start,"%m/%d/%Y") +| eval filt_active_search=if("$tok_report_label$"=="Active","where lastLogonTimestamp>".filt_active_start,"where lastLogonTimestamp<".filt_active_start) +| table filt_active_start,filt_active_from,filt_active_search + + + + + + + + $result.filt_active_start$ + $result.filt_active_from$ + $result.filt_active_search$ + + + + + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + search msad_action=$tok_action$ +$tok_filt_link$ + + + + + True + + + True + True + + + + + + + `ms_obj_admon_flt_obj_type(ms_obj_md_admon_user("$tok_dc_val$"),ms_obj_admon_base_a_type)` $tok_filt_raw_txt$ +| eval user_obj_lkp=if(isnull(cn),if(isnull(sAMAccountName),lower(dn),lower(sAMAccountName)),lower(cn)) +$tok_filt_link_admon$ + + + + + True + + + True + True + + + + $field3.earliest$ + $field3.latest$ + +
+ + + + + Select Domain... + sel + sel + + table domain | sort domain + + domain + domain + + + + + True + green + Info: + 1: Select the Target Domain to run the report against. + + + True + False + $value$ + True + green + Info: + 2: Select the Target Report from the "Select Report" dropdown. + + + + + + Select Report... + All Users + New Users + Unused + Deleted + Changed + Disabled + SmartCard Required + No SmartCard Required + Sensitive + Password Too Old + Password Not Required + Password Does Not Expire + Don't Expire + Expired Users + Not Managed + Active + Inactive + sel + sel + + + + + + + + + + + + + + + + $label$ + True + |`ms_obj_md_secrpt-all-users("$tok_user_lkp$","$tok_domain$")` + + + + + + + + + + + + + + $label$ + True + New Users + |`ms_obj_md_secrpt-new-users + True + created + created + Created + 4 + domain,user,whenCreated,userAccountControl,userAccountControl_Details,userPrincipalName,distinguishedName + + + + + + + + + + + + + $label$ + Enter Days Back for Last Login + True + + + True + True + green + Info: + 4. Enter Days Back for Last Login + + + + + + + + + + + + $label$ + True + True + Enter Days Since Last Login + True + green + Info: + 4. Enter Days Since Last Login + + + + + + + + + + + + $label$ + True + |`ms_obj_md_secrpt-unused-users($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + + $label$ + True + Deleted Users + |`ms_obj_md_secrpt-deleted-users + True + deleted + deleted + Deleted + 4 + domain,user,orig_cn,whenDeleted,userAccountControl_Details,userPrincipalName,distinguishedName + + + + + + + + + + + + + + + + + + + + $label$ + True + Disabled Users + | `ms_obj_md_secrpt-disabled-users + True + disabled + Disabled + 4 + domain,user,whenChanged,userAccountControl,userAccountControl_Details,userPrincipalName,distinguishedName + + + + + + + $label$ + True + | `ms_obj_md_secrpt-users-smartcard-required($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-users-no-smartcard-required($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-sensitive-users($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + $label$ + True + True + green + Info: + 4. Days Since Password Change + + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-users-that-dont-require-password($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-users-whose-password-doesnt-expire($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-users-that-dont-expire($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-expired-users($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + $label$ + True + | `ms_obj_md_secrpt-users-with-no-manager($tok_user_lkp$,$tok_domain$)` + + + + + + + + + + + + + + + + True + $label$ + True + all + * + All Changes + 5 + + + + + + + + + + -4h@m + now + + + + + strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p") + strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p") + + + + + All + + |stats count by msad_action +| eval label=case(msad_action="enabled","Enabled",msad_action="created","Created",msad_action="disabled","Disabled",msad_action="modified","Modified",msad_action="deleted","Deleted",msad_action="moved","Moved") +| eval label=if(isnull(label),msad_action,label) +| table msad_action,label +| sort msad_action + + * + * + label + msad_action + + + + + * + All Changes + + + + + + + $value$ + $label$ + + + + + + 30 + 30 + + + + 30 + 30 + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + WinEvent Summary + WinEvent Details + Admon Events + Change_Summary + Change_Summary + + + + True + Change_Summary + + + + True + Change_Details + + + + True + + + + +

+ + + $tok_res_message_state$ $tok_res_message$ + +

+ + + + + + + $tok_report_label$ - Users + + $tok_report$ + $field3.earliest$ + $field3.latest$ + + + + + + +
+ + $tok_report_label$ - Users - (From: $set_time_from$ To: $set_time_to$) + + | table $fields_time_rep$ + + + + + + + + + + True + $row.user$ + True + Change_Summary + Change_Summary + Change_Summary + True + True + green + Info: + 4. Select Event Result Type + +
+ +

+ + + Click on a User in the above table to view $tok_action_lbl$ Event Details. + +

+ + + $tok_report_label$ - Users - (From: $tok_active_from$ - $tok_active_days$ Days) + + | `ms_obj_md_secrpt_activity_users($tok_user_lkp$,$tok_domain$,"$tok_active_search$")` + + + + + +
+ + $tok_report_label$ - Users - (Password Older than $tok_pwd_old_days$ Days) + + | `ms_obj_secrpt-users-password-too-old($tok_domain$,$tok_user_lkp$,"$tok_pwd_old_days$")` + + + + + +
+ +

+ Info: The Active and Inactive Reports leverages the lastLogonTimestamp field in the $tok_user_lkp$ lookup. +
+

+

Since AD only captures the lastLogonTimestamp when the domain controller is locally logged on by the user, the value will be set to 0 for all other logons. To work around this you can follow the below steps to create a Scheduled Search to update the lastLogon and lastLogonTimestamp values in the $tok_usr_lkp$ to use Windows Successful Logon Events to update these field in the $tok_user_lkp$. +
    +
  • Note: You might need to adjust the Earliest and Cron Expression for your environment, depending on the amount of logon events.
    • +
+

+ + + + + + + +
+

Create a Scheduled Report to update User's Logon Timestamp in the $tok_user_lkp$ lookup using Windows Successful Logon Events:

+
+

Scheduled Report for updating User's Logon Timestamp in the $tok_user_lkp$ lookup using Windows Successful Logon Events:

+
    +
  • + Example Scheduled Report Settings +
      +
    • Title: AD_Obj_User_sedemo_Update_logon
      • +
    • Search: `ms_obj_upd_user_last_logon("$tok_user_lkp$","$tok_domain$")`
      • +
    • Earliest: -15m@m
      • +
    • Latest: now
      • +
    • App: MS Windows AD Objects
      • +
    +
    • +
  • + Scheduling Settings +
      +
    • Cron Expression: 06,16,26,36,46,56 * * * *
      • +
    +
    • +
+
+ + + Changed Users - $tok_action_lbl$ - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + + + + $row.user$ + True + Change_Summary + Change_Summary + Change_Summary + True + True + green + Info: + 5. Select Event Result Type + +
+ +

+ + + Click on a User in the above table to view $tok_action_lbl$ Event Details. + +

+ + + + + "$tok_sel_obj$" - $tok_action_lbl$ Change Events - (From: $set_time_from$ To: $set_time_to$) + + table time_group,adminuser,user,Change_Actions,$tok_tbl_res_flds$ +| rename time_group AS Time_Minute_Group,adminuser as "Administrator",user as "Target_User",Change_Details as "Change Details",Change_Summary as "Change Summary" + + + + + + + + + + + +
+ +
+ + View Raw Events -

Click to open a new window with raw events for All Windows Change activities with User ($tok_sel_obj$) within Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No $tok_action_lbl$ events found for User ($tok_sel_obj$) +
+

+ + Search Raw Events +

Click to search for All Windows Change activities with User:

+ +
    +
  • + User: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + + "$tok_sel_obj$" - admon Events - (From: $set_time_from$ To: $set_time_to$) + + + + + + + + + + +
+ + View Raw Events -

Click to open a new window with raw admon events for All Admon Change activities with User ($tok_sel_obj$) within Time Period (From: $set_time_from$ To: $set_time_to$)

+
+ + +
+

+ Warning: No Admon events found for User ($tok_sel_obj$) +
+

+ + Search Admon Events +

Click to search for All Admon Change activities with User:

+ +
    +
  • + User: $tok_sel_obj$
    • +
  • + From: $set_time_from$
    • +
  • + To: $set_time_to$
    • +
+ +
+ + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_change_overview.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_change_overview.xml new file mode 100644 index 00000000..b62b6e5c --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_change_overview.xml @@ -0,0 +1,173 @@ +
+ + + | tstats count FROM datamodel=MS_Windows_AD_Changes.ms_ad_obj_audit_changes WHERE nodename=ms_ad_obj_audit_changes BY ms_ad_obj_audit_changes.change_action, ms_ad_obj_audit_changes.change_category, ms_ad_obj_audit_changes.src_user +| rename ms_ad_obj_audit_changes.change_category AS Change_Category,ms_ad_obj_audit_changes.src_user AS Admin_User, ms_ad_obj_audit_changes.change_action AS Change_Action +| eval Admin_User=lower(Admin_User) +| table data_child, Change_Category, Admin_User, Change_Action,count + $field1.earliest$ + $field1.latest$ + 1 + +
+ + + + @d + now + + + + + Object Type + Change Action + Administrators + obj_type + obj_type + + + Object Type + change_category + Change_Category + True + + + + Change Action + change_action + Change_Action + True + + + + All Administrators + src_user + Admin_User + * + + + + + + + + + All + all + all + Admin_User + Admin_User + + stats count by Admin_User +| table Admin_User +| sort Admin_User + + + + * + + + + $value$ + (Admin - $value$) + + + +
+ + + + Group Changes + + search Admin_User="$tok_admin_sel$" Change_Category="Group" OR Change_Category="Group Membership"| stats sum(count) + + + + + + + User Changes + + search Admin_User="$tok_admin_sel$" Change_Category="User" | stats sum(count) + + + + + + + + Computer Changes + + search Admin_User="$tok_admin_sel$" Change_Category="Computer" | stats sum(count) + + + + + + + + Group Policy Changes + + search Admin_User="$tok_admin_sel$" Change_Category="Group Policy" | stats sum(count) AS count +| eval count=if(isnull(count),"No GPO Changes",count) + + + + + + + OU Changes + + search Admin_User="$tok_admin_sel$" Change_Category="OU" | stats sum(count) + + + + + + + + + + Total AD Changes by $tok_label$ $tok_user_label$ - Overall + + search Admin_User="$tok_admin_sel$" + | table $tok_ovr_srch$,count + | stats sum(count) AS Total_Changes by $tok_ovr_srch$ + | sort -Total_Changes + + + + + + + + + + + Total AD Changes by $tok_label$ $tok_user_label$ - Overtime + + | tstats count FROM datamodel=MS_Windows_AD_Changes.ms_ad_obj_audit_changes WHERE nodename=ms_ad_obj_audit_changes BY _time,ms_ad_obj_audit_changes.$tok_time_srch$,ms_ad_obj_audit_changes.src_user +| search ms_ad_obj_audit_changes.src_user="$tok_admin_sel$" +| rename ms_ad_obj_audit_changes.$tok_time_srch$ AS $tok_ovr_srch$ +| timechart span=1d count by $tok_ovr_srch$ + $field1.earliest$ + $field1.latest$ + + + + + + Total AD Changes by $tok_label$ - Overtime + + | tstats count FROM datamodel=MS_Windows_AD_Changes.ms_ad_obj_audit_changes WHERE nodename=ms_ad_obj_audit_changes BY _time,ms_ad_obj_audit_changes.$tok_time_admin_srch$ +| rename ms_ad_obj_audit_changes.$tok_time_admin_srch$ AS $tok_ovr_srch$ +| timechart span=1d count by $tok_ovr_srch$ + $field1.earliest$ + $field1.latest$ + + + + + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_changes.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_changes.xml new file mode 100644 index 00000000..0df4b27b --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_changes.xml @@ -0,0 +1,1293 @@ +
+ + + + + + + + + + + 0 + orange + 0 + orange + 0 + orange + 0 + orange + 0 + orange + 0 + orange + 0 + orange + + + | makeresults +| eval t_filt_s ="$main_Time.earliest$", t_filt_e="$main_Time.latest$" +| eval t_filt_s_f=case(match(t_filt_s,"^\d+$"),t_filt_s,t_filt_s="",0,match(t_filt_s,"^(\-|\@)"),relative_time(now(),t_filt_s)) +| eval t_filt_e_f=case(match(t_filt_e,"^\d+$"),t_filt_e,t_filt_e="",9999999999,match(t_filt_e,"^(\-|\@)"),relative_time(now(),t_filt_e),t_filt_e="now",now()) +| eval t_filt_s_l=if(t_filt_s_f=0,"0",strftime(t_filt_s_f,"%m/%d/%y %I:%M %P")) +| eval t_filt_e_l=if(t_filt_e_f=9999999999,"All Time",strftime(t_filt_e_f,"%m/%d/%y %I:%M %P")) +| eval t_filt_full_l=if(t_filt_e_f=9999999999,"All Time","From: ".strftime(t_filt_s_f,"%m/%d/%y %I:%M %P")." To: ".strftime(t_filt_e_f,"%m/%d/%y %I:%M %P")) +| table t_filt_s_f, t_filt_s_l,t_filt_e_f, t_filt_e_l,t_filt_full_l + + + $result.t_filt_s_f$ + $result.t_filt_e_f$ + $result.t_filt_s_l$ + $result.t_filt_e_l$ + $result.t_filt_full_l$ + + + + + | inputlookup AD_Obj_Admin_Audit WHERE [| `ms_obj_domain_list`| stats values(domain) AS admin_domain | format | table search] +| eval last_time_utc=tonumber(last_time_utc) +| search last_time_utc>$time_from_val$ +| eventstats values(admin_domain) AS domain_filt +| eval domain_filt="\"".mvjoin(domain_filt,"\",\"")."\"" +| table domain_filt,admin_domain,admin_user,last_time_string,last_time_utc + + + True + round(($job.doneProgress$*100),0) + $job.dispatchState$ + 0 + red + 0 + red + 0 + red + 0 + red + 0 + red + + + + + + + True + 0 + orange + 0 + orange + 0 + orange + 0 + orange + 0 + orange + + + + + + + + True + | inputlookup AD_Obj_Admin_Audit WHERE [| `ms_obj_domain_list`| stats values(domain) AS admin_domain | format | table search]| sort -last_time_utc + + + + + $result.domain_filt$ + + + + + | `ms_obj_domain_list` +| search domain IN($tok_domain_filt$) + + + + + + + True + True + + + + + + True + + + + True + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + + `ms_obj_$tok_start_logon_srch$("user")` $tok_domain$ ([|$tok_srch_admin_raw_filter$]) +| fields _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,dest_nt_domain,user,Logon_Type,host,status,Failure_Reason +| eval Failure_Reason=if(isnull(Failure_Reason),if(isnull(signature),"Unknown",signature),Failure_Reason) +| eval src_ip=if(isnull(src_ip) OR src_ip=="127.0.0.1" OR src_ip=="::1" OR src_ip="-","localhost",src_ip),src_nt_domain=if(isnull(src_nt_domain),upper(dest_nt_domain),upper(src_nt_domain)) +| eval src_nt_host=if(isnull(src_nt_host),if(isnull(srch_host),if(src_ip=="localhost",upper(host),upper(host)." (".src_ip.")"),upper(src_host)),replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| lookup AD_Audit_Logon_Types Logon_Type OUTPUT Logon_TypeName +| eval Logon_Type="[Type ID: ".Logon_Type." ] ".Logon_TypeName +| fillnull value="Not In Event" src_nt_host, src_ip,Logon_Type,src_nt_domain,status +| eval src_user=lower(user) +| stats values(src_nt_host) AS src_nt_host, count by src_ip,src_nt_domain,src_user,Logon_Type,status,Failure_Reason +| search src_user IN([|$tok_srch_admin_user_filter$]) +| eventstats sum(count) AS sess_count + $main_Time.earliest$ + $main_Time.latest$ + + + $job.dispatchState$ + blue + + + + + 0 + red + + + toString($result.sess_count$,"commas") + green + + + + + + `ms_obj_win_events_security` +[| inputlookup AD_Audit_Change_EventCodes WHERE change_category="User" OR change_category="Computer" OR change_category="Group" OR change_category="Group Membership" + | stats values(EventCode) AS EventCode by obj_type + | format + | table search] src_user_type="user" ([|$tok_srch_admin_raw_filter$]) +| fields _time,EventCode,comp_obj_dn,comp_obj_sam,group_obj_lkp,msad_action,dir_svcs_action,obj_type,signature,change_signature,src_nt_domain,dest_nt_domain,src_user,user,user_obj_lkp,user_obj_dn,user_type,AttributeLDAPDisplayName,AttributeValue,Correlation_ID,DN,MSADChangedAttributes,MSADChanges,MSADGroupClass,MSADGroupClassID,MSADGroupType,New_DN,Old_DN,change_category,member_obj_cn,member_obj_dn,member_obj_lkp,member_obj_id,member_obj_sam,Old_Account_Name,New_Account_Name +| lookup AD_Audit_Change_EventCodes EventCode AS EventCode,obj_type AS obj_type OUTPUT change_category +| eval member_obj_lkp=trim(member_obj_lkp) +| eval group_obj_val=if(obj_type="group",if(isnull(member_obj_lkp),if(isnull(group_obj_lkp),NULL,trim(group_obj_lkp)),member_obj_lkp),NULL) +| eval user_obj_lkp=if(obj_type="user" OR Class="user" OR objectClass=="user",if(isnull(New_Account_Name),if(isnull(user_obj_dn),if(isnull(DN),if(isnull(New_DN),lower(user),lower(New_DN)),lower(DN)),lower(user_obj_dn)),lower(New_Account_Name)),NULL) +| eval computer_obj_lkp=if(obj_type="computer" OR user_type="computer" OR Class="computer" OR objectClass=="computer",if(isnull(comp_obj_dn),if(isnull(comp_obj_sam),if(match(user,"\$$"),user,NULL),comp_obj_sam),comp_obj_dn),NULL) +| eval obj_val=mvappend(user_obj_lkp,group_obj_val,computer_obj_lkp) +| eval dir_svcs_action=if(isnull(dir_svcs_action),"Unknown",dir_svcs_action) +| eval adminuser=if(isnull(src_nt_domain),if(isnull(dest_nt_domain),src_user,dest_nt_domain."\\".src_user),src_nt_domain."\\".src_user) +| stats values(*) AS * by _time,adminuser,src_user,obj_val,msad_action,dir_svcs_action +| eval domain="$tok_domain$" +| search src_user IN([|$tok_srch_admin_user_filter$]) + + + active + + + + + + + + + + + $main_Time.earliest$ + $main_Time.latest$ + + + + + search obj_type="group" change_category!="Group Membership" +| `ms_obj_md_group_change_cmb("$tok_group_lkp$")` + + + $job.dispatchState$ + blue + + + + + 0 + red + + + + toString($job.resultCount$,"commas") + green + True + + + + + + search obj_type="group" change_category="Group Membership" +| `ms_obj_md_group_change_cmb("$tok_group_lkp$")` +| lookup $tok_group_lkp$ lookup_grp AS group,domain AS domain OUTPUT MSADGroupClass,MSADGroupType +| lookup $tok_user_lkp$ lookup_usr AS member_obj_lkp,domain AS domain OUTPUT cn AS u_cn +| lookup $tok_group_lkp$ lookup_grp AS member_obj_lkp,domain AS domain OUTPUT cn AS g_cn +| lookup $tok_computer_lkp$ lookup_cmp AS member_obj_lkp,domain AS domain OUTPUT cn AS c_cn +| eval member=if(isnull(u_cn),if(isnull(g_cn),if(isnull(c_cn),member_obj_lkp,mvdedup(c_cn)),mvdedup(g_cn)),mvdedup(u_cn)) + + + + $job.dispatchState$ + blue + + + + + 0 + red + + + + toString($job.resultCount$,"commas") + green + True + + + + + + search obj_type="user" change_category="User" +| `ms_obj_md_user_change_cmb("$tok_user_lkp$")` + + + $job.dispatchState$ + blue + + + + + 0 + red + + + + toString($job.resultCount$,"commas") + green + True + + + + + + search obj_type="Computer" change_category="Computer" +| `ms_obj_md_computer_change_cmb("$tok_computer_lkp$")` +| lookup $tok_computer_lkp$ lookup_cmp AS comp_obj_lkp,domain AS domain OUTPUT cn,sAMAccountName,orig_cn,dn,lookup_cmp +| eval computer_obj_lkp=if(isnull(orig_cn) OR orig_cn="",if(isnull(sAMAccountName) OR sAMAccountName="",if(isnull(cn) OR cn="",lower(comp_obj_lkp),lower(cn)),lower(sAMAccountName)),lower(orig_cn)) +| table time_group,adminuser,computer_obj_lkp,msad_action,Correlation_IDs,Change_Actions,Change_Summary,Change_Details,lookup_cmp + + + $job.dispatchState$ + blue + + + + + 0 + red + + + + toString($job.resultCount$,"commas") + green + True + + + + + + | inputlookup $tok_group_lkp$ WHERE dn="$tok_group$" AND domain="$tok_domain$" +| fields cn,dn,member +| rename cn AS Group,dn AS Group_DN +| rename member AS dn +| mvexpand dn +| table Group,Group_DN,dn + + + stats values(admin_user_filt_val) AS admin_user_filt_val by Group_dn +| eval domain="$tok_domain$" +| lookup $tok_group_lkp$ dn AS Group_dn,domain AS domain OUTPUT cn AS Group_cn,groupType,groupType_Name +| eval admin_user_filter=mvjoin(admin_user_filt_val,"|") +| table admin_user_filter,Group_dn,Group_cn,groupType,groupType_Name + + + $tok_base_info_srch$ +| table * + + + table objectGUID,cn,domain,distinguishedName,description,displayName,IsDeleted,IsRecycled,objectSid,sAMAccountName,whenChanged,whenCreated,last_time_utc + + $result.cn$ + $result.domain$ + $result.distinguishedName$ + $result.distinguishedName$ + $result.description$ + $result.displayName$ + $result.isDeleted$ + $result.isRecycled$ + $result.objectSid$ + $result.sAMAccountName$ + $result.whenChanged$ + $result.whenCreated$ + + + + | inputlookup AD_Obj_Admin_Audit WHERE admin_domain="$tok_domain$" +| lookup $tok_user_lkp$ lookup_usr AS admin_user,domain AS admin_domain OUTPUT description,displayName,isRecycled,isDeleted,objectSid,whenChanged,whenCreated,objectGUID AS admin_objectGUID,cn AS admin_cn,dn AS admin_dn +| lookup $tok_group_lkp$ member AS admin_dn,domain AS admin_domain OUTPUT dn AS Group_dn +| eval IsDeleted=if(IsDeleted=="TRUE" OR IsRecycled=="TRUE","TRUE","FALSE") +| eval admin_user_filt_val=admin_user +| eval admin_user_filt_val="\"".mvjoin(mvappend(admin_user_filt_val,admin_dn,admin_userPrincipalName),"|")."\"" +| table admin_domain,admin_user, admin_objectGUID, admin_cn,admin_dn,last_time_string,last_time_utc,description,displayName,isRecycled,isDeleted,objectSid,whenChanged,whenCreated,objectGUID,Group_dn,admin_user_filt_val + + + + makemv delim="|" objectClass +| makemv delim="####" dSCorePropagationData +| makemv delim=" " userAccountControl +| fields * + +
+
+ + + + + + @d + now + + + + + Select Domain... + sel + sel + + sort domain + + domain + domain + + + + + + + + + + + + admin_search + admin_search + green + Info: + 1: Select the AD Domain for the target Administrators + + + + + + + + + + $value$ + $value$ + admin_search + admin_search + true + sel + sel + green + Info: + 2: Select how you would like to search for admin changes, by either admin group, or specific admin. + + + + + + By Admin + By Group + + + + + + + + + + + all + all + True + sel + sel + AD Object Details Description for + 0 + orange + 0 + 0 + 0 + 0 + green + Info: + 3 + 4: Select Group Type to filter the Group List, and then Select the Admin Group to search for changes made by its members. + + + + + + + + + + + True + sel + sel + AD Object Details Description for + 0 + orange + 0 + 0 + 0 + 0 + green + Info: + 3: Select a Specific Admin to search for changes made by them. + + + + + + All + + stats count by groupType_Name | sort groupType_Name + + groupType_Name + groupType_Name + all + all + + + sel + sel + * + + + sel + sel + $value$ + + + + + + + search groupType_Name="$tok_group_type$" |table Group_cn,Group_dn | sort Group_cn + + Select Admin Group + Group_cn + Group_dn + True + + + + + + + + + + + + + True + + + + + + + + + Change_Summary + Change_Summary + Change_Summary + Change_Summary + all + all + all + all + all + active + | inputlookup $tok_group_lkp$ WHERE dn="$value$" | lookup AD_Obj_Group member AS dn OUTPUT dn AS memberOf + $value$ + $label$ + $label$ + Admins - In Group ($label$) + `ms_obj_aa_filt_by_groupm_in("$tok_domain$","dn","$value$","cn,sAMAccountName,userPrincipalName","$tok_user_lkp$","$tok_group_lkp$")` + `ms_obj_aa_filt_by_groupm_raw("$tok_domain$","dn","$value$","cn,sAMAccountName,userPrincipalName","$tok_user_lkp$","$tok_group_lkp$")` + _changes_base + failed_success_logons + + + + + + + eval admin_cn="[".admin_user."] ".admin_cn + | stats count by admin_cn,admin_dn + | sort admin_cn + + Select Admin... + admin_cn + admin_dn + sel + sel + + + + + + + + + + + + + + `ms_obj_aa_filt_by_admin_in("$tok_domain$","dn","$value$","cn,sAMAccountName,userPrincipalName","$tok_user_lkp$")` + `ms_obj_aa_filt_by_admin_raw("$tok_domain$","dn","$value$","cn,sAMAccountName,userPrincipalName","$tok_user_lkp$")` + _changes_base + failed_success_logons + True + Change_Summary + Change_Summary + Change_Summary + Change_Summary + all + all + all + all + all + + + + + + + + + active + | inputlookup $tok_user_lkp$ WHERE dn="$value$" AND domain="$tok_domain$"| lookup $tok_group_lkp$ member AS dn OUTPUT dn AS memberOf + $value$ + $label$ + $label$ + Admin - ($label$) + + + + +

+ + + $tok_message_state$: $tok_message$. + + +

+ + + + + + Administrator Changes from $time_from_string$ to $time_to_string$ + + + + + + + + +

+ Warning - No updated admin changes in the selected time period ($time_from_string$ to $time_to_string$), adjust the time period to search for administrative changes, or view the below options. +

+
    +
  • +

    + Troubleshooting Options: +

    +
  • + + Review AD_Obj_Admin_Audit lookup: + +
  • + + Click Here to view the lookup table that contains the list of administrators who have made AD Object Changes, and the time of their last AD change. + +
    • + + + +
  • + + Update AD_Obj_Admin_Audit lookup with the most recent changes: + +
  • + If you believe there has either been administrative changes made in the last 30 minutes, or there were administrative changes made during the time period you selected, then Click Here to update the AD_Obj_Admin_Audit lookup with the latest administrator changes. +
    • +
  • + By default this lookup is scheduled to update every 30 minutes. You can also adjust the time to update the lookup with older time periods. +
    • + + + + +
+ + + + + + +

$tab_active_desc$ - + $tok_audit_value_label$ + +

+

+ Use the Tabbed views to analyze the Group Membership, AD Attributes, and Group/User/Computer/GPO Change history for - $tok_audit_value_label$. +

+ + + + table cn,domain,distinguishedName,description,displayName,IsDeleted,IsRecycled,objectSid,sAMAccountName,whenChanged,whenCreated,last_time_utc +| eval last_time_utc=strftime(last_time_utc,"%I:%M:%S %P, %A %m/%d/%y") +| rename cn AS "Common Name", domain AS "Domain", distinguishedName AS "Distinguished Name", description AS "Description:", displayName AS "Display Name:", IsDeleted AS "Is Deleted:", IsRecycled AS "Is Recycled:" , objectSid AS "Object SID:", sAMAccountName AS "User Account:", whenChanged AS "When Changed:", whenCreated AS "When Created:",last_time_utc AS "Last Administrative Action Time" +| transpose +| sort column +| rename column AS "AD Field", "row 1" AS "Value" + + + + + + +
+ + + + + + $tok_group_name$ - Group Membership - User Accounts + + join dn [|inputlookup $tok_user_lkp$ WHERE domain="$tok_domain$"| fields dn,cn,sAMAccountName,domain | table dn,cn,sAMAccountName,domain] +| sort domain,cn, sAMAccountName +| table domain,cn, sAMAccountName +| rename cn AS Member, sAMAccountName AS "Member_Account", domain AS "Member_Domain", + + + + + + +
+ + + + $tok_group_name$ - Group Membership - Embedded Groups + + join dn [|inputlookup $tok_group_lkp$ WHERE domain="$tok_domain$" | fields dn,cn,sAMAccountName,domain | table dn,cn,sAMAccountName,domain] +| table domain,cn, sAMAccountName +| sort domain,cn, sAMAccountName +| rename cn AS Member, sAMAccountName AS "Member Account", domain AS "Member Domain", + + + + + + +
+ + + + $tok_group_name$ - Group Membership - Computers + + join dn [|inputlookup $tok_computer_lkp$ WHERE domain="$tok_domain$" | fields dn,cn,sAMAccountName,domain | table dn,cn,sAMAccountName,domain] +| sort domain,cn, sAMAccountName +| table domain,cn, sAMAccountName +| rename cn AS Member, sAMAccountName AS "Member Account", domain AS "Member Domain", + + + + + + +
+ + + + Group Membership for Admin ($tok_desc_sAMAccountName$) + + search admin_dn="$tok_user$" +| lookup $tok_group_lkp$ dn AS Group_dn,domain AS admin_domain OUTPUT cn AS Group_cn,description AS Group_description +| table Group_cn,Group_dn,Group_description +| sort Group_cn +| rename Group_cn AS "Group Name", Group_description AS "Group Description", Group_dn AS "Group DN" + + + + + + +
+ + + + + AD Object LDAP View + +
+ + + + + + Successful Login Details: + + Successful Logins from $tok_admin_type_label$ by Account + + where status="success" +| stats sum(count) AS count by src_user,src_nt_domain +| eventstats sum(count) AS total_count +| sort -count +| rename src_user as "Admin Username", src_nt_domain as "Domain", count as "Total Logins" + + "Admin Username","Domain","Total Logins" + + + + + +
+ + Successful Logins from $tok_admin_type_label$ by Source System + + where status="success" +| stats sum(count) AS count by Logon_Type,src_nt_host, src_ip, src_user +| sort -count +| appendpipe [|stats sum(count) AS src_ip_cnt by src_ip,src_user] +| appendpipe [|stats sum(count) AS src_nt_host_cnt by src_nt_host,src_user] +| appendpipe [|stats sum(count) AS logon_type_cnt by Logon_Type,src_user] +| eval src_nt_host_summary=src_nt_host." (".src_nt_host_cnt.")" +| eval logon_type_summary=Logon_Type." (".logon_type_cnt.")" +| eval src_ip_summary=src_ip." (".src_ip_cnt.")" +| stats sum(count) AS Total_Logins, list(src_nt_host_summary) AS src_nt_host_summary, list(src_ip_summary) AS src_ip_summary, list(logon_type_summary) AS logon_type_summary by src_user +| table src_user, src_nt_host_summary, src_ip_summary, logon_type_summary, Total_Logins +| sort -Total_Logins +| rename src_user AS "Admin User",src_nt_host_summary as "Workstation Summary",src_ip_summary as "IP Address Summary", logon_type_summary AS "Logon Type Summary",Total_Logins as "Total Logins" + + + + + + +
+ + Successful Logins from $tok_admin_type_label$ by Source System + + where status="success" +| stats sum(count) AS count by src_user,src_nt_host, src_ip +| sort -count +| rename user AS "Admin User",src_nt_host as "Workstation",src_ip as "IP Address", count as "Total Logins" + + + + + + +
+ + + Failed Login Details: + + Failed Logins from $tok_admin_type_label$ by Account + + where status="failure" +| stats sum(count) AS count by src_user,src_nt_domain,Failure_Reason +| eval Failure_Reason="(".count.") ".Failure_Reason +| sort -count +| stats list(Failure_Reason) AS Failure_Reason,sum(count) AS Total_Attempts by src_user,src_nt_domain +| sort -Total_Attempts +| rename src_user as "Admin Username", src_nt_domain as "Domain", Total_Attempts as "Total Attempts", Failure_Reason as "Failure Reason" + + "Admin Username","Domain","Total Attempts","Failure Reason" + + + + + +
+ + Failed Logins from $tok_admin_type_label$ by Source System + + where status="failure" +| stats sum(count) AS count by Logon_Type,src_nt_host, src_ip, src_user +| sort -count +| appendpipe [|stats sum(count) AS src_ip_cnt by src_ip,src_user] +| appendpipe [|stats sum(count) AS src_nt_host_cnt by src_nt_host,src_user] +| appendpipe [|stats sum(count) AS logon_type_cnt by Logon_Type,src_user] +| eval src_nt_host_summary=src_nt_host." (".src_nt_host_cnt.")" +| eval logon_type_summary=Logon_Type." (".logon_type_cnt.")" +| eval src_ip_summary=src_ip." (".src_ip_cnt.")" +| stats sum(count) AS Total_Attempts, list(src_nt_host_summary) AS src_nt_host_summary, list(src_ip_summary) AS src_ip_summary, list(logon_type_summary) AS logon_type_summary by src_user +| table src_user, src_nt_host_summary, src_ip_summary, logon_type_summary, Total_Attempts +| sort -Total_Attempts +| rename src_user AS "Admin User",src_nt_host_summary as "Workstation Summary",src_ip_summary as "IP Address Summary", logon_type_summary AS "Logon Type Summary",Total_Attempts as "Total Attempts" + + + + + + +
+ + Failed Logins from $tok_admin_type_label$ by Source System + + where status="failure" +| stats sum(count) AS count by src_user,src_nt_host, src_ip +| sort -count +| rename user AS "Admin User",src_nt_host as "Workstation",src_ip as "IP Address", count as "Total Attempts" + + + + + + +
+ + + + + + + WinEvent Summary + WinEvent Details + Change_Summary + Change_Summary + + + + All + + stats count by group | eval group_label=group." (".tostring(count,"commas").")"| sort group + + group_label + group + all + all + + + + + + search group="$value$"| + + + + + + + + + Group Changes by $tok_admin_type_label$ $tok_group_res_tp$ + + $tok_filt_group$ table time_group,domain,adminuser,group,MSADGroupClass,MSADGroupType,$tok_group_res_tp$ +| eval domain="$tok_domain$" +| lookup $tok_group_lkp$ lookup_grp AS group,domain AS domain OUTPUT MSADGroupClass,MSADGroupType +| rename adminuser as "Admin User",msad_action as "Action", group as "Target Group",MSADGroupClass as "GroupClass",MSADGroupType as "GroupType",Change_Summary as "Change Summary",Change_Details as "Change Details" + + + + + + +
+ + + + + + + WinEvent Summary + WinEvent Details + Change_Summary + Change_Summary + + + + All + + stats count by group | eval group_label=group." (".tostring(count,"commas").")"| sort group + + group_label + group + all + all + + + + + + search group="$value$"| + + + + + + All + + stats count by member | eval member_label=member." (".tostring(count,"commas").")" | sort member + + member_label + member + all + all + + + + + + search member="$value$"| + + + + + + + + + Group Membership Changes by $tok_admin_type_label$ + + $tok_filt_m_group$ $tok_filt_member$ table time_group,adminuser,group,msad_action,MSADGroupType,MSADGroupClass,member,$tok_group_m_res_tp$ +| rename group as "Target Group",MSADGroupClass as "GroupClass",msad_action AS "Action",member AS "Target Member",MSADGroupType as "GroupType",adminuser as "Admin User",Change_Summary as "Change Summary",Change_Details as "Change Details" + + + $job.dispatchState$ + blue + + + + + 0 + red + + + toString($job.resultCount$,"commas") + green + + + + + + + + +
+ + + + + + + WinEvent Summary + WinEvent Details + Change_Summary + Change_Summary + + + + All + + stats count by user | sort user | eval user_label=user." (".tostring(count,"commas").")" + + user_label + user + all + all + + + + + + search user="$value$"| + + + + + + + + + User Account Changes by $tok_admin_type_label$ + + $tok_filt_user$ table time_group,adminuser,user,msad_action,dest_user_subject,Change_Actions,$tok_user_res_tp$ +| rename msad_action as "Action",user as "Target User",dest_user_subject as "Target User ID",adminuser as "Admin User",Change_Summary as "Change Summary",Change_Details as "Change Details" + + + + + + +
+ + + + + + + WinEvent Summary + WinEvent Details + Change_Summary + Change_Summary + + + + All + + stats count by computer_obj_lkp | sort computer_obj_lkp | eval computer_obj_lkp_label=computer_obj_lkp." (".tostring(count,"commas").")" + + computer_obj_lkp_label + computer_obj_lkp + all + all + + + + + + search computer_obj_lkp="$value$"| + + + + + + + + + + Computer Account Changes by $tok_admin_type_label$ + + $tok_filt_comp$ table time_group,adminuser,computer_obj_lkp,msad_action,Correlation_IDs,Change_Actions,lookup_cmp,$tok_comp_res_tp$ +| rename msad_action as "Action",computer_obj_lkp as "Target Computer",lookup_cmp as "Target Computer ID",adminuser as "Admin User",Change_Summary as "Change Summary",Change_Details as "Change Details" + + + + + + +
+ + + + + + Group Policy Changes by $tok_admin_type_label$ + + `ms_obj$tok_start_chg_srch$_cat("Group Policy")` (src_nt_domain="$tok_domain$" OR dest_nt_domain="$tok_domain$") ([|$tok_srch_admin_raw_filter$]) +| fields _time, session_id, src_nt_domain, src_user,Object_Name_Guid,displayName,dir_svcs_action,AttributeLDAPDisplayName,AttributeValue,MSADChangedAttributes,Correlation_ID,signature,msad_action,Old_DN,New_DN +| fillnull value="NA" Correlation_ID,msad_action +| search src_user IN([|$tok_srch_admin_user_filter$]) +| eval adminuser=if(isnull(src_nt_domain),src_user,src_nt_domain."\\".src_user) +| eval Object_Lookup_Name="{".lower(Object_Name_Guid)."}" +| `ms_obj_msad-changed-attributes` +| stats max(_time) AS last_time, min(_time) AS start_time,list(MSADChanges) AS MSADChanges,values(Correlation_ID) AS Correlation_IDs by session_id,Object_Lookup_Name,adminuser,signature,msad_action +| eval signature=mvdedup(signature) +| join type=left Object_Lookup_Name [| inputlookup AD_Obj_GPO WHERE domain="$tok_domain$" | fields cn, displayName | eval Object_Lookup_Name=trim(lower(cn)) | table Object_Lookup_Name, displayName] +| eval displayName=if(isnull(displayName),"Warning GPO Not Found In Lookup(".Object_Lookup_Name.")",displayName) +| eval MSADChanges=mvjoin(MSADChanges, "########") +| eval MSADChanges=case(isnull(signature) AND isnull(MSADChanges),"Unknown Changes",isnull(signature),MSADChanges,isnotnull(MSADChanges),"Signature: ".signature."########".MSADChanges) +| eval SessionTime="Session ID (".session_id.")|Start: ".strftime(start_time,"%m/%d/%y %I:%M:%S %P")."|End: ".strftime(last_time,"%m/%d/%y %I:%M:%S %P") +| table SessionTime,adminuser,msad_action,displayName,Correlation_IDs,MSADChanges +| makemv delim="########" MSADChanges +| makemv delim="|" Session_Time +| rename adminuser as "Admin User",msad_action as "Action",displayName as "GPO Name",MSADChanges as "Changes" + $main_Time.earliest$ + $main_Time.latest$ + + + $job.dispatchState$ + blue + + + + + 0 + red + + + toString($job.resultCount$,"commas") + green + + + + SessionTime,"Admin User",Action,"GPO Name",Changes + + + + + +
+ + + + + + Organizational Unit Changes by $tok_admin_type_label$ + + `ms_obj$tok_start_chg_srch$_cat("OU")` (src_nt_domain="$tok_domain$" OR dest_nt_domain="$tok_domain$") ([|$tok_srch_admin_raw_filter$]) +| fields _raw,_time,chg_gp_guid,dir_svcs_action,signature,LDAP_Display_Name,gpo_name,ou_obj_dn,DN,Old_DN,New_DN,Correlation_ID,Value,LDAP_Display_Name,chg_gp_guid,src_user,src_nt_domain,EventCode,msad_action +| eval domain="$tok_domain$" +| search src_user IN([|$tok_srch_admin_user_filter$]) +| eval dest_ou_dn=if(isnull(New_DN),DN,New_DN),adminuser=if(isnull(src_nt_domain),lower(src_user),src_nt_domain."\\".lower(src_user)) +| rex field=dest_ou_dn "(?i)ou\=(?<ou_name>[^\,]+)" +| rex field=Value max_match=0 "\{(?<chg_gp_guid>[^\}]+)" +| fillnull value="NA" chg_gp_guid,dir_svcs_action,signature,LDAP_Display_Name,gpo_name,DN,Old_DN,New_DN,Correlation_ID +| mvexpand chg_gp_guid +| eval gpo_link=if(LDAP_Display_Name=="gPLink",lower(chg_gp_guid),"") +| eval Value=if(isnull(Value),lower(AttributeValue),lower(Value)) +| lookup AD_Obj_GPO gpo_link, domain AS domain OUTPUT displayName AS gpo_name +| eval mod_summary=if(LDAP_Display_Name=="gPLink" AND isnotnull(gpo_name),"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name."| - Target Linked GPO: ".gpo_name."| - Target Linked GPO ID: ".chg_gp_guid,"| - Action: ".dir_svcs_action."| - Target Attribute: ".LDAP_Display_Name."| - Target Attribute Value: ".Value) +| eval chg_summary=case(EventCode=5137,"OU Created:| - Event Correlation ID: ".Correlation_ID."| - DN: ".DN,EventCode=5138,"OU Undeleted:| - Event Correlation ID: ".Correlation_ID." - ",EventCode=5139,"OU Moved:| - Event Correlation ID: ".Correlation_ID."| - From: ".Old_DN."| - To: ".New_DN,EventCode=5141,"OU Deleted:| - Event Correlation ID: ".Correlation_ID,EventCode=5136 OR EventCode=4662,"OU Modified: | - Event Correlation ID: ".Correlation_ID."|".mod_summary) +| table _time,adminuser,msad_action,ou_name,dest_ou_dn,EventCode,signature,chg_summary +| stats values(*) AS * by _time,adminuser,ou_name,msad_action +| makemv delim="|" chg_summary +| rename msad_action AS "Action",adminuser AS "Admin User",ou_name AS OU,dest_ou_dn AS "OU DN",chg_summary AS "Changes" + $main_Time.earliest$ + $main_Time.latest$ + + + $job.dispatchState$ + blue + + + + + 0 + red + + + toString($job.resultCount$,"commas") + green + + + + _time,"Admin User",Action,OU,"OU DN",Changes + + + + + +
+ + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_changes_lookup.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_changes_lookup.xml new file mode 100644 index 00000000..8a088fe8 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_audit_changes_lookup.xml @@ -0,0 +1,191 @@ +
+ + This dashboard displays the list of EventCodes, AD Target Object Type, and AD Change Type. This lookup is leveraged by the all of the AD Change dashboards within this application. + + | inputlookup AD_Audit_Change_EventCodes +| table change_category, change_action,EventCode, obj_type, signature +| sort change_category,EventCode +| search change_category="*" change_action="*" obj_type="*" EventCode="*" +| join type=left obj_type, EventCode[| tstats count FROM datamodel=MS_Windows_AD_Changes.ms_ad_obj_audit_changes WHERE nodename=ms_ad_obj_audit_changes BY ms_ad_obj_audit_changes.change_action, ms_ad_obj_audit_changes.change_category, ms_ad_obj_audit_changes.obj_type, ms_ad_obj_audit_changes.EventCode +| rename ms_ad_obj_audit_changes.obj_type AS obj_type,ms_ad_obj_audit_changes.change_category AS change_category,ms_ad_obj_audit_changes.change_action AS change_action, ms_ad_obj_audit_changes.EventCode AS EventCode, count AS EventCount +| stats sum(count) AS count by change_category,change_action,EventCode,EventCount,obj_type] +| eval msad_action=lower(change_action) +| eval Found_Events=if(isnull(EventCount),0,EventCount) +| sort -Found_Events, change_category, EventCode +| table Found_Events,change_category, change_action,EventCode,signature,obj_type,msad_action + $field1.earliest$ + $field1.latest$ + + + +
+ + + + -24h@h + now + + + + + All + All + All + change_category + change_category + + search change_action="$tok_filt_change_action$" EventCode="$tok_filt_event_code$" +| table change_category +| dedup change_category +| sort change_category + + + + * + * + + + user + User + + + group + Group + + + group + Group Membership + + + computer + Computer + + + groupPolicyContainer + Group Policy + + + organizationalUnit + OU + + + + + + + + + + All + * + * + change_action + change_action + + search change_category="$tok_filt_change_type$" obj_type="$tok_filt_obj_type$" EventCode="$tok_filt_event_code$" +| table change_action +| dedup change_action +| sort change_action + + + + + + + + + + + All + * + * + EventCode + EventCode + + search change_action="$tok_filt_change_action$" change_category="$tok_filt_change_type$" obj_type="$tok_filt_obj_type$" +| table EventCode +| dedup EventCode +| sort EventCode + + + + + + + + +
+ + + AD_Audit_Change_EventCodes Lookup Table + + + search change_category="$tok_filt_change_type$" change_action="$tok_filt_change_action$" obj_type="$tok_filt_obj_type$" EventCode="$tok_filt_event_code$" +| eval msad_action=lower(change_action) +| table Found_Events, change_category, change_action,EventCode, signature,obj_type, msad_action +| sort -Found_Events, change_category,EventCode + + + + + + + + + + [#D93F3C,#65A637] + 1 + + + $row.EventCode$ + $row.signature$ + $row.obj_type$ + $row.msad_action$ + case($row.obj_type$=="user","NOT user",$row.obj_type$=="computer","user",$row.obj_type$=="group","NOT src_user",$row.obj_type$=="groupPolicyContainer","NOT src_user",$row.obj_type$=="organizationalUnit","NOT src_user") + case($row.obj_type$=="user" AND $tok_chg_type$="Moved","cn",$row.obj_type$=="user" AND $tok_chg_type$!="moved","user",$row.obj_type$=="computer" AND $tok_chg_type$!="moved","user",$row.obj_type$=="computer" AND $tok_chg_type$="moved","cn",$row.obj_type$=="group" AND $tok_chg_type$!="moved","user_group",$row.obj_type$=="group" AND $tok_chg_type$="moved","cn",$row.obj_type$=="groupPolicyContainer","Object_Name_Guid",$row.obj_type$=="organizationalUnit" AND $tok_chg_type$!="moved","distinguishedName",$row.obj_type$=="organizationalUnit" AND $tok_chg_type$="moved","cn") + case($row.obj_type$=="User" OR $row.obj_type$=="user","User",$row.obj_type$=="computer","Computer",$row.obj_type$=="group","Group",$row.obj_type$=="groupPolicyContainer","Group_Policy_GUID",$row.obj_type$=="organizationalUnit","OU") + +
+ +

+

+ + Click a row above to view the count of events for the EventCode and obj_type. + +
+

+ + + + + + +

+

AD Change Events for selected obj_type ( + $tok_obj_type$ + ) and EventCode + $tok_event_code$ + ($tok_event_desc$)
+

+ + + + `ms_obj_win_events_security` EventCode="$tok_event_code$" obj_type="$tok_obj_type$" (src_user_type="user") +| `ms_obj_msad-changed-attributes` +| eval MSADChanges=if(isnull(MSADChanges) OR MSADChanges="",signature,MSADChanges) +| table _time, EventCode, obj_type, src_user, $tok_group_by$,MSADChanges +| rename $tok_group_by$ AS $tok_rename_to$ + $field1.earliest$ + $field1.latest$ + + + + + + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_ratio.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_ratio.xml new file mode 100644 index 00000000..158202b3 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_ratio.xml @@ -0,0 +1,984 @@ +
+ + + True + + + + + + 50 + 600 + green + Info: + 1: Select the Domain Status of the user. + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + active + + + + | makeresults +| eval d_st_type="$tok_user_domain_acct_bs$" +| eval dom_stat=case(d_st_type=="all","",d_st_type=="False","(Sub_Status=0xC0000064 OR Error_Code=0xC0000064)",d_st_type=="True","NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064") + + + $result.dom_stat$ + + + + | `ms_obj_domain_list` + + + search domain="$tok_domain_ad_user$" +| eval dom_lkp_srch_trigger="$show_dom_acc$" +| eval tok_lkp_filt=if(multi_lkps_enabled=="t","User_".kv_suffix,"User") + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + User + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.tok_lkp_filt$ + + + + + + | `ms_obj_ss_filt_pre_lkp("$tok_user_lkp$","$tok_domain_ad_user$","$tok_user_filter$","cn,sAMAccountName,userPrincipalName","domain,cn,sAMAccountName,userPrincipalName,dn,_key")` +| eval dom_srch_trigger="$tok_tgr_bs_dom_user$",key_val=_key + + + + + | fields +| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)` +| eval show_bypass_option=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"true","false") +| eval show_user_list=if(count>=$tok_bypass_min$,"false","true") +| eval inp_usr_lst_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"7","6") +| eval inp_post_filt_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"8","7") +| eval msg_state=if(count>=$tok_bypass_min$,"Warning","Info") +| eval msg_color=if(count>=$tok_bypass_min$,"red","green") +| eval msg=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Either update the \"Filter User\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow Search Possible).",if(count>=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Update the \"Filter User\" to reduce the matching count.",inp_usr_lst_nmb.": (".count." Users) Either select a individual matching user account or \"All\" from the \"Select User\" input.")) + + + + if($result.show_bypass_option$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + $result.count$ + $result.inp_usr_lst_nmb$ + $result.msg_color$ + $result.msg_state$ + $result.msg$ + $result.inp_post_filt_nmb$ + + + + $result.count$ + true + + + + + | makeresults | eval tok_tgr_post_check="$tok_tgr_post_check$",dom_srch_trigger="$tok_tgr_bs_dom_user$",count=$tok_filt_user_cnt$ + + + + + + + red + Warning: + 5: No Users found matching the "Filter User" ($tok_user_filter$) entry. Update the "Filter User" to return values. Note: You can use wildcards, (ex. al*), however you cannot enter only a * to search for all. + + + + + + eval trigger_sub_user_list="$tok_tgr_sub_user_list$" +| eval label=if(isnull(cn),sAMAccountName." (".domain." )",cn." (".domain." )") +| stats count by label,key_val +| sort label + + + + | makeresults +| eval exec_trigger="$tok_tgr_sub_user_list$" +| eval filt_link_add="| join type=left Logon_User [|inputlookup $tok_user_lkp$ WHERE [|`ms_obj_ss_filt_pre_base(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\")`] | eval Logon_User=cn.\"|\".sAMAccountName.\"|\".userPrincipalName | makemv delim=\"|\" Logon_User | stats values(uac_details) AS uac_details by Logon_User | eval uac_details=mvjoin(uac_details,\":\")| table Logon_User, uac_details] +| eval uac_details=if(isnull(uac_details),\"Not Available\",uac_details) +| makemv delim=\":\" uac_details" +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`" +| eval filt_link="| search Logon_User IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl + + + + + + + + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_raw_text_lbl$ + + + + + + | makeresults +| eval non_dom_filt_srch_trigger="$tok_tgr_sub_non_dom_logon_filt$" +| eval filt_raw_text=if(match("$tok_user_filter$","^\*$$"),"","\"$tok_user_filter$\"") +| eval filt_link=if(match("$tok_user_filter$","^\*$$"),"","| search Logon_User=\"$tok_user_filter$\"") +| eval filt_link_r_evt=if(match("$tok_user_filter$","^\*$$"),"","| search user=\"$tok_user_filter$\"") +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt + + + + + + + + + + $result.filt_raw_text$ + $result.filt_link$ + + $result.filt_link_r_evt$ + + + + + + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ +| fields user, status, _time, host,src_ip,src_nt_host,src_nt_domain,dest_nt_domain,signature,Failure_Reason,Logon_Type,session_id,Sub_Status,Error_Code +| eval exec_logon_srch_trigger="$tok_tgr_bs_login_search$" +| eval Domain_Account=if(match(Sub_Status,"(?i)0xc0000064") OR match(Error_Code,"(?i)0xc0000064"),"Non_Domain_Account","Domain_Account") +| eval Logon_User=lower(user),status=if(status=="denied","failure",status) +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####")) +| eval Domain=if(isnull(dest_nt_domain),if(isnull(src_nt_domain),"Unknown",upper(src_nt_domain)),upper(dest_nt_domain)) +| eval session_id=if(isnull(session_id),_time,session_id) +| makemv delim="####" src_nt_host +| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason) +| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature +| eval Session_Status="Audit ".status +| stats values(src_nt_host) as src_nt_host,count by _time, Domain, session_id,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account +$tok_filt_link$ +| eval success_count=if(Session_Status="Audit success",1,0), fail_count=if(Session_Status="Audit failure",1,0) +| stats max(_time) AS latest, min(_time) AS earliest,values(src_nt_host) as src_nt_host,count AS sesscount, sum(success_count) AS success_count, sum(fail_count) AS fail_count by Domain,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account +| stats max(latest) AS latest, min(earliest) AS earliest,sum(sesscount) AS sesscount, values(src_nt_host) AS Session_Hosts, values(Logon_Type) AS Session_Types,sum(success_count) AS success_count,sum(fail_count) AS fail_count by Logon_User,Domain,Domain_Account +| eval Session_Host_Count=mvcount(Session_Hosts) +| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") +| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") +| eval Total_Attempts=sesscount +| eval Fail_Percent=round((fail_count/Total_Attempts)*100,2) +| sort 0 -Fail_Percent, -Total_Attempts +| eval Success_Percent=round((success_count/Total_Attempts)*100,2) +| table Domain,Logon_User, Session_Host_Count, Total_Attempts, fail_count, Fail_Percent, success_count, Success_Percent, First_Attempt, Last_Attempt,Domain_Account + $time_field.earliest$ + $time_field.latest$ + + + + + + + + true + + + + + + + + + + + + + + + + + active + true + true + `ms_obj_failed_success_logons("user")` +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ +| fields user, status, _time, host,src_ip,src_nt_host,src_nt_domain,dest_nt_domain,signature,Failure_Reason,Logon_Type,session_id,Sub_Status,Error_Code +| eval Domain_Account=if(match(Sub_Status,"(?i)0xc0000064") OR match(Error_Code,"(?i)0xc0000064"),"Non_Domain_Account","Domain_Account") +| eval Logon_User=lower(user) +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####")) +| eval Domain=if(isnull(dest_nt_domain),if(isnull(src_nt_domain),"Unknown",upper(src_nt_domain)),upper(dest_nt_domain)) +| eval session_id=if(isnull(session_id),_time,session_id) +| makemv delim="####" src_nt_host +| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason) +| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature +| eval Session_Status="Audit ".status +| stats values(src_nt_host) as src_nt_host,count by _time, Domain, session_id,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account $tok_filt_link$ +| eval success_count=if(Session_Status="Audit success",1,0), fail_count=if(Session_Status="Audit failure",1,0) +| stats max(_time) AS latest, min(_time) AS earliest,values(src_nt_host) as src_nt_host,count AS sesscount, sum(success_count) AS success_count, sum(fail_count) AS fail_count by Domain,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account +| stats max(latest) AS latest, min(earliest) AS earliest,sum(sesscount) AS sesscount, values(src_nt_host) AS Session_Hosts, values(Logon_Type) AS Session_Types,sum(success_count) AS success_count,sum(fail_count) AS fail_count by Logon_User,Domain,Domain_Account +| eval Session_Host_Count=mvcount(Session_Hosts) +| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") +| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") +| eval Total_Attempts=sesscount +| eval Fail_Percent=round((fail_count/Total_Attempts)*100,2) +| sort 0 -Fail_Percent, -Total_Attempts +| eval Success_Percent=round((success_count/Total_Attempts)*100,2) +| table Domain,Logon_User, Session_Host_Count, Total_Attempts, fail_count, Fail_Percent, success_count, Success_Percent, First_Attempt, Last_Attempt,Domain_Account + + + + + + + active + True + `ms_obj_failed_success_logons("user")` +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ +| fields user, status, _time, host,src_ip,src_nt_host,src_nt_domain,dest_nt_domain,signature,Failure_Reason,Logon_Type,session_id,Sub_Status,Error_Code +| eval Domain_Account=if(match(Sub_Status,"(?i)0xc0000064") OR match(Error_Code,"(?i)0xc0000064"),"Non_Domain_Account","Domain_Account") +| eval Logon_User=lower(user) +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####")) +| eval Domain=if(isnull(dest_nt_domain),if(isnull(src_nt_domain),"Unknown",upper(src_nt_domain)),upper(dest_nt_domain)) +| eval session_id=if(isnull(session_id),_time,session_id) +| makemv delim="####" src_nt_host +| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason) +| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature +| eval Session_Status="Audit ".status +| stats values(src_nt_host) as src_nt_host,count by _time, Domain, session_id,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account $tok_filt_link$ +| eval success_count=if(Session_Status="Audit success",1,0), fail_count=if(Session_Status="Audit failure",1,0) +| stats max(_time) AS latest, min(_time) AS earliest,values(src_nt_host) as src_nt_host,count AS sesscount, sum(success_count) AS success_count, sum(fail_count) AS fail_count by Domain,Logon_User, Session_Status,signature,Failure_Reason,Logon_Type,Domain_Account +| stats max(latest) AS latest, min(earliest) AS earliest,sum(sesscount) AS sesscount, values(src_nt_host) AS Session_Hosts, values(Logon_Type) AS Session_Types,sum(success_count) AS success_count,sum(fail_count) AS fail_count by Logon_User,Domain,Domain_Account +| eval Session_Host_Count=mvcount(Session_Hosts) +| eval First_Attempt=strftime(earliest, "%m/%d/%Y %H:%M:%S") +| eval Last_Attempt=strftime(latest, "%m/%d/%Y %H:%M:%S") +| eval Total_Attempts=sesscount +| eval Fail_Percent=round((fail_count/Total_Attempts)*100,2) +| sort 0 -Fail_Percent, -Total_Attempts +| eval Success_Percent=round((success_count/Total_Attempts)*100,2) +| table Domain,Logon_User, Session_Host_Count, Total_Attempts, fail_count, Fail_Percent, success_count, Success_Percent, First_Attempt, Last_Attempt,Domain_Account + | search Total_Attempts>$tok_min_attempts$ $tok_min_failure$ Session_Host_Count>$tok_min_hosts$ +| eval Fail_Percent=Fail_Percent."% (".tostring(fail_count,"commas").")" +| eval Success_Percent=Success_Percent."% (".tostring(success_count,"commas").")" +| eval Total_Attempts=tostring(Total_Attempts,"commas") +| table Domain,Logon_User, Domain_Account,Session_Host_Count, Total_Attempts, Fail_Percent, Success_Percent, First_Attempt, Last_Attempt + true + active + + + + +
+ + + + + + -4h@h + now + + + + + Domain Account + Non-Domain Account + All + + + true + + + + + + + + + + + + + + + + + True + sel + sel + sel + sel + green + Info: + 3: Choose whether to use Domain Filters or not. + True + NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064 + | table Logon_User, uac_details + + + + + + + + + + + + + + + + + + + + True + 3 + $value$ + green + Info: + 3: Enter a user filter in the "Filter User" input. Note: You can use wildcards, enter * to search for all logon users during specified time period. + | table Logon_User + + 4 + + + + + + Yes + No + + + + + + + + true + green + Info: + 4: Select a target AD Domain for the logon users. + + + + + + + + + true + 4 + green + Info: + 4: Enter a user filter in the "Filter User" input. Note: You can use wildcards, enter * to search for all logon users during specified time period. + 5 + + + + + + + + + + + True + if(len($value$)>0,$value$,NULL) + $value$ + + + + true + + + + + + + + + + + + + + + Select Domain + sel + sel + + fields domain | eval domain_val=lower(domain) | table domain,domain_val | search domain!="" | sort domain + + domain + domain_val + + + + + + + + + + + + + + + + + + sel + True + True + $value$ + + green + Info: + 5: Enter a user filter in the "Filter User" input. Note: This filter will look through the "CN, sAMAccountName, and userPrincipalName" for matches and open the "Select User" dropdown list with matching results. You can use wildcards, however you cannot enter only a "*" to search for all. + + + + + + + + + + + + + + + sel + + + + + + sel + $value$ + + + + + + Yes + + + true + true + + + + + + + + + + Select... + All + sel + sel + + + + label + key_val + + + + + + + + + + + + true + True + $tok_user_filter$ + cn,sAMAccountName,userPrincipalName + + + + + + + + true + True + $value$ + _key + search _key="$value$" + + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ + + + + + +
+ Hide Filters +
+ + +
+ Show Filters +
+ + + + + + + + + + + + + +
+

+ Search Running

+
+ + + + + + +
+

+ Warning: No Logon Events were found with matching users from the selected inputs. +

+

Either adjust the Selected Time Period or the selected inputs.

+
+
+ + + + + + + + + +
+
    +
  • Initial Base Search: +
      +
    • + 
      $tok_srch_bs_logon_dom_filt$
      +
      • +
    +
    • +
+ 		+ + Open Search + +
+
    +
  • Full Base Search: +
      +
    • + 
      $tok_srch_bs_logon_full$
      +
      • +
    +
    • +
+ 		+ + Open Search + +
+
+ + + + + + Filter Login Success Ratio Results: + + + 0 + 0 + + + + 0 + 0 + + + Fail_Percent>-1 + + + Fail_Percent>$value$ + + + + + + 0 + 0 + + + + + Total Users + + stats dc(Logon_User) AS Total_Users + + + + Total Attempts + + search Total_Attempts>$tok_min_attempts$ $tok_min_failure$ Session_Host_Count>$tok_min_hosts$ +| stats sum(Total_Attempts) AS Total_Attempts + + + + Total Failed Attempts + + search Total_Attempts>$tok_min_attempts$ $tok_min_failure$ Session_Host_Count>$tok_min_hosts$ +| stats sum(fail_count) AS Total_Failed_Attempts + + + + Total Success Attempts + + search Total_Attempts>$tok_min_attempts$ $tok_min_failure$ Session_Host_Count>$tok_min_hosts$ +| stats sum(success_count) AS Total_Success_Attempts + + + + Average Failure Ratio + + search Total_Attempts>$tok_min_attempts$ $tok_min_failure$ Session_Host_Count>$tok_min_hosts$ +| stats avg(Fail_Percent) AS Average_Failure_Ratio + + + + + + + + + + Average Success Ratio + + search Total_Attempts>$tok_min_attempts$ $tok_min_failure$ Session_Host_Count>$tok_min_hosts$ +| stats avg(Success_Percent) As Average_Success_Ratio + + + + + + + + + + + Logon - Sucess - Fail - Ratio Result Details: + + + | search Total_Attempts>$tok_min_attempts$ $tok_min_failure$ Session_Host_Count>$tok_min_hosts$ +| eval Fail_Percent=Fail_Percent."% (".tostring(fail_count,"commas").")" +| eval Success_Percent=Success_Percent."% (".tostring(success_count,"commas").")" +| eval Total_Attempts=tostring(Total_Attempts,"commas") +| table Domain,Logon_User,Domain_Account,Session_Host_Count,Total_Attempts,Fail_Percent,Success_Percent,First_Attempt,Last_Attempt +| lookup AD_Obj_Domain domain AS Domain OUTPUT user_lookup +| eval user_lookup=if(isnull(user_lookup),"#All#",user_lookup) +| eval dd_filt=Domain_Account."|".Domain."|".Logon_User."|".user_lookup + + + + + + + + + + {"True":#65A637,"False":#D93F3C} + + + [#DC4E41,#EC9960,#53A051] + 0,70 + + + + + + + + + + ["Domain","Logon_User","Domain_Account","Session_Host_Count","Total_Attempts","Fail_Percent","Success_Percent","First_Attempt","Last_Attempt"] + + if("$row.Domain_Account$"=="Domain_Account","True","False") + if("$row.Domain_Account$"=="Domain_Account","tok_user_filter_bs","tok_user_filter_non_dom_bs=".$row.Logon_User$) + if("$row.Domain_Account$"=="Domain_Account",$row.Domain$,"sel")form.tok_domainif("$row.Domain_Account$"=="Domain_Account","all","sel") + user="$row.Logon_User$" + + + + +
+ +

+ Click on a User to review more details on the users logon activities +

+ + + + + + + +
+

+ Base Search Details: +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Search Content:Search:Description:
+

1. Base Data +

+ Logon Events + 		+ 
$tok_srch_bs_logon$
+ 		+
    +
  • This is the base search that looks for failed or successful User logons.
    • +
  • + + Open Search + +
    • +
+
+

2. Base Filter +

+ Domain Status + 		+ 
$tok_domain_acct$
+ 		+
    +
  • This filter determines whether the user account that failed to logon was found in the AD Domain. +
      + Domain Status Selection to Search Values: +
    • + Domain Account: NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064 +
      • +
    • + Non-Domain Account: (Sub_Status=0xC0000064 OR Error_Code=0xC0000064) +
      • +
    • + All: When selected the Domain Status filter will be blank. +
      • +
    +
    • +
  • + + Open Search + +
    • +
+
+

3. Base Filter +

+ Raw Text + 		+ 
($tok_srch_filt_raw$)
+ 		+
    +
  • This filter is raw text that is added to the Base Logon Search for quickly filtering out logon events for matching, or selected user accounts.
    • +
  • Raw Text searching provides greater speed and performance vs trying to look for exact field values (ie. "hax0r" vs user="hax0r" + .
    • +
  • When searching for the Domain Account logon activity, the Raw Text Filter will inlcude the matching or selected User's CN, sAMAccountName, and userPrincipleName to ensure all logon activity data is captured for the User.
    • +
  • + + Open Search + +
    • +
+
+

4. Final Filter +

+ User Link + 		+ 
$tok_filt_link$
+ 		+
    +
  • This filter is used later in the search to specifically match the user field in the data with input selections.
    • +
  • This seems to be redundant, but it speeds up the search process by using the Raw Text Filter first, and then using this Link Filter later on to match the user.
    • +
  • It is also necessary to ensure the returned values are correctly mapped to the input selections.
    • +
+
+

5. Full Base +

+ Resulting Search + 		+ 
$tok_srch_bs_logon_full$
+
+ 		+
    +
  • This is the full base search that combines the above search components, along with field formatting, to return the data used by the Post Processing Searches to populate each of the resulting panels in this dashboard.
    • +
  • + + Open Search + +
    • +
+
+

5. Status Ratio +

+ Resulting Search + 		+ 
$tok_srch_bs_logon_full$ $tok_srch_logon_ratio_full$
+ 		+
    +
  • This is the full Status Ratio search that combines the above search components, along with the calculations for the Logon Status Ratio.
    • +
  • + + Open Search + +
    • +
+
+
+ + + + + + + + + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_sessions.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_sessions.xml new file mode 100644 index 00000000..61bf5a33 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_sessions.xml @@ -0,0 +1,245 @@ +
+ + + | `ms_obj_domain_list` + + + + True + + + + True + + + + + search domain="$tok_domain$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + * + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + $result.kv_suffix$ + $result.dc_val$ + + + + + `ms_obj_win_events_security` (EventCode=4624 OR EventCode=4638 OR EventCode=4634 OR EventCode=4647 OR EventCode=4800 OR EventCode=4801 ) +| fields _time, user, EventCode,user_type +| search user_type="user" +| eval time_day=strftime(_time,"%m/%d/%y") +| stats max(_time) as end_time, min(_time) as start_time by user, EventCode, time_day +| eval logon_time=if(EventCode==4624 OR EventCode==4801, start_time,end_time) +| eval logoff_time=if(EventCode==4634 OR EventCode==4638 OR EventCode==4647 OR EventCode==4800, end_time,start_time) +| stats count AS Total_Logons,min(logon_time) AS logon_time, max(logoff_time) AS logoff_time by user, time_day +| eval Duration=logoff_time-logon_time +| eval Logon_Time=strftime(logon_time,"%m/%d/%y %I:%M:%S %P") +| eval logoff_a_time=strftime(logoff_time,"%m/%d/%y %I:%M:%S %P") +| eval Logoff_Time=if(Duration==0,"No Logoff Time",logoff_a_time) +| eval Total_Duration=tostring(Duration ,"duration") +| table time_day, user, Logon_Time, Logoff_Time, Total_Duration, Duration, Total_Logons + $field1.earliest$ + $field1.latest$ + + + | inputlookup $tok_user_lkp$ $tok_domain_ad_user$ | fields cn,sAMAccountName,userPrincipalName,domain | table cn,sAMAccountName,userPrincipalName,domain | sort cn + + + True + red + Warning: + User Not found in the AD_Obj_User lookup using the filter ($tok_user_filter$). + A* + + + + True + * + + + + +
+ + + + @d + now + + + + + Select Domain... + + |inputlookup AD_Obj_Domain | dedup domain | table domain | sort domain + + domain + domain + sel + sel + + + + + + + + WHERE domain="$value$" + dest_nt_domain="$value$" + dest_nt_domain="$value$" AND + + + + + + All + With Logoff + Without Logoff + Logoff_Time=* + Logoff_Time=* + + + + + + + + + + + + all + + + + Account_Name="$value$" + user="$value$" + user="$value$" + search (cn="$value$" OR sAMAccountName="$value$" OR userPrincipalName="$value$")| + True + all + + + + + + All + + $tok_user_lkup_filter$stats count by domain,cn,sAMAccountName | dedup sAMAccountName| table cn,sAMAccountName | sort cn + + cn + sAMAccountName + all + all + + + + $tok_filter$ + + + user="$value$" + Account_Name="$value$" + + + +
+ + + + Total Logons + + search $tok_user_srch$ $tok_logoff_type$ | fields Total_Logons | stats sum(Total_Logons) AS Total_Logons + + + + + Total Logoffs + + search $tok_user_srch$ $tok_logoff_type$ | fields Logoff_Time | stats count(eval(Logoff_Time!="No Logoff Time")) AS Total_Logoffs + + + + + Total Users + + search $tok_user_srch$ $tok_logoff_type$ | fields user | stats dc(user) AS Total_Users + + + + + Total Duration + + search $tok_user_srch$ $tok_logoff_type$ | fields Duration | stats sum(Duration) AS Total_Duration | eval Total_Duration=tostring(Total_Duration,"duration") + + + + + + Avg Duration + + search $tok_user_srch$ $tok_logoff_type$ | fields Duration | stats avg(Duration) AS Average_Duration | eval Average_Duration=tostring(round(Average_Duration,0),"duration") + + + + + + + + + + + Logon and Logoff By Day + + search $tok_user_srch$ $tok_logoff_type$| table time_day, user, Logon_Time, Logoff_Time, Total_Duration + + + + + + +
+ + + + + Total Duration By Day for User ($tok_user$) + + + search $tok_user_srch$ $tok_logoff_type$|stats sum(Duration) As Total_Duration by time_day| eval Total_Duration=Total_Duration/60/60 + + + + + + + + + + + + + + + + + + + + + + + + + + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_user.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_user.xml new file mode 100644 index 00000000..ced62b0f --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_login_user.xml @@ -0,0 +1,960 @@ +
+ + + + 200 + 500 + green + Info: + 1: Select the Domain Status of the user. + + + + + + + + 200 + 500 + green + Info: + 1: Select the Domain Status of the user. + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + + + + + | makeresults +| eval dd_val="$tok_user_dd$" +| rex field=dd_val "(?<dom_status>[^\|]+)\|(?<domain>[^\|]+)\|(?<user>[^\|]+)\|(?<user_lookup>.+)" +| eval flg_dom=if(user_lookup=="#All#","F","T") +| eval bs_user=lower(user),bs_domain=lower(domain) +| eval raw_txt=if(flg_dom=="F",domain." ".user,"([|`ms_obj_ss_filt_raw_link(\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"".user_lookup."\",\"".bs_domain."\",\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`])") +| eval raw_txt_lbl=if(flg_dom=="F",domain." ".user,"|`ms_obj_ss_filt_raw_link(\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"".user_lookup."\",\"".bs_domain."\",\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`") +| eval link_txt_r_evt=if(flg_dom=="F","| search user=\"".user."\"","| search user IN([|`ms_obj_ss_filt_raw_link(\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"".user_lookup."\",\"".bs_domain."\",\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])") +| eval link_txt=if(flg_dom=="F","| search Logon_User =\"".user."\"","| search Logon_User IN([|`ms_obj_ss_filt_raw_link(\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"".user_lookup."\",\"".bs_domain."\",\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])") +| eval link_add=if(flg_dom=="F","","| join type=left Logon_User [|inputlookup ".user_lookup." WHERE [|`ms_obj_ss_filt_pre_base(\"".bs_user."\",\"cn,sAMAccountName,userPrincipalName\")`] | eval Logon_User=cn.\"|\".sAMAccountName.\"|\".userPrincipalName | makemv delim=\"|\" Logon_User | stats values(uac_details) AS uac_details by Logon_User | eval uac_details=mvjoin(uac_details,\":\")| table Logon_User, uac_details]") +| eval tbl_flds=if(flg_dom=="F","| table Logon_User,","| table Logon_User,uac_details,") +| eval tok_domain_acct=if(dom_status="Domain_Account","NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064","Sub_Status=0xC0000064 OR Error_Code=0xC0000064") +| table dd_val,flg_dom,bs_user,bs_domain,user_lookup,dom_status,raw_txt,raw_txt_lbl,link_txt_r_evt,link_txt,link_add,tbl_flds,tok_domain_acct + + + + + all + all + True + $result.bs_user$ + $result.bs_user$ + + + $result.tok_domain_acct$ + $result.bs_domain$ + $result.raw_txt$ + $result.raw_txt_lbl$ + $result.link_txt_r_evt$ + $result.link_txt$ + $result.link_add$ + $result.tbl_flds$ + green + OK + Drilldown Login Search for User($result.bs_user$) + True + True + + + + + | makeresults +| eval d_st_type="$tok_user_domain_acct_bs$" +| eval dom_stat=case(d_st_type=="all","",d_st_type=="False","(Sub_Status=0xC0000064 OR Error_Code=0xC0000064)",d_st_type=="True","NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064") + + + $result.dom_stat$ + + + + | `ms_obj_domain_list` + + + search domain="$tok_domain_ad_user$" +| eval dom_lkp_srch_trigger="$show_dom_acc$" + + + AD_Obj_User + AD_Obj_Group + AD_Obj_Computer + + + $result.user_lookup$ + $result.group_lookup$ + $result.computer_lookup$ + + + + + + | `ms_obj_ss_filt_pre_lkp("$tok_user_lkp$","$tok_domain_ad_user$","$tok_user_filter$","cn,sAMAccountName,userPrincipalName","domain,cn,sAMAccountName,userPrincipalName,dn,_key")` +| eval dom_srch_trigger="$tok_tgr_bs_dom_user$",key_val=_key + + + + | fields +| `ms_obj_ss_filt_pre_cnt_chk($tok_bypass_min$,$tok_results_max$)` +| eval show_bypass_option=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"true","false") +| eval show_user_list=if(count>=$tok_bypass_min$,"false","true") +| eval inp_bypass_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"4","false") +| eval inp_usr_lst_nmb=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,"5","4") +| eval msg_state=if(count>=$tok_bypass_min$,"Warning","Info") +| eval msg_color=if(count>=$tok_bypass_min$,"red","green") +| eval msg=if(count>=$tok_bypass_min$ AND count<=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Either update the \"Filter User\" to reduce the matching count, or click the \"Yes\" option in the \"Bypass Large List\" input and run the search (Slow Search Possible).",if(count>=$tok_results_max$,inp_usr_lst_nmb.": ".count." Total Users matched the \"Filter User\" ($tok_user_filter$). Update the \"Filter User\" to reduce the matching count.",inp_usr_lst_nmb.": (".count." Users) Either select a individual matching user account or \"All\" from the \"Select User\" input.")) + + + + if($result.show_bypass_option$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + if($result.show_user_list$=="false",NULL,"true") + $result.count$ + 3 + $result.inp_bypass_nmb$ + $result.inp_usr_lst_nmb$ + $result.msg_color$ + $result.msg_state$ + $result.msg$ + + + + $result.count$ + true + + + + + | makeresults | eval tok_tgr_post_check="$tok_tgr_post_check$",dom_srch_trigger="$tok_tgr_bs_dom_user$",count=$tok_filt_user_cnt$ + + + + + + + red + Warning: + 4: No Users found matching the "Filter User" ($tok_user_filter$) entry. Update the "Filter User" to return values. Note: You can use wildcards, (ex. al*), however you cannot enter only a * to search for all. + + + + + + eval trigger_sub_user_list="$tok_tgr_sub_user_list$" +| eval label=if(isnull(cn),sAMAccountName." (".domain." )",cn." (".domain." )") +| stats count by label,key_val +| sort label + + + | makeresults +| eval exec_trigger="$tok_tgr_sub_user_list$" +| eval filt_link_add="| join type=left Logon_User [|inputlookup $tok_user_lkp$ WHERE [|`ms_obj_ss_filt_pre_base(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\")`] | eval Logon_User=cn.\"|\".sAMAccountName.\"|\".userPrincipalName | makemv delim=\"|\" Logon_User | stats values(uac_details) AS uac_details by Logon_User | eval uac_details=mvjoin(uac_details,\":\")| table Logon_User, uac_details] +| eval uac_details=if(isnull(uac_details),\"Not Available\",uac_details) +| makemv delim=\":\" uac_details" +| eval filt_raw_text="([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`])" +| eval filt_raw_text_lbl="|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"raw_txt\")`" +| eval filt_link="| search Logon_User IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| eval filt_link_r_evt="| search user IN([|`ms_obj_ss_filt_raw_link(\"$tok_sel_user_filt$\",\"$tok_pre_filt_flds$\",\"$tok_user_lkp$\",\"$tok_domain_ad_user$\",\"$tok_sel_user_filt$\",\"cn,sAMAccountName,userPrincipalName\",\"link\")`])" +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt,filt_raw_text_lbl + + + + + + + + + + $result.filt_raw_text$ + $result.filt_link$ + $result.filt_link_add$ + $result.filt_link_r_evt$ + $result.filt_raw_text_lbl$ + + + + + + | makeresults +| eval non_dom_filt_srch_trigger="$tok_tgr_sub_non_dom_logon_filt$" +| eval filt_raw_text=if(match("$tok_user_filter$","^\*$$"),"","\"$tok_user_filter$\"") +| eval filt_link=if(match("$tok_user_filter$","^\*$$"),"","| search Logon_User=\"$tok_user_filter$\"") +| eval filt_link_r_evt=if(match("$tok_user_filter$","^\*$$"),"","| search user=\"$tok_user_filter$\"") +| table filt_raw_text,filt_link,filt_link_add,filt_link_r_evt + + + + + + + + + + $result.filt_raw_text$ + $result.filt_link$ + + $result.filt_link_r_evt$ + True + + + + + + + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status,Error_Code +| eval exec_logon_srch_trigger="$tok_tgr_bs_login_search$" +| eval Domain_Account=if(match(Sub_Status,"(?i)0xc0000064") OR match(Error_Code,"(?i)0xc0000064"),"Non_Domain_Account","Domain_Account") +| eval Logon_User=lower(user) +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason) +| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature +| eval Session_Status="Audit ".status +| fields _time, host,src_ip,src_nt_host,Logon_User, status, Session_Status,signature,Failure_Reason,session_id,Logon_Type,Domain_Account +| stats values(src_nt_host) as src_nt_host,count by _time, host,src_ip,Logon_User, status, Session_Status,signature,Failure_Reason,session_id,Logon_Type,Domain_Account +$tok_filt_link$ + $time_field.earliest$ + $time_field.latest$ + + + + + + + true + + + + + + + + true + true + `ms_obj_failed_success_logons("user")` +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ + `ms_obj_failed_success_logons(\"user\")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status +| eval Domain_Account=if(Sub_Status=="0xC0000064" OR Error_Code=="0xC0000064","Non_Domain_Account","Domain_Account") +| eval Logon_User=lower(user) +| eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) +| eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####")) +| makemv delim="####" src_nt_host +| eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason) +| fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature +| eval Session_Status="Audit ".status +| fields _time, host,src_ip,src_nt_host,Logon_User, status, Session_Status,signature,Failure_Reason,session_id,Logon_Type,Domain_Account +| stats values(src_nt_host) as src_nt_host,count by _time, host,src_ip,Logon_User, status, Session_Status,signature,Failure_Reason,session_id,Logon_Type,Domain_Account +$tok_filt_link$ + + + true + True + + + + `ms_obj_failed_success_logons("user")` +| fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ + `ms_obj_failed_success_logons(\"user\")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ + | fields user, status, _time, host,src_ip,src_nt_host,signature,Failure_Reason,Logon_Type,session_id,Sub_Status + | eval Domain_Account=if(Sub_Status=="0xC0000064" OR Error_Code=="0xC0000064","Non_Domain_Account","Domain_Account") + | eval Logon_User=lower(user) + | eval src_ip=if(isnull(src_ip) OR match(src_ip,"^::|\-|127.0.0.1"),upper(host),src_ip) + | eval src_nt_host=if(isnull(src_nt_host),src_ip,replace(src_nt_host,"\s","####")) + | makemv delim="####" src_nt_host + | eval Failure_Reason=if(isnull(Failure_Reason),signature,Failure_Reason) + | fillnull value="Not In Event" src_nt_host, src_ip,Failure_Reason,signature + | eval Session_Status="Audit ".status + | fields _time, host,src_ip,src_nt_host,Logon_User, status, Session_Status,signature,Failure_Reason,session_id,Logon_Type,Domain_Account + | stats values(src_nt_host) as src_nt_host,count by _time, host,src_ip,Logon_User, status, Session_Status,signature,Failure_Reason,session_id,Logon_Type,Domain_Account + $tok_filt_link$ + true + active + + + + + + + + + + + + + + `ms_obj_failed_success_logons("user")` $tok_domain_acct$ $tok_domain_ad_user$ $tok_filt_raw_txt$ + | fields _raw,_time,user + | eval exec_logon_srch_trigger="$tok_tgr_bs_raw_login_search$" + | fields - exec_logon_srch_trigger + $tok_filt_link_r_evt$ + + $time_field.earliest$ + $time_field.latest$ + +
+ + + + -4h@h + now + + + + + Domain Account + Non-Domain Account + All + + + true + + + + + + + + + + + + + + + + + sel + sel + sel + sel + green + Info: + 2: Select a specific domain from the "Select Domain" list. + True + NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064 + | table Logon_User, uac_details + + + + + + + + + + + + + + + + + True + $value$ + green + Info: + 2: Enter a user filter in the "Filter User" input. Note: You can use wildcards, enter * to search for all logon users during specified time period. + | table Logon_User + + + + + + + + + + + + True + $value$ + + + + true + + + + + + + + + + + green + Info: + 2: Enter a user filter in the "Filter User" input. Note: You can use wildcards, you can enter * for all logon users but will be slower. + + + + + + Select Domain + sel + sel + + fields domain | eval domain_val=lower(domain) | table domain,domain_val | search domain!="" | sort domain + + domain + domain_val + + + + + + + + + + + + + + + + + + + sel + True + True + $value$ + + green + Info: + 3: Enter a user filter in the "Filter User" input. Note: This filter will look through the "CN, sAMAccountName, and userPrincipalName" for matches and open the "Select User" dropdown list with matching results. You can use wildcards, however you cannot enter only a "*" to search for all. + + + + + + + + + + + + + sel + $value$ + + + + + + + + + + sel + + + + + + No + Yes + no + no + + + + + + + true + true + + + + + + Select... + All + sel + sel + + + + label + key_val + + + + + + + + + true + True + $tok_user_filter$ + cn,sAMAccountName,userPrincipalName + + + + + + + + true + True + $value$ + _key + search _key="$value$" + + + + + + + +

+ + + $tok_message_state$ $tok_message$ + +

+ +
+ + + + + + + + + + User Login - Success - Failure - Ratio + + + | lookup AD_Audit_Logon_Types Logon_Type OUTPUT Logon_TypeName +| eval Logon_TypeName=if(isnull(Logon_TypeName),"Unknown Logon Type - ".Logon_Type,Logon_TypeName) +| eventstats count AS Logon_Type_Count by Logon_TypeName,Logon_User +| eval Session_Types=Logon_TypeName." (".tostring(Logon_Type_Count,"commas").")" +| stats max(_time) AS latest, min(_time) AS earliest, count AS Total_Attempts, dc(session_id) AS sesscount, dc(src_nt_host) AS Source_Host_Count, values(Session_Types) AS Session_Types, count(eval(status="success")) AS success_count, count(eval(status="failure")) AS fail_count by Logon_User,Domain_Account +| eval Fail_Percent=round((fail_count/Total_Attempts)*100,2) +| eval Success_Percent=round((success_count/Total_Attempts)*100,2) +| eval Attempt_Summary="Total Attempts: ".tostring(Total_Attempts,"commas")."|Failed: ".Fail_Percent."% (".tostring(fail_count,"commas").")|Success: ".Success_Percent."% (".tostring(success_count,"commas").")|First Attempt: ".strftime(earliest, "%m/%d/%Y %H:%M:%S")."|Last_Attempt: ".strftime(latest, "%m/%d/%Y %H:%M:%S") +| makemv delim="|" Attempt_Summary +| sort -Fail_Percent, -Total_Attempts +| eval Total_Attempts=tostring(Total_Attempts,"commas") +| eval Fail_Percent=Fail_Percent."%" +| eval Success_Percent=Success_Percent."%" +$tok_filt_link_add$ +| eval uac_details=if(Domain_Account=="False","Not Available",uac_details) +| makemv delim=":" uac_details +$tok_table_search$,Domain_Account,Total_Attempts, Fail_Percent, Success_Percent,Session_Types,Source_Host_Count, Attempt_Summary + + + + + + + + + + {"True":#65A637,"False":#D93F3C} + +
+ + + + + User Login - Status - Over Time + + Successful Logins + + search status="success" +| timechart count by Logon_User + + + + + + + + + Failed Logins + + search status="failure" +| timechart count by Logon_User + + + + + + + + + + + User Login - Failure - Details + + + search status="failure" +| eventstats count AS Failure_Reason_cnt by Failure_Reason,Logon_User +| eventstats count AS src_ip_cnt by src_ip,Logon_User +| eventstats count AS src_nt_host_cnt by src_nt_host,Logon_User +| eval Failure_Reason="(".Failure_Reason_cnt.") - ".Failure_Reason +| eval src_ip="(".src_ip_cnt.") - ".src_ip +| eval src_nt_host="(".src_nt_host_cnt.") - ".src_nt_host +| stats count AS Total_Failed_Attempts, values(Failure_Reason) AS Top_Reasons,values(src_ip) AS Source_IPs,values(src_nt_host) AS Source_Hosts by Logon_User,Domain_Account +| sort -Total_Failed_Attempts +| eval Top_Reasons=mvindex(Top_Reasons,0,9) +$tok_filt_link_add$ +| eval uac_details=if(Domain_Account=="False","Not Available",uac_details) +| makemv delim=":" uac_details +$tok_table_search$,Domain_Account,Total_Failed_Attempts,Source_IPs, Source_Hosts,Top_Reasons +| rename uac_details AS "User Account Control Details" + + + + + + + + +
+ + + + + User Login - Success - Details + + + search status="success" +| fillnull value="Not Available" uac_details +| eventstats count AS src_ip_cnt by src_ip,Logon_User +| eventstats count AS src_nt_host_cnt by src_nt_host,Logon_User +| eval src_ip="(".src_ip_cnt.") - ".src_ip +| eval src_nt_host="(".src_nt_host_cnt.") - ".src_nt_host +| stats count AS Total_Successful_Attempts, values(src_ip) AS Source_IPs,values(src_nt_host) AS Source_Hosts by Logon_User,Domain_Account +| sort -Total_Successful_Attempts +$tok_filt_link_add$ +| eval uac_details=if(Domain_Account=="False","Not Available",uac_details) +| makemv delim=":" uac_details +$tok_table_search$,Domain_Account,Total_Successful_Attempts,Source_IPs, Source_Hosts +| rename uac_details AS "User Account Control Details" + + + + + + + + +
+ + + + + Source Host Login - Status - Over Time + + Successful Logins + + search status="success" +| timechart count by src_nt_host + + + + + + + + Failed Logins + + search status="failure" +| timechart count by src_nt_host + + + + + + + + + + + Source IP Login - Status - Over Time + + Successful Logins + + search status="success" +| timechart count by src_ip + + + + + + + + Failed Logins + + search status="failure" +| timechart count by src_ip + + + + + + + + + + + + + stats count by src_ip, Logon_User +| iplocation src_ip +| geostats count by Logon_User + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Raw Login Events + + + + + + + + + + + + +
+

Base Search Details:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Search Content:Search:Description:

1. Base Data

Logon Events
$tok_srch_bs_logon$
 +
    +
  • This is the base search that looks for failed or successful User logons.
    • +
  • + + Open Search + +
    • +
+

2. Base Filter

Domain Status
$tok_domain_acct$
 +
    +
  • This filter determines whether the user account that failed to logon was found in the AD Domain. +
      Domain Status Selection to Search Values: +
    • Domain Account: NOT Sub_Status=0xC0000064 NOT Error_Code=0xC0000064
      • +
    • Non-Domain Account: (Sub_Status=0xC0000064 OR Error_Code=0xC0000064)
      • +
    • All: When selected the Domain Status filter will be blank.
      • +
    +
    • +
  • + + Open Search + +
    • +
+

3. Base Filter

Raw Text
($tok_srch_filt_raw$)
 +
    +
  • This filter is raw text that is added to the Base Logon Search for quickly filtering out logon events for matching, or selected user accounts.
    • +
  • Raw Text searching provides greater speed and performance vs trying to look for exact field values (ie. "hax0r" vs user="hax0r".
    • +
  • When searching for the Domain Account logon activity, the Raw Text Filter will inlcude the matching or selected User's CN, sAMAccountName, and userPrincipleName to ensure all logon activity data is captured for the User.
    • +
  • + + Open Search + +
    • +
+

4. Final Filter

User Link
$tok_filt_link$
 +
    +
  • This filter is used later in the search to specifically match the user field in the data with input selections.
    • +
  • This seems to be redundant, but it speeds up the search process by using the Raw Text Filter first, and then using this Link Filter later on to match the user.
    • +
  • It is also necessary to ensure the returned values are correctly mapped to the input selections.
    • +
+

5. Full Base

Resulting Search
$tok_srch_bs_logon_full$
+
+
    +
  • This is the full, base search that combines the above search components, along with field formatting, to return the data used by the Post Processing Searches to populate each of the resulting panels in this dashboard.
    • +
  • + + Open Search + +
    • +
+
+
+ + + + + + +

Search Running

+ + + + + + +

Warning: No Logon Events were found with matching users from the selected inputs.

+

Either adjust the Selected Time Period or the selected inputs.

+
+ + + + + + + + + +
+
    +
  • Base Search: +
      + 
    • $tok_srch_bs_logon_dom_filt$
      • +
    +
    • +
+ 		+ + Open Search + +
+
    +
  • Full Search: +
      + 
    • $tok_srch_bs_logon_full$
      • +
    +
    • +
+ 		+
+ + Open Search + +
+
+
+ + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_splunk_index_compression.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_splunk_index_compression.xml new file mode 100644 index 00000000..10ecbcc7 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_splunk_index_compression.xml @@ -0,0 +1,137 @@ +
+ + + | dbinspect timeformat="%s" index="*" +| fields index,endEpoch, startEpoch,sizeOnDiskMB, rawSize, eventCount,state + $tok_time.earliest$ + $tok_time.latest$ + + + + +
+ + + + -7d@h + now + + + + + Windows + Non-Internal Only + Internal Only + All + windows + windows + + + |search NOT index="_*"| + + + |search index="_*"| + + + |search (index="msad" OR index="wineventlog" OR index="perfmon" OR index="windows" OR index="msexchange")| + + + + + + + + + All + all + all + + + $tok_idx_type_filt$ stats count by index | sort index | fields index + + + index + index + + + $tok_idx_type_filt$ + + + |search index="$value$"| + + + +
+ + + +

Analyze a target Splunk Indexes current compression ratio

+

Select Target Index to get the current compression ratio

+

rawTotalinMB = Total Data Size Received for Index.

+

diskTotalinMB = Total currently stored on Disk.

+

compression = Compression Percentage (Total Data Size On Disk/Total Data Size Received)

+

+ Go hear for more information +

+ + + + + + + Overall Compression - Total Stored Compression Ratio for Selected Index and Time + + $index_filter$stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB, sum(eventCount) AS Total_Events +| sort -rawTotal +| eval rawTotalinMB=(rawTotal / 1024 / 1024) +| eval compression=if(rawTotalinMB>diskTotalinMB, (diskTotalinMB / rawTotalinMB * 100), 0) +| eval compression=if(rawTotalinMB>diskTotalinMB, tostring(round((100 - compression),2)) + "%", "0 %") +| eval rawTotalinMB=tostring((round(rawTotalinMB,2)), "commas") +| eval diskTotalinMB=tostring((round(diskTotalinMB,2)), "commas") +| eval Total_Events=tostring(Total_Events, "commas") +| table Total_Events, rawTotalinMB, diskTotalinMB, compression + + +
+ + + + Compression by State - Total Stored Compression Ratio for Selected Index, Bucket State, and Time + + $index_filter$stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB, sum(eventCount) AS Total_Events by state +| sort -rawTotal +| eval rawTotalinMB=(rawTotal / 1024 / 1024) +| eval compression=if(rawTotalinMB>diskTotalinMB, (diskTotalinMB / rawTotalinMB * 100), 0) +| eval compression=if(rawTotalinMB>diskTotalinMB, tostring(round((100 - compression),2)) + "%", "0 %") +| eval rawTotalinMB=tostring((round(rawTotalinMB,2)), "commas") +| eval diskTotalinMB=tostring((round(diskTotalinMB,2)), "commas") +| eval Total_Events=tostring(Total_Events, "commas") +| table state, Total_Events, rawTotalinMB, diskTotalinMB, compression + + +
+ + + + + + Compression By Day - Total Stored Compression Ratio for Selected Index, and Time + + $index_filter$convert timeformat="%m/%d/%Y" ctime(endEpoch) as End_Date +| convert timeformat="%m/%d/%Y" ctime(startEpoch) as Start_Date +| stats sum(rawSize) AS rawTotal_MB, sum(sizeOnDiskMB) AS diskTotalinMB, sum(eventCount) AS Total_Events by index,Start_Date,End_Date +| sort -rawTotal_MB +| eval rawTotalinMB=round((rawTotal_MB / 1024 / 1024),2) +| eval SizeOnDisk_MB=round(SizeOnDisk_MB,2) +| eval compression=if(rawTotalinMB>diskTotalinMB, (diskTotalinMB / rawTotalinMB * 100), 0) +| eval compression=if(rawTotalinMB>diskTotalinMB, tostring(round((100 - compression),2)) + "%", "0 %") +| eval rawTotalinMB=tostring((round(rawTotalinMB,2)), "commas") +| eval diskTotalinMB=tostring((round(diskTotalinMB,2)), "commas") +| eval Total_Events=tostring(Total_Events, "commas") +| table index,End_Date, Start_Date,Total_Events, diskTotalinMB, rawTotalinMB, compression + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_user_tracking.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_user_tracking.xml new file mode 100644 index 00000000..845a9fa1 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_admin_user_tracking.xml @@ -0,0 +1,121 @@ +
+ + + ($token_sourcetype$) $token_search_extra$ ($token_host$) (user=$token_user$ OR src_user=$token_user$ OR User=$token_user$) +| fields _time, sourcetype, user, User, src_user, _raw, host + $token_time.earliest$ + $token_time.latest$ + +
+ + + All + + | metadata type=sourcetypes | table sourcetype | sort sourcetype + + sourcetype + sourcetype + sourcetype=" + " + OR + * + + + + All + + | metadata type=hosts | table host| sort host + + host + host + host=" + " + OR + * + + + + admin* + " + " + admin* + + + + + " + " + + + + + -4h@m + now + + +
+ + + + Count by sourcetype + + stats count by sourcetype +| sort -count + + + + + + +
+ + Count Over Time + + timechart limit=10 count by sourcetype + + + + + + + + + + + + + + + + + + + + + + + + + + + + Transaction of Raw Events for Users + + eval User=if(isnull(user),if(isnull(src_user),if(isnull(User),"Unknown",User),src_user),user) +| transaction sourcetype, User, host +| highlight $token_user$ + + + + + + + + + + + ["host","source","sourcetype"] + + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_analyze_fields.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_analyze_fields.xml new file mode 100644 index 00000000..115c886e --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_analyze_fields.xml @@ -0,0 +1,330 @@ +
+ + + $tok_group$=$tok_series$ +| fieldsummary +| search count>0 +| table field, values +| fields + field, values +| rex max_match=2 field=values "\{\"value\"\:\"(?P<Example_Values>[^\"]+)" +| table field, Example_Values + $field2.earliest$ + $field2.latest$ + + + | datamodel $tok_data_model$ $tok_sel_owner$ search +| fieldsummary +| table field, values +| fields + field, values +| rex max_match=2 field=values "\{\"value\"\:\"(?P<Example_Values>[^\"]+)" +| table field, Example_Values + $field2.earliest$ + $field2.latest$ + + + + $field2.earliest$ + $field2.latest$ + + + NOT Example_Values="*" + + + + + + true + + + +
+ + + + -60m@m + now + + + + + By Index + By Sourcetype + By Source + By Host + By Lookup + + + + true + + + + + + + + + + + true + + + + + + + + + + + true + + + + + + + + + + + true + + + + + + + + + + + true + + + + + + + + + + + true + + + + + + + + + + + + + + + index=_internal source=*metrics.log group="per_$tok_group$_thruput" NOT series="splunk*" NOT series="_*" NOT series="audittrail" NOT series="*splunk/var/log/*" NOT series="summary" NOT series="kvstore" +| stats count by series +| sort series + + series + series + true + + + + + + + + | rest /servicesNS/nobody/-/datamodel/model +| dedup title +| rex field=description "modelName\"\:\"(?<modelName>[^\"]+)" +| rex field=id "8089(?<modelPath>[^$]+)" +| table modelName,modelPath + + modelName + modelPath + + + + + | rest $tok_data_model$ +| dedup title +| rex field=description max_match=0 "owner\"\:\"(?<data_model_full_path>[^\"]+)" +| mvexpand data_model_full_path +| stats count by data_model_full_path +| rex field=data_model_full_path "(?<path_b>.*)\.(?<object_a>[^\.]*$)" +| eval data_model_path=if(isnull(path_b),data_model_full_path,path_b) +| eval object=if(isnull(object_a),data_model_full_path,object_a) +| rex mode=sed field=data_model_path "s/\./ - /g" +| dedup object,data_model_full_path +| table object, data_model_full_path +| search NOT object="BaseEvent" +| sort data_model_full_path + + object + object + + + + + | rest /servicesNS/-/-/data/transforms/lookups +| dedup title +| table title +| sort title + + title + title + + + + * + * + +
+ + + + Fields With Data + + search Example_Values="*" field="$tok_field_filt$" + + + + + + + + + + $click.value$ + + +
+ + + Optional - Click a field in the table above to view top values for that field + + + + + Fields Without Data + + search field="$tok_field_filt$" + + + +
+ + + + + + ES Data Model Information: + + | datamodelinfo $tok_data_model$| fields datamodel size | join max=0 datamodel [| contentinfo | eval datamodel=mvdedup(datamodel)| eval name=case(isnotnull(search_name), search_name,isnotnull(panel_title), view_name + " - " + panel_title, isnotnull(view_name), view_name, 1==1, null()) | eval subtype=coalesce(subtype, if(isnotnull(panel_title), "panel", " ")) | fields app datamodel name type subtype| stats list(*) as *, count by datamodel app | eval name=mvjoin(name, ";") | eval type=mvjoin(type, ";")| eval subtype=mvjoin(subtype, ";")]| fields datamodel app size name type subtype count | makemv delim=";" name | makemv delim=";" type | makemv delim=";" subtype | fillnull value=0 size count | stats first(size) as readiness sum(count) as total by datamodel + $field2.earliest$ + $field2.latest$ + + +
+ + + + ES Data Model Information: + + | datamodelinfo $tok_data_model$| fields datamodel size | join max=0 datamodel [| contentinfo | eval datamodel=mvdedup(datamodel)| eval name=case(isnotnull(search_name), search_name,isnotnull(panel_title), view_name + " - " + panel_title, isnotnull(view_name), view_name, 1==1, null()) | eval subtype=coalesce(subtype, if(isnotnull(panel_title), "panel", " ")) | fields app datamodel name type subtype| stats list(*) as *, count by datamodel app | eval name=mvjoin(name, ";") | eval type=mvjoin(type, ";")| eval subtype=mvjoin(subtype, ";")]| fields datamodel app size name type subtype count | makemv delim=";" name | makemv delim=";" type | makemv delim=";" subtype | stats sum(eval(if(size>0, count, 0))) as active sum(count) as total | eval pct=active/total*100 | eval completeness=floor(pct)."%" + $field2.earliest$ + $field2.latest$ + + +
+ + + + + + Field ($tok_sel_field$) Values Count: + + $tok_group$=$tok_series$ $tok_sel_field$="*" | stats count by $tok_sel_field$ | sort -count + $field2.earliest$ + $field2.latest$ + + +
+ + + + + + + + Editable + Required + Hidden + Multi Value + All + + + + Data Model Field Information: + + | datamodel $tok_data_model$ $tok_data_model_obj$ | fields _raw +| table _raw +| rex field=_raw "\"parentName\"\:\".*\"\,\"fields\"\:\[(?P<fieldsdata>[^\]]+)" +| rex mode=sed field=fieldsdata "s/\{\"fieldName/####\"fieldName/g" +| rex mode=sed field=fieldsdata "s/\}\,\{\"fieldName/####\"fieldName/g" +| makemv delim="####" fieldsdata +| mvexpand fieldsdata +| rex field=fieldsdata max_match=0 "\"fieldName\":\"(?P<fieldName>[^\"]+)\"\,\"owner\":\"(?P<owner>[^\"]+)\"\,\"type\":\"(?P<type>[^\"]+)\"\,\"fieldSearch\":(?P<fieldSearch>[^\,]+)\,\"required\"\:(?P<required>[^\,]+)\,\"multivalue\":(?P<multivalue>[^\,]+)\,\"hidden\":(?P<hidden>[^\,]+)\,\"editable\":(?P<editable>[^\,]+)\,\"displayName\":\"(?P<displayName>[^\"]+)\"\,\"comment\":(?P<comment>[^\}]+)" +| eval fieldName=if(owner=="BaseEvent",fieldName,owner.".".fieldName) +| rename displayName AS Original_Field_Name, fieldName AS Model_Field_Name, owner AS Object_Owner +| table Model_Field_Name, Original_Field_Name, Object_Owner, type, fieldSearch, required, multivalue, hidden, editable, comment +$tok_dm_field_config$ +| sort Object_Owner + + $field2.earliest$ + $field2.latest$ + + + + + $click.value$ + + +
+ + + Step 4 - Click a field in the table above to view top values for that field + + + Data Model Field ($tok_sel_dm_field$) Values: + + |tstats summariesonly=true allow_old_summaries=true count from datamodel=$tok_data_model$ by $tok_sel_dm_field$ +| sort -count + + $field2.earliest$ + $field2.latest$ + + +
+ + + + + + Lookup ($tok_lookup$) Values: + + |inputlookup $tok_lookup$ + + $field2.earliest$ + $field2.latest$ + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_health_overview.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_health_overview.xml new file mode 100644 index 00000000..2d75e36e --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_health_overview.xml @@ -0,0 +1,195 @@ +
+ + + `ms_obj_admon_flt_obj_type(ms_obj_admon_user,ms_obj_admon_base_a_type)` +| fields objectClass, admonEventType +| eval AD_Object=case(objectClass="top|person|organizationalPerson|user","Users",objectClass="top|group","Groups",objectClass="top|person|organizationalPerson|user|computer","Computers",objectClass="","Distribution List",objectClass="top|organizationalUnit","Organizational Units",objectClass="top|container|groupPolicyContainer","Group Policies") +| eval admon_Type=case(admonEventType="Sync","Baseline",admonEventType="Update","Update",admonEventType="Deleted","Deleted") +| stats max(_time) AS last_time,count by AD_Object, admon_Type +| table last_time, AD_Object,admon_Type,count + $field1.earliest$ + $field1.latest$ + 1 + + + | `ms_ad_obj_cfg_idx_base` +| mvexpand index +| join type=left index [| `ms_ad_obj_cfg_idx_avail` ] +| join type=left index [| `ms_ad_obj_cfg_idx_data` ] +| sort flag,-Total_Events +| eval Total_Sourcetypes=if(isnull(cmb),0,mvcount(cmb)) +| fillnull 0 Total_Events,currentDBSizeMB +| eval flag=if(isnull(index_flag),2,if(isnull(data_flag),1,0)) +| eval flag_msg=case(flag=2,"index Not Created: ".index,flag=1,"Missing Index Data: ".index,flag=0,"OK: ".index) +| rename index as macro_index, cmb as sourcetypes +| fillnull value=0 Total_Events,currentDBSizeMB +| eval sourcetypes=if(isnull(sourcetypes),flag_msg,sourcetypes) +| makemv delim="|" sourcetypes +| sort -flag macro_name +| table macro_name,macro_definition,macro_index,flag,flag_msg,Total_Events,currentDBSizeMB,sourcetypes + $field1.earliest$ + $field1.latest$ + 1 + +
+ + + sourcetype="ActiveDirectory" - Event Statistics + + + + -24h@h + now + + + + Total admon Event Counts by AD Object + + | eval baseline_last_time=if(admon_Type=="Baseline",last_time,"Never") +| eval update_last_time=if(admon_Type=="Update",last_time,"Never") +| eval deleted_last_time=if(admon_Type=="Deleted",last_time,"Never")| eval base_cnt=if(admon_Type=="Baseline",count,0) +| eval upd_cnt=if(admon_Type=="Update",count,0) +| eval del_cnt=if(admon_Type=="Deleted",count,0) +| eval update_last_time=if(admon_Type=="Update",last_time,"Never") +| eval deleted_last_time=if(admon_Type=="Deleted",last_time,"Never") +| stats max(baseline_last_time) AS baseline_last_time,max(update_last_time) AS update_last_time,max(deleted_last_time) AS deleted_last_time,sum(base_cnt) AS Baseline_Count,sum(upd_cnt) AS Update_Count,sum(del_cnt) AS Deleted_Count,sum(count) AS Total_Count by AD_Object +| fillnull value=0 Baseline_Count,Update_Count,Deleted_Count,Total_Count +| eval Baseline_Event_Summary=if(baseline_last_time=="Never","Total Events: ".tostring(Baseline_Count,"commas"),"Total Events: ".tostring(Baseline_Count,"commas")."|Last Event Time: ".strftime(baseline_last_time,"%m/%d/%y %H:%M:%S")) +| eval Update_Event_Summary=if(update_last_time=="Never","Total Events: ".tostring(Update_Count,"commas"),"Total Events: ".tostring(Update_Count,"commas")."|Last Event Time: ".strftime(update_last_time,"%m/%d/%y %H:%M:%S")) +| eval Deleted_Event_Summary=if(deleted_last_time=="Never","Total Events: ".tostring(Deleted_Count,"commas"),"Total Events: ".tostring(Deleted_Count,"commas")."|Last Event Time: ".strftime(deleted_last_time,"%m/%d/%y %H:%M:%S")) +| makemv delim="|" Baseline_Event_Summary +| makemv delim="|" Update_Event_Summary +| makemv delim="|" Deleted_Event_Summary +| sort -Total_Count +| table AD_Object, Baseline_Event_Summary,Update_Event_Summary,Deleted_Event_Summary,Total_Count +| eval Total_Count=tostring(Total_Count,"commas") + + + + + + + + +
+ + + Built and Updated AD Object Lookup Table Counts + + + | inputlookup AD_Obj_User +| stats count + 0 + + + + + + + + | inputlookup AD_Obj_Group +| stats count + 0 + + + + + + + + + + | inputlookup AD_Obj_Group WHERE sAMAccountType="268435457" +| stats count + 0 + + + + + + +
+ + + + | inputlookup AD_Obj_Computer +| stats count + 0 + + + + + + + + | inputlookup AD_Obj_OU +| stats count + 0 + + + + + + + + | inputlookup AD_Obj_GPO +| stats count + 0 + + + + + + + + + + + Windows Events Data + + search macro_name="ms__obj_win_events_index" + | mvexpand sourcetypes + | rex field=sourcetypes "(?<sourcetype>[^\(]+)\((?<count>[^\)]+)\)" + | table sourcetype,count + + +
+ + + + Windows Perfmon Data + + search macro_name="ms__obj_win_perfmon_index" + | mvexpand sourcetypes + | rex field=sourcetypes "(?<sourcetype>[^\(]+)\((?<count>[^\)]+)\)" + | table sourcetype,count + + +
+ + + + Windows AD Data + + search macro_name="ms__obj_win_ad_index" + | mvexpand sourcetypes + | rex field=sourcetypes "(?<sourcetype>[^\(]+)\((?<count>[^\)]+)\)" + | table sourcetype,count + + +
+ + + + Windows API Data + + search macro_name="ms__obj_win_api_index" + | mvexpand sourcetypes + | rex field=sourcetypes "(?<sourcetype>[^\(]+)\((?<count>[^\)]+)\)" + | table sourcetype,count + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_health_sched_searches.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_health_sched_searches.xml new file mode 100644 index 00000000..0378b5c6 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_health_sched_searches.xml @@ -0,0 +1,157 @@ +
+ + + active + + + index=_internal sourcetype=scheduler savedsearch_name="AD_Obj_*_Update" (status="completed" OR status="success" OR status="skipped" OR status="deferred") +| fields _time, status, dispatch_time,run_time,scheduled_time,window_time,savedsearch_id,savedsearch_name,user,alert_actions,reason,cron_schedule,app,result_count + $field1.earliest$ + $field1.latest$ + 1 + +
+ + + + -30m + @m + + +
+ + + +
+ Click Here to view the Scheduled Searches that are part of this app so you can optionally adjust the schedule for admon Updates/New/Deleted events that apply the changes to the specific AD Objects lookup tables. +
+ + + + + + Scheduled Search Analytics + + + + + + + + Scheduled Searches - Runtime Statistics - Basic + + + search (status="completed" OR status="success") +| rex field=savedsearch_name "AD_Obj_(?<AD_Object_Category>.+)_(?<AD_Object_Type>.*)" +| rex field=savedsearch_name "AD_Obj_(?<AD_Object_Category>(User|Group|Computer|OU\_GPO|GPO\_OU|GPO|OU|Admin_Audit))_(?<AD_Object_Type>.*)" +| rex field=savedsearch_name "AD_Obj_(?<AD_Object_Category>(User|Group|Computer|OU\_GPO|GPO\_OU|GPO|OU|Admin_Audit))_(?<AD_MD_Domain>[^\_]+)_(?<AD_Object_MD_Type>.*)" +| eval AD_Object_Type=if(isnull(AD_MD_Domain),AD_Object_Type,AD_Object_MD_Type) +| eval AD_Object_Category=if(isnull(AD_MD_Domain),AD_Object_Category." - ".AD_Object_Type,AD_Object_Category." - ".AD_MD_Domain." - ".AD_Object_Type) +| eval window_time = if(isnotnull(window_time), window_time, 0) +| eval execution_latency = max(dispatch_time - (scheduled_time + window_time), 0) +| stats max(run_time) AS Longest_Run_Time_Seconds, avg(run_time) AS Average_Run_Time_Seconds, count AS Total_Executions, last(result_count) AS Last_Result_Count,last(dispatch_time) AS Last_Execution_Time,last(scheduled_time) AS Schedule_Execution_time,last(execution_latency) AS Execution_Latency by savedsearch_name, AD_Object_Category +| eval Execution_Latency=Execution_Latency." Seconds" +| eval Last_Execution_Time=strftime(Last_Execution_Time,"%m/%d/%y %I:%M %P") +| eval Schedule_Execution_time=strftime(Schedule_Execution_time,"%m/%d/%y %I:%M %P") +| eval Longest_Run_Time_Seconds=round(Longest_Run_Time_Seconds,1) +| eval Average_Run_Time_Seconds=round(Average_Run_Time_Seconds,1) +| sort -Average_Run_Time_Seconds, AD_Object_Category + + + + + + + + +
+ + + + + Scheduled Searches - Runtime Statistics - Advance + + + search (status="completed" OR status="success" OR status="skipped" OR status="deferred") +| eval window_time = if(isnotnull(window_time), window_time, 0) +| eval execution_latency = max(dispatch_time - (scheduled_time + window_time), 0) +| stats avg(run_time) as runtime, avg(execution_latency) AS avg_exec_latency, count(eval(status=="completed" OR status="success" OR status=="skipped")) AS total_exec, count(eval(status=="skipped")) AS skipped_exec count(eval(status=="deferred")) AS deferred_exec by app, savedsearch_name, user, savedsearch_id +| join savedsearch_id type=outer [ + | rest "/servicesNS/-/-/saved/searches/" earliest_time=`ms_obj_time_modifier(-0s@s)` latest_time=`ms_obj_time_modifier(+1d@d)` search="is_scheduled=1" search="disabled=0" + | search NOT (dispatch.earliest_time=rt* OR dispatch.latest_time=rt*) eai:acl.app="ms_windows_ad_objects" + | mvexpand scheduled_times + | stats count(title) as count max(scheduled_times) as max_t min(scheduled_times) as min_t by title, eai:acl.app, eai:acl.owner cron_schedule + | eval schedule_interval=round((max_t-min_t)/(count-1), 0) + | eval savedsearch_id = 'eai:acl.owner'.";".'eai:acl.app'.";".title + | fields savedsearch_id, cron_schedule, schedule_interval ] +| eval runtime = round(runtime, 0) +| eval avg_exec_latency = round(avg_exec_latency, 0) +| eval search_workload = round(runtime / schedule_interval * 100, 2)." %" +| eval skip_ratio = round(skipped_exec / total_exec * 100, 2)." %" +| fields savedsearch_name, app, user, cron_schedule, schedule_interval, runtime, search_workload, total_exec, skipped_exec, skip_ratio, deferred_exec, avg_exec_latency +| sort - search_workload +| rename savedsearch_name as "Report Name", app as App, user as User, cron_schedule as "Cron Schedule", runtime as "Average Runtime (sec)", total_exec as "Total Executions", skip_ratio as "Skip Ratio", skipped_exec as "Skipped Executions", deferred_exec AS "Deferred Executions", schedule_interval as "Schedule Interval (sec)", search_workload as "Interval Load Factor", avg_exec_latency AS "Average Execution Latency (sec)" + + + + + + + + + + + + +
+ + + + + Successful Scheduled Searches Execution Overtime + + + search status="success" + | timechart limit=20 count by savedsearch_name + + + + + + + + + Skipped - Scheduled Searches - Details + + + search status="skipped" + | eval alert_actions = if(isnull(alert_actions) OR alert_actions == "", "none", alert_actions) + | eval reason = if(isnull(reason) OR reason == "", "none", reason) + | stats count AS count values(alert_actions) AS alert_actions, max(_time) AS last_time by savedsearch_name, reason + | eval reason_and_count = reason." (".count.")" + | stats max(last_time) AS last_time,values(reason_and_count) AS reasons first(alert_actions) AS alert_actions by savedsearch_name + | eval last_time=strftime(last_time,"%m/%d/%y %H:%M:%S") + | rename reasons AS "Skip Reason (Skip Count)" alert_actions AS "Alert Actions" savedsearch_name AS "Report + Name", last_time AS "Last Time Attempted" + + + + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_knowledge_browser.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_knowledge_browser.xml new file mode 100644 index 00000000..f71065c7 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_app_knowledge_browser.xml @@ -0,0 +1,563 @@ +
+ + + active + 0 + blue + 0 + blue + 0 + blue + 0 + blue + 0 + blue + + + | makeresults +| eval config="transforms,props,savedsearches,tags,eventtypes" +| makemv config delim="," +| mvexpand config +| map maxsearches=10 search="| rest /servicesNS/-/-/configs/conf-$$config$$ splunk_server=* | search eai:acl.app="$tok_app$" +| fields eai:acl.app eai:userName eai:acl.sharing +| eval config=\"$$config$$\" + | table eai:acl.app,eai:userName,eai:acl.sharing,config" +| append + [| rest /servicesNS/-/-/data/ui/views splunk_server=* | search eai:acl.app="$tok_app$" + | fields eai:acl.sharing eai:userName eai:acl.app + | eval config="dashboard" + | table eai:acl.sharing,eai:userName,eai:acl.app,config] +| append + [| rest /servicesNS/-/-/data/lookup-table-files splunk_server=* | search eai:acl.app="$tok_app$" + | fields eai:acl.sharing eai:userName eai:acl.app + | eval config="lookups" + | table eai:acl.sharing,eai:userName,eai:acl.app,config] +| append + [| rest /servicesNS/-/ms_windows_ad_objects/storage/collections/config splunk_server=* | search eai:acl.app="$tok_app$" + | fields eai:acl.sharing eai:userName eai:acl.app + | eval config="knowledge store" + | table eai:acl.sharing,eai:userName,eai:acl.app,config] +| rename eai:acl.app AS app eai:userName AS user eai:acl.sharing AS sharing +| eval private_count=if(sharing="user" OR user!="nobody",1,0) +| stats count AS object_count,sum(private_count) AS private_count,values(user) AS users by config app +| sort - object_count +| eventstats sum(object_count) AS total_objects +| eval _time=now() +| fields - _time + + + 0 + red + + + $result.total_objects$ + green + + + + + | rest /servicesNS/-/-/data/lookup-table-files splunk_server=* | search eai:acl.app="$tok_app$" +| eval updated=if(match(updated,"^1969"),"Never",updated) +| table title,author,eai:data,updated,disabled +| join type=left title [| rest /servicesNS/-/-/saved/searches splunk_server="*" | fields eai:acl.app,search,title| search eai:acl.app="$tok_app$" | rename title AS search_title |rex field=search "outputlookup\s+(?P<title>\w+)"| search title="*" |table search_title, title] +| eval search_outputlookup=if(isnull(search_title),"","Outputlookup Search: (".search_title.")") + -24h@h + now + 1 + + + 0 + red + + + $job.resultCount$ + green + + + + + | rest /servicesNS/-/ms_windows_ad_objects/storage/collections/config +| search eai:acl.app="$tok_app$" +| table eai:acl.app,title,replicate,accelerated_fields.* + -24h@h + now + 1 + + + 0 + red + + + $job.resultCount$ + green + + + + + + | rest /servicesNS/-/-/admin/macros count=0 splunk_server=local |search eai:appName="$tok_app$" $macro_text_token$ +| rex field=definition max_match=0 "(?:\`)(?<emb_macro>[^\`]+)\`" +| rename eai:appName AS "App" +| eval args=if(isnull(args),"None",args) +| mvexpand emb_macro +| rex field=emb_macro "(?:\()(?<emb_macro_args>[^\)]+)" +| makemv delim="," emb_macro_args +| eval emb_macro_a_cnt=mvcount(emb_macro_args) +| eval emb_macro=if(isnull(emb_macro),"None",if(isnull(emb_macro_args),emb_macro,replace(emb_macro,"\(.*\)","")."(".emb_macro_a_cnt.")")),args=if(isnull(args),"None",args) +| eval updated=if(match(updated,"1969"),"Default",updated) +| eval emb_macro=if(match(emb_macro,"\$"),"",emb_macro) +| stats values(emb_macro) AS emb_macro by title,args,updated,definition +| eval Summary="Macro: ".title."|Arguments: ".args."|Embedded Macros: ".mvjoin(emb_macro,", ")."|Updated: ".updated +| rename title as Macro | makemv delim="|" summary +| table Summary,Macro,args,definition,updated,emb_macro + -24h@h + now + + + 0 + red + + + $job.resultCount$ + green + + + + + | rest /servicesNS/-/-/admin/eventtypes count=0 splunk_server=local | search eai:acl.app="$tok_app$" $eventtype_text_token$ |table title, eai:appName, search, tags,updated + | rex max_match=0 field=search "(?:eventtype(\=|\s+\=))(?<emb_eventype>[^(\s|\")]+)" + | eval updated=if(match(updated,"1969"),"Default",updated) + -24h@h + now + + + 0 + red + + + $job.resultCount$ + green + + + + + | rest /servicesNS/-/-/data/props/extractions +| table attribute, eai:acl.app,field.name, eai:acl.sharing, stanza, title, type, updated, value +| append [| rest /servicesNS/-/-/data/props/calcfields | table attribute, eai:acl.app,field.name, eai:acl.sharing, stanza, title, type, updated, value] +| search eai:acl.app="$tok_app$" +| rename eai:acl.app AS app,eai:acl.sharing AS app_sharing,field.name AS field_name +| eval updated=if(match(updated,"^1969-"),"Never",updated) +| rex field=value max_match=0 "\(\?\<(?<field_extract>[^\>]+)" +| eval field_name=if(type=="Inline",mvjoin(field_extract,"####"),field_name) +| fillnull value=" " field_name +| table attribute, app,field_name, app_sharing, stanza, title, type, updated, value + -24h@h + now + + + 0 + red + + + $job.resultCount$ + green + + + +
+ + + MS Windows AD Objects + All + ms_windows_ad_objects + ms_windows_ad_objects + label + title + + | rest /servicesNS/nobody/system/apps/local +| where NOT title="ms_windows_ad_objects" +| table label, title + -24h@h + now + + +
+ + + + + + + + + + Object Counts + + + + + + + + + + + +
+ + + + + Lookup Tables + + + All + * + * + title + title + + stats count by title | sort 0 title | table title + + + + + |search title="$tok_lookup_filt$" |rename search_title as "Lookup Search Name" + + + + + + + + +
+ + + Lookup Tables + + + All + * + * + title + title + + stats count by title | sort 0 title | table title + + + + + |search title="$tok_kvstore_filt$" + + + + + + + + +
+ + + + + + Eventtypes + + + All + True + False + all + all + + + | search updated="*" + + + | search updated!="Default" + + + | search updated="Default" + + + + + + all + all + All + title + title + + table label, title + + + + + + + | search title="$value$" + + + + + + + + + + |WHERE match(search,"$value$") + + + + + + + + + All + all + all + emb_eventype + emb_eventype + + stats values(emb_eventype) AS emb_eventype | mvexpand emb_eventype | sort emb_eventype + + + + + + + | search emb_eventype="$value$" + + + + + + $tok_emb_evemnttype_val$ $eventtype_token$ $tok_eventtype_updated$ $eventtype_text_token$|rename title as Eventtype + + + + + + + + +
+ + + + + Macros + + + All + True + False + all + all + + + | search updated="*" + + + | search updated!="Default" + + + | search updated="Default" + + + + + + all + All + all + Macro + Macro + + + | search Macro="*" + + + | search Macro="$value$" + + + + stats count by Macro | sort Macro + + + + + + + + + |WHERE match(definition,"$value$") + + + + + + + + + all + All + all + emb_macro + emb_macro + + + | search emb_macro="*" + + + | WHERE match(emb_macro,"$value$") + + + + stats count by emb_macro | sort emb_macro + + + + + $macro_name_token$ $macro_text_token$ $tok_macro_updated$| makemv delim="|" Summary| table Summary,definition,* + + + + + + + + +
+ tok_macro_updated = $tok_macro_updated$ + + + + + Field Extractions + + + All + * + * + type + type + + stats count by type | sort 0 type | table type + + + + + All + * + * + stanza + stanza + + search type="$tok_field_type$" value IN("$tok_field_value$")| stats count by stanza | sort 0 stanza | table stanza + + + + + All + * + * + title + title + + search value IN("$tok_field_value$") type="$tok_field_type$" stanza="$tok_field_stanza$"| stats count by title | sort 0 title | table title + + + + + All + * + * + app_sharing + app_sharing + + search value IN("$tok_field_value$") title="$tok_field_title$" type="$tok_field_type$" stanza="$tok_field_stanza$"| stats count by app_sharing | sort 0 app_sharing | table app_sharing + + + + + All + all + all + field_name + field_name + + search value IN("$tok_field_value$") title="$tok_field_title$" type="$tok_field_type$" stanza="$tok_field_stanza$" | makemv delim="####" field_name | mvexpand field_name | stats count by field_name| sort 0 field_name | table field_name + + + + + + + | WHERE match(field_name,"$value$") + + + + + + * + * + * + * + + + $tok_field_name$ + + search value IN("$tok_field_value$") app_sharing="$tok_field_app_sharing$" type="$tok_field_type$" stanza="$tok_field_stanza$" title="$tok_field_title$" +$tok_field_name$ +| makemv delim="####" field_name +| sort title + + + + + + + + +
+ + + + + + + + + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_build_ad_lookup_lists__main.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_build_ad_lookup_lists__main.xml new file mode 100644 index 00000000..52cb2da3 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_build_ad_lookup_lists__main.xml @@ -0,0 +1,1459 @@ +
+ + + Pending + Pending + Pending + Pending + Pending + Pending + active + 0 + 0 + 0 + True + Pending + Pending + Pending + Pending + Pending + Pending + Pending + 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 + Pending + Pending + Pending + Pending + Pending + Pending + Pending + display:none; + display:none; + display:none; + display:none; + display:none; + display:none; + display:none; + + + + + + false + display:none; + + + + + + + + + + + + + + + + + | inputlookup AD_Domain_Selector +| eval trigger="$tok_new_cfg$" +| head 2 + + + 0 + disabled + chk_pre_upg_n + Pending Scope Definition: + obj_upg_app_n + Completed + pending + + chosen + + + 0 + disabled + chk_pre_upg_y + build_migrate + Upgrade Pre-Check + obj_depl_n + enable + ms_ad_obj_gs_prep.html + obj_upg_app_y + none + none + none + none + no + no + no + no + no + Completed + Not_Required + Not_Required + Skip + Not_Required + Not_Required + Skip + Not_Required + Not_Required + Skip + Skip + Skip + Not_Required + Not_Required + Skip + Skip + Pre-Check - It appears you are upgrading the MS Windows AD Objects application, if not then select Yes on the first question in the left panel.: + completed + chosen + + + + + + `ms__obj_win_ad_index` eventtype="ms_ad_obj_msad-dc-health" +| eval tok_srch_trigger_rerun_val="$tok_dom_health_trigger$" +| head 2 + + + + chk_dm_health_missing + Warning: MSAD Health data is missing. + Review below troubleshooting steps for checking required macro index definitions and enabling the MSAD Health data collection input on a Domain Controller or Click the Manually Domain Input to manually input the Domain values. Note: You can ignore if you the above Status is "Ok: AD_Obj_Domain Lookup has data". + ms_ad_obj_gs_chk_data_src.html + ms_ad_obj_gs_chk_data_det.html + chk_d_y + chk_d_ko_y + chk_d_dom_health_y + chk_d_man_domain_y + + + chk_dm_health_ok + OK: MSAD Health data is available + MSAD Health Data is being indexed, and will be used to update AD_Obj_Domain lookup. + chk_d_dom_health_n + chk_d_man_domain_n + + + @d + now + + + + | inputlookup AD_Obj_Domain +| eval tok_srch_trigger_rerun_val="$tok_dom_lkup_trigger$" + + + AD_Domain_Selector + + + + + $job.resultCount$ + TRUE + TRUE + F + display:none; + chk_dm_lkp_ok + Ok: AD_Obj_Domain Lookup has data + The AD_Obj_Domain Lookup has data, so if the other data checks are ok then click Next to proceed to the Building Lookup tasks. + TRUE + TRUE + + + + + + + @d + now + + + | inputlookup $tok_sec_domain_attempt$ + + + `ms_obj_admon_bld_domain` + + + + + + ms_obj_admon_migrate_out + + + @d + now + + + |`$tok_third_domain_attempt$(domain,Domain)` + + + `ms_obj_admon_bld_domain` + + + + + $job.resultCount$ + TRUE + TRUE + F + display:none; + chk_dm_lkp_ok + Ok: AD_Obj_Domain Lookup migration completed. + The AD_Obj_Domain Lookup now has data populated by the previous versions lookup AD_Domain_Selector, so if the other data checks are ok then click Next to proceed to the Building Lookup tasks. + TRUE + + + + + + + @d + now + + + $tok_fourth_domain_attempt$ + + + 0 + chk_dm_lkp_missing + Critical: AD_Obj_Domain Lookup is missing data + The AD_Obj_Domain Lookup has not been populated. This is required before proceeding to the next step. Review the below troubleshooting steps and then click the Rerun Autocheck button to attempt to build again. The AD_Obj_Domain lookup has to be populated before attempting to build the other AD_Obj_... lookups. Note: You can also manually populate this lookup using the below manual entry form. + chk_dm_health_missing + Warning: MSAD Health data is missing + MSAD Health data is not being collected, so the AD_Obj_Domain Lookup was not populated. Review the below troubleshooting steps and then click the Rerun Autocheck button to attempt to build again. Note: You can also manually populate this lookup using the below manual entry form. + chk_d_y + chk_d_ko_y + + + + + $job.resultCount$ + TRUE + F + display:none; + TRUE + chk_dm_lkp_ok + Ok: AD_Obj_Domain Lookup has been built + The AD_Obj_Domain Lookup now has data populated by the MSAD Health collected data, so if the other data checks are ok then click Next to proceed to the Building Lookup task. + TRUE + + + + + + @d + now + + + + | `ms_obj_cfg_macro_chk_h("$tok_check_mac_trigger$")` + + + + `ms_obj_admon_get_begin_sync_t_val` +| eval auto_earliest=strptime(Recommended_Sync_Start_Day,"%m/%d/%y") +| eval tok_srch_trigger_rerun_val="$tok_ad_sync_trigger$" + + + + + chk_d_res_admon_y + chk_d_ko_y + chk_admon_sync_missing + Warning: admon Baseline (Sync) data is missing + The baseline admon (ie admonEventType=Sync) is either not collected, or was collected before the last 30 days. If you collected it more than a year ago, it is recommended to recollect it now. Click the "Resetting admon Baseline" button below and follow the steps. + 1 + + + chk_d_res_admon_n + chk_admon_sync_ok + OK: admon Baseline (Sync) data is available + The baseline admon (ie admonEventType=Sync) is available within the last 30 days. + $result.Recommended_Sync_Start_Day$ + $result.Last_Sync_Day$ + True + $result.auto_earliest$ + $result.auto_earliest$ + True + admon Last Sync Data ($result.Recommended_Sync_Start_Day$) - total Sync Events ($result.Sync_Count$) + 1 + + + 0 + now + + + + | makeresults +| eval async="$tok_chk_d_admon_sync_cls$" +| eval domlkp="$tok_chk_d_dom_lkp_cls$" +| eval warn=if(async=="chk_admon_sync_missing" OR domlkp=="chk_dm_lkp_missing","TRUE","FALSE") +| search warn="TRUE" + + + + + + TRUE + + + + + + | makeresults +| eval trigger="$tok_add_domain_trigger$" +| eval host = "$tok_upd_dm_host$" +| eval DomainDNSName = "$tok_upd_dm_dns$" +| eval DomainNetBIOSName = "$tok_upd_dm_netbios$" +| eval domain = DomainNetBIOSName +| eval ForestName = "$tok_upd_dm_forest$" +| eval Site = "$tok_upd_dm_site$" +| eval time=now() +| eval multi_lkps_enabled="f" +| eval kv_suffix=lower(DomainNetBIOSName) +| eval dc_val=lower(DomainDNSName) +| eval user_lookup="AD_Obj_User",group_lookup="AD_Obj_Group",computer_lookup="AD_Obj_Computer" +| table domain,host,DomainNetBIOSName,DomainDNSName,ForestName,Site,time,multi_lkps_enabled,kv_suffix,dc_val,user_lookup,group_lookup,computer_lookup +| eval _key=host +| outputlookup AD_Obj_Domain append=true + -24h@h + now + + $result.host$ + $result.ForestName$ + $result.DomainDNSName$ + $result.DomainNetBIOSName$ + $result.Site$ + + + + $result.time$ + $result.time$ + $result.time$ + + + + + | inputlookup AD_Obj_UAC | head 5 + + + ms_obj_UAC_new + + + + + + + + | `$load_new_uac_table$` + + + | $tok_start_uac_flg$ +| eval uac_u_vals="$tok_uac_u$" +| eval uac_c_vals="$tok_uac_c$" +| eval userAccountControl=case(uac_u_vals="0" AND uac_c_vals="0","NA",uac_u_vals="0",uac_c_vals,uac_c_vals="0",uac_u_vals,uac_u_vals!="0" AND uac_c_vals!="0",uac_u_vals.",".uac_c_vals) +| makemv delim="," userAccountControl +| mvexpand userAccountControl +| table userAccountControl +| join type=left userAccountControl [|inputlookup AD_Obj_UAC | table userAccountControl,uac_bin_map,uac_details] +| WHERE (isnull(uac_details) OR uac_details="") AND userAccountControl!="NA" +| table userAccountControl +| `ms_obj_uac_to_details` +| table userAccountControl,uac_bin_map,uac_details +| eval _key=userAccountControl +| outputlookup AD_Obj_UAC append=true + + + | makeresults +| eval type_value="build_all,build_individual" +| makemv delim="," type_value +| mvexpand type_value +| eval type_label=if(type_value="build_all","New Build - All","New Build - Individual") +| append [| inputlookup AD_OU_LDAP_list | fields | stats count | eval type_label=if(count>0,"Migrate Previous",NULL),type_value=if(count>0,"build_migrate",NULL) | table type_label,type_value] +| sort type_value +| table type_value,type_label + + + + `$tok_exec_time_helper$` + + Running - Please Wait. + + Pending + Pending + + + + Warning: No Sync admon Events Found. Make sure you have followed the steps for getting the admon baseline data in, and have permission to the index specified in the macro ms__obj_win_ad_index. + Not Found + Not Found + True + + + Review Results - Settings (2. Select Admon Sync Time) + $result.First_Sync_Day$ + $result.Last_Sync_Day$ + True + + + -180d@d + now + + + | `ms_obj_config_st_upd($tok_result_btn_run$)` + + + + | makeresults +| eval flag_status=if("$tok_count_user_build$"="0" OR "$tok_count_computer_build$"="0" OR "$tok_count_group_build$"="0" OR "$tok_count_ou_build$"="0" OR "$tok_count_gpo_build$"="0" OR "$tok_count_gpo_ou_link$"="0" OR "$tok_count_admin_audit_build$"="0","1","0") +| eval completed_trigger="$tok_result_btn_run$" +| eval flag_ok=if(flag_status=="1","0","1") +| eval flag_warn=if(flag_status=="1","1","0") +| table flag_ok,flag_warn + + + + + if($result.flag_ok$=="0",NULL,"True") + if($result.flag_warn$=="0",NULL,"True") + completed + + + + + $tok_exec_user_build$ +| stats count,values(userAccountControl) AS uac_e_val +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" +| table count,flg_compl,uac_e_val,build_type + + tostring(round(tonumber('job.doneProgress')*99,2))."%" + + + + + 0 + Warning + 0 + Warning: No User admon events found - Change Sync Time Period + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out_no_sync(computer,Computer)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(computer,Computer)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.flg_compl$="T",$result.uac_e_val$,0) + if($result.build_type$="build_all","`ms_obj_admon_bld_init_out_no_sync(computer,Computer)`",if($result.build_type$="build_migrate","|`ms_obj_admon_migrate_out(computer,Computer)`",NULL)) + if($result.build_type$="build_all","Running",if($result.build_type$="build_migrate","Migrating","Next")) + if($result.build_type$="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.flg_compl$="T","Initial Build: AD_Obj_User Lookup - Completed","Warning: No User admon events found - Change Sync Time Period") + if($result.flg_compl$="T","Success","Warning") + if($result.build_type$="build_individual"," ","display:none;") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_computer_build$ +| stats count,values(userAccountControl) AS uac_e_val +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" +| table count,flg_compl,uac_e_val,build_type + + tostring(round(tonumber('job.doneProgress')*99,2))."%" + + + + + 0 + makeresults + Warning + 0 + Warning: No Computer admon events found - Change Sync Time Period + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out_no_sync(group,Group)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(group,Group)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.flg_compl$="T",$result.uac_e_val$,0) + makeresults + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out_no_sync(group,Group)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(group,Group)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + if($result.flg_compl$=="T","Initial Build: AD_Computer Lookup - Completed","Warning: No Computer admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_group_build$ +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*99,2))."%" + + + + + Warning + 0 + Warning: No Group admon events found - Change Sync Time Period + if($result.build_type$=="build_all","ms_obj_admon_bld_init_out_no_sync(ou,OU)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(ou,OU)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out_no_sync(ou,OU)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(ou,OU)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + $result.count$ + if($result.flg_compl$=="T","Initial Build: AD_Obj_Group Lookup - Completed","Warning: No Group admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_ou_build$ +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + Warning + 0 + Warning: No OU admon events found - Change Sync Time Period + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out_no_sync(gpo,GPO)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(gpo,GPO)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + display:none; + + + if($result.build_type$=="build_all","`ms_obj_admon_bld_init_out_no_sync(gpo,GPO)`",if($result.build_type$=="build_migrate","|`ms_obj_admon_migrate_out(gpo,GPO)`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + if($result.flg_compl$=="T","Initial Build: AD_OU Lookup - Completed","Warning: No OU admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_gpo_build$ +| stats count +| eval flg_compl=if(count>0,"T","F") + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + Warning + 0 + Warning: No GPO admon events found - Change Sync Time Period + ms_ad_admon_upd_gpo_wou + ms_ad_admon_upd_ou_wgpo + Running + Executing... Please Wait... + display:none; + + + ms_ad_admon_upd_gpo_wou + ms_ad_admon_upd_ou_wgpo + Running + Executing... Please Wait... + if($result.flg_compl$=="T","Initial Build: AD_GPO Lookup - Completed","Warning: No GPO admon events found - Change Sync Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + display:none; + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + | `$tok_exec_gpo_ou_link$` +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + Warning + 0 + Warning: No GPO<->OU Links found in AD_Obj_GPO and AD_Obj_OU Lookups + if($result.build_type$=="build_all","`ms_obj_winevt_init_admin_audit`",if($result.build_type$=="build_migrate","| `ms_obj_winevt_migrate_admin_audit`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + + + if($result.build_type$=="build_all","`ms_obj_winevt_init_admin_audit`",if($result.build_type$=="build_migrate","| `ms_obj_winevt_migrate_admin_audit`",NULL)) + if($result.build_type$=="build_all","Running",if($result.build_type$=="build_migrate","Migrating","Next")) + if($result.build_type$=="build_individual","Click the button to the right to build this lookup next:","Executing... Please Wait.") + if($result.build_type$=="build_individual"," ","display:none;") + if($result.flg_compl$=="T","Initial Build: AD_Obj_GPO<->AD_Obj_OU Links - Completed","Warning - No GPO and OU Links Found - Change Time Period") + if($result.flg_compl$=="T","Success","Warning") + $result.count$ + + + $tok_time_sync.earliest$ + $tok_time_sync.latest$ + + + $tok_exec_admin_audit_build$ +| stats count +| eval flg_compl=if(count>0,"T","F"),build_type="$tok_build_type$" + + tostring(round(tonumber('job.doneProgress')*100,2))."%" + + + + + Warning + 0 + if($result.build_type$=="build_migrate","Migrate: No Data - AD_Obj_Admin_Audit_list - Lookup","No Windows Change Events Found - Change Time Period" + completed + display:none; + + + if($result.flg_compl$=="T","Initial Build: AD_Obj_Admin_Audit Lookup - Completed","Warning: No Windows Change Events Found - Change Time Period") + if($result.flg_compl$=="T","Success","Warning") + completed + $result.count$ + display:none; + + + $tok_time_admin.earliest$ + $tok_time_admin.latest$ + + + | makeresults +| eval state="$tok_build_clear_flag$" +| search state="clear" + + + + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + Pending + Pending + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+

+ Check Data - Click Rerun All Autochecks to rerun the validation searches after changes. +

+

Use the below table to check that your environment is ready for the next task of Building the AD Object Lookup tables.

+
+
StatusMessage
+ + + + $tok_chk_d_dom_lkp_lbl$ Rerun Check + $tok_chk_d_dom_lkp_msg$
+ + + + $tok_chk_d_dom_health_lbl$ Rerun Check + $tok_chk_d_dom_health_msg$
+ + + + $tok_chk_d_admon_sync_lbl$ Rerun Check + $tok_chk_d_admon_sync_msg$
+ + + +
+ +
+
+
+
+
+ + + + + + + + + + + + + +
+
+

Troubleshooting Bar:

+
+
+ + Resetting admon Baseline + + + Macro Settings Check + + + + + MSAD Health Input + + + Manual Domain Input + + + Base OS Pre-Defined Inputs + + + AD Pre-Defined Inputs +
+
+
+ + + + + + Verify Baseline Data - Overall + + + Auto Time Range + Manual Time Range + auto + auto + + + True + + + + + True + + + + + + + -30d@d + now + + + +

+ $tok_show_ok_sync_msg$ +

+ + + + + + `ms_obj_admon_get_sync_cnt(ms_obj_admon_base_a_obj)` + 0 + now + 1 + + + + + + + + + + domain_count,ObjectType,count,sync_start_event_time,last_event_event_time,completion_check +
+ + + `ms_obj_admon_get_sync_cnt_nt(ms_obj_admon_base_a_obj)` +| eval trigger="$tok_show_time_manual$" + $time_verify.earliest$ + $time_verify.latest$ + 1 + + + + + + + + + + domain_count,ObjectType,count,sync_start_event_time,last_event_event_time,completion_check +
+ + + + + +
+
+

+ + +
+
Please Wait. $tok_show_build_all_msg$ All the lookups... + +

+
+
+ + +
+
+

+ + + Lookup Build Process Successfully Completed + +

+
+
    +
  • +
    Click the in the Action column to view lookup results
    +
    • +
  • +
    Click the in the Action column to review base search.
    +
    • +
  • +
    You can Now Exit the Getting Started Dashboard or Click Here to open the Overview Dashboard.
    +
    • +
+
+ + +
+
+

+ + + Warning: Build process cancelled or not all of the Lookups were successfully built + +

+
+

Review the below options and troubleshooting steps for more information on successfully building the required lookups.

+
    +
  • +
    Click + + : Reset above Inputsefresh the settings and try expanding the Sync or Admin Audit Time Period
    +
    • +
  • +
    Click + + : Troubleshooting Roles and Knowledge Objects.
    +
    • +
  • +
    Click + + : Refreshing admon Baseline data with current values.
    +
    • +
+
+ + + + + + build_all + build_all + type_label + type_value + + + + + display:none; + display:none; + + True + clear + + + + + display:none; + display:none; + + True + clear + true + + + + display:none; + display:none; + display:none; + clear + + + + + + + + + + -30d@d + now + + + clear + + + + + + -30d@d + now + + + clear + + + +
+

+ $tok_show_ok_sync_msg$ +

+
+ + +
+ +

Complete building the individual lookups using the table and action buttons in the right column.

+
+ + + + + +
+
+ + Help and Tips: +

+

    +
  • + Setting the 2. Select Admon Sync Time input:: +
      +
    1. +
      Click Use Sync Time Helper to help you determine what beginning start date to enter above for 2. Select Admon Sync Start Time.
      +
      2. +
    2. +
      It is important that you get the last time the admon baseline was collected, to ensure that all of the AD Objects (User/Group/Computer/OU/GPO) are added to the lookup.
      +
      3. +
    3. +
      Choose a day that contains the most Sync_Count and then is closest to the current day.
      +
      4. +
    +
    • +
  • +
    Click + + to view steps for Refreshing admon Baseline data with current values if no Sync data is found.
    +
    • +
+

+
+
+ + + Large AD Environments Tip: + + +
    +
  • +
    + If you have a large AD Object count environment, and the building process is taking too long, it is recommended follow the steps outlined in the Steps for Recollecting admon Base Line Data to recollect the "Baseline" admon data for the individual Splunk Forwarder that is collecting admon data. +
    +
    • +
  • +
    This will allow you to select a shorter time range for picking up the Sync data used to build the Lookups.
    +
    • +
  • +
    For Advance Users, you can also split out the User, Group, and Computer lookups into separate lookups for each domain. Click Here to review the configuration steps for performing this.
    +
    • +
+
+
+
+ + + + + + + + + + + + + + + + +
+

Time Helper Results

+
Message: + $tok_time_helper_msg$ +
First Time for Sync Data: + $tok_time_helper_f_time$ +
Last Time for Sync Data: + $tok_time_helper_l_time$ +
+

Use the table below for seeing the Sync history

+
+ + + Sync History + + table Sync_Day,Sync_Count +| sort -Sync_Count + + + + + + + + +
+ + + +
+

+ Warning - Review the troubleshooting steps below before attempting to build the lookups. Required data is missing or unavailable. +

+
+ + +
+

+ Click to Build All AD Lookups + + + Click to Build AD_Obj_User Lookup First + + + Click to Migrate All AD Lookups + + +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
LookupBuild StatusObject CountStatus MessageActions
AD_Obj_Domain + (Success) + $tok_count_domain_build$Initial Build: AD_Obj_Domain Lookup - Completed. + + + +
AD_Obj_Users + ($tok_status_user_build$) + $tok_count_user_build$$tok_msg_user_build$ + + + + + + + + + +
AD_Obj_Computers + ($tok_status_computer_build$) + $tok_count_computer_build$$tok_msg_computer_build$ + + + + + + + Build Computer Lookup + + + +
AD_Obj_Group + ($tok_status_group_build$) + $tok_count_group_build$$tok_msg_group_build$ + + + + + + + Build Group Lookup + + + +
AD_Obj_OU + ($tok_status_ou_build$) + $tok_count_ou_build$$tok_msg_ou_build$ + + + + + + + Build OU Lookup + + + +
AD_Obj_GPO + ($tok_status_gpo_build$) + $tok_count_gpo_build$$tok_msg_gpo_build$ + + + + + + + Build GPO Lookup + + + +
AD_Obj_GPO<->AD_Obj_OU Links + ($tok_status_gpo_ou_link$) + $tok_count_gpo_ou_link$$tok_msg_gpo_ou_link$ + + + + + GPO + + + OU + +
AD_Obj_Admin_Audit + ($tok_status_admin_audit_build$) + $tok_count_admin_audit_build$$tok_msg_admin_audit_build$ + + + + + + + + + + Build Admin Audit Lookup +
+
+ + + + + + + + + +
+

+ Resulting Values in the $tok_dd_result_lookup$ KVstore Lookup +

+
+ + + + | inputlookup $tok_dd_result_lookup$ + +
+ + + + + Manually Add AD Domain Information into the AD_Obj_Domain lookup + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+

Fill Out the Boxes above, when all of the inputs have been populated, click the Add Above Values to add the Domain Details into the AD_Obj_Domain Lookup.

+

+ Add Above Values +

+
+
+ + + + +

+ + New Domain Information Just Added + +

+ + + + + + + + + + + + + + + + + +
hostdomainDomainDNSNameDomainNetBIOSNameForestNameSite
$tok_n_dm_host$$tok_n_dm_netbios$$tok_n_dm_dns$$tok_n_dm_netbios$$tok_n_dm_forest$$tok_n_dm_site$
+
+ + + Updated Full AD_Obj_Domain Lookup Table + + | inputlookup AD_Obj_Domain +| eval trigger="$tok_post_exec_add_d$" +| sort -time +| table domain,host,DomainNetBIOSName,DomainDNSName,ForestName,Site,user_lookup,group_lookup,computer_lookup + + + + + + + + + + + + + + +
+ + + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_cfg_split_kvs.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_cfg_split_kvs.xml new file mode 100644 index 00000000..e974ba87 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_cfg_split_kvs.xml @@ -0,0 +1,763 @@ + + + This Configuration Dashboard should only be leveraged if you have Multiple AD Domains, and there are performance issues with the KV Store. + + + + + active + hidden + hidden + hidden + + hidden + + hidden + Running + + + |inputlookup AD_Obj_Domain +| fields domain,DomainDNSName,Site,multi_lkps_enabled,kv_suffix,dc_val,user_lookup,group_lookup,computer_lookup +| stats count by domain,DomainDNSName,Site,multi_lkps_enabled,kv_suffix,dc_val,user_lookup,group_lookup,computer_lookup + + + eval edit_array=if(multi_lkps_enabled="f",NULL,domain) +| eval dis_array=if(multi_lkps_enabled="f",domain,NULL) +| stats dc(domain) AS count,values(edit_array) AS edit_array,values(dis_array) AS dis_array +| eval edit_array=if(isnull(edit_array),"f",mvjoin(edit_array,",")) +| eval dis_array=if(isnull(dis_array),"f",mvjoin(dis_array,",")) +| eval view_cfg=if(edit_array=="f","display:none;","") +| eval cnt_flg="f" + + + Warning - The AD_Obj_Domain Lookup is not currently populated. This needs to be populated before being able to leverage this configuration dashboard. + "true" + + + + display:none; + + + if($result.cnt_flg$=="f",NULL,"Info - The AD_Obj_Domain Lookup only has one AD Domain, the configuration walked through in this dashboard is not needed with a single AD Domain environments.") + if($result.cnt_flg$=="f",NULL,"true") + if($result.cnt_flg$=="f","true",NULL) + if($result.cnt_flg$=="f","true",NULL) + if($result.edit_array$=="f",NULL,$result.edit_array$) + if($result.edit_array$=="f","",$result.dis_array$) + $result.view_cfg$ + + + + + + |`ms_obj_cfg_kv_split_h` + | table table_vl + + True + + + + + True + + + + + $ppllkp_hold$ + + tostring(round(tonumber($job.doneProgress$)*100,2)) + $job.dispatchState$ + + 0 + now + + + earliest=0 `ms_obj_admon_base` dc_val="$tok_dc_val_chk$"| fields dc_val,objectCategory | head 5 | stats count by dc_val,objectCategory + + + Warning: No results were found using the specified admon Domain Filter. Either adjust the filter or run the below search in a separate window. + earliest=0 `ms_obj_admon_base` dc_val="$tok_dc_val_chk$"| fields dc_val,objectCategory | head 5 | stats count by dc_val,objectCategory + red + + + OK: Resuts were found using the specified admon Domain Filter. + earliest=0 `ms_obj_admon_base` dc_val="$tok_dc_val_chk$"| fields dc_val,objectCategory | head 5 | stats count by dc_val,objectCategory + green + + + + + | join type=left domain [|`ms_obj_cfg_filter_md_inp("$tok_upd_ena_array$","$tok_upd_kvsuff_array$","$tok_upd_dc_array$")`] +| join type=left domain [| makeresults| eval dis_array="$tok_upd_dis_array$" | makemv delim="," dis_array| eval domain=mvfilter(match(dis_array,"^\\S+")) | mvexpand domain| eval multi_lkps_enabled="f",updated="1"| table domain,multi_lkps_enabled,updated] +| eval kv_suffix=if(isnull(n_kv_suffix) OR n_kv_suffix=="n_a",kv_suffix,n_kv_suffix) +| eval dc_val=if(isnull(n_dc_val) OR n_dc_val=="n_a",dc_val,n_dc_val) +| eval user_lookup=if(multi_lkps_enabled="t","AD_Obj_User_".kv_suffix,"AD_Obj_User"),group_lookup=if(multi_lkps_enabled="t","AD_Obj_Group_".kv_suffix,"AD_Obj_Group"),computer_lookup=if(multi_lkps_enabled="t","AD_Obj_Computer_".kv_suffix,"AD_Obj_Computer") +| eval dis_def_srch_flg=if(multi_lkps_enabled="f",1,0) +| eventstats max(dis_def_srch_flg) AS dis_def_srch_flg +| search updated="1" +| eval upd_arr=if(updated="1",domain,NULL) +| eval save_numb=if("$tok_upd_ena_array$"=="","3","7") +| eventstats values(upd_arr) AS upd_arr +| eval upd_arr=mvjoin(upd_arr,",") + + + + + 7 + + + $result.upd_arr$ + $result.save_numb$ + + + + + search multi_lkps_enabled="t" + + + + hidden + + + + + + + + eval save_cfg_trigger="$tok_sv_cfg$" +| search updated="1" +| join domain [|inputlookup AD_Obj_Domain | fields host,domain,Site,DomainNetBIOSName,ForestName | stats values(host) AS host by domain,Site,DomainNetBIOSName,ForestName | eval host=mvjoin(host,",")] +| makemv delim="," host +| mvexpand host +| table domain,host,DomainNetBIOSName,DomainDNSName,ForestName,Site,time,multi_lkps_enabled,kv_suffix,dc_val,user_lookup,group_lookup,computer_lookup +| eval key_val=host +| outputlookup AD_Obj_Domain key_field=key_val +| eval trigger=now() + + + + hidden + + true + + + + + true + hidden + $result.trigger$ + + + + + | inputlookup AD_Obj_Domain WHERE [| makeresults | eval domain="$tok_upd_domains$" | makemv delim="," domain | mvexpand domain] +| eval upd_res_trigger="$tok_pos_upd_trigger$" +| table domain,host,DomainNetBIOSName,DomainDNSName,ForestName,Site,time,multi_lkps_enabled,kv_suffix,dc_val,user_lookup,group_lookup,computer_lookup + + + + + + + + + + + + + +

Gathering Domain Details

+

Please Wait...

+ + + + + +
+
+ + + + + + + + +
+

Overview - Splitting User, Group, and Computer KVstore Lookups into seperate lookups by domain.

+

This should Only be done if you have multiple AD Domains, and a large count of AD Users, Groups or Computers (ie > 200,000).

+
+
+

+ What this configuration dashboard can do for you? +

+
+
Split out the AD_Object_User, AD_Object_Group, and AD_Object_Computer lookups into seperate lookups for each AD Domain.
+
This process can be helpful for Large (>200,000 Objects) environments by reducing the User, Group, and Computer lookups. This is done by creating separate lookups of these three main lookups for each AD Domain, which will reduce the amount stored in them individually.
+
+
+ 		+

+ Step Descriptions +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+ Step 1: Select the Target Domains you would like to create the separate lookups for and adjust settings if needed. +
+
+
+ + +
+
+ Step 2: Create the New KvStore Collections +
+
+ This Provides the collections.conf settings based off of the selected Domain and configuration. +
+
+
+ + +
+
+ Step 3: Create the Lookup Definitions for the created KV Store Collections +
+
+ This Provides the transforms.conf settings based off of the selected Domain and configuration. +
+
+
+ + +
+
+ Step 4: Create New Scheduled Searches +
+
+ Since there will be different lookups, this step will walk you through the steps for adding new scheduled searches to keep the new lookups up to date with the specific domains admon changes, updates. +
+
+
+ + +
+
+ Step 5: Adjust Default Scheduled Searches +
+
+ This section walks through any adjustments to the Default Scheduled Searches. +
+
+
+ + +
+
+ Step 6: Populate the New Lookups +
+
+ This section walks through the steps and searches to populate ad object data. +
+
+ This section also provides ways to clean out the default lookups with data for a now-split domain.. +
+
+
+ + +
+
+ Step 7: Save Configuration +
+
+ This last step is important, because the configurations made in Step 1 are not saved until you click the Save Configuration button in this step. +
+
+
+
+
+
+ + + + + + +

$tok_pre_warn_msg$

+ + + + + + + + + + + + + + +

Enable and Define New Lookup Definitions for Specific Domains

+

Configuration Steps:

+

Below are the steps for Enabling and Defining the Settings required to split out the AD_Obj_User, AD_Obj_Group, and AD_Obj_Computer KV Store lookups into separate lookups for the Domain Enabled.

+
    +
  • Important Note: This below steps do NOT automatically create the KV Store Lookups, and the entered values are not saved until Step 7 they are initial steps to prepare for the creation and for telling this application where to store, and use the AD User, Group, Computer information.
    • +
+
    +
  1. Select an AD Domain to split out the lookups by clicking on the Enable toggle button to set it to Yes
    2. +
  2. Optionally change the Lookup Suffix to a different value (Default: DomainNetBIOSName). +
      +
    • The value entered here will be the added value at the end of the original lookups name, with a preceding "_".
      • +
    +
    3. +
  3. Verify and optionally change the Domain DC Value to a different value. +
      +
    • Important Note: It is critical that this value is correct.
      • +
    • This value is used by MS Windows AD Objects Sync job's to find this specific domain's admon data, so only its data is loaded/updated in it's separate lookups.
      • +
    • Click the Verify button to open a search view to verify the set value.
      • +
    +
    4. +
  4. Repeat the above steps for each AD Domain you would like to split out the 3 lookups for.
    5. +
  5. Proceed to the next section after you are done
    6. +
+ +
+ + Input Definitions: + + + + + + + + + + + + + + + + + + + + + + +
+

Input Definitions:

+
+

Enabled

+ 		+
+
+ This sets that seperate lookup kvstores will be used instead of the default AD_Obj_User, AD_Obj_Group, and AD_Obj_Computer +
+
+ When set to Yes, the listed Lookup Names will be used instead of the default aligned lookups for the specific domain. +
+
+ When set to No, the default lookups AD_Obj_User, AD_Obj_Group, and AD_Obj_Computer will be used. +
+
+
+

Lookup Suffix

+ 		+
+
+ The value entered here will be the added value at the end of the original lookups name, with a preceding "_". +
+
+ The new name will then be used in the next step for creating the KV Store collection and definition. +
+
+
+

Lookup Names

+ 		+
+
+ This column shows the 3 lookups that will contain the specific domains content, and used in the dashboard dropdowns. +
+
+
+

admon Domain Filter:

+ 		+
+
+ The value entered should match the dc_val field. This field consist of the DC.* portion from the objectCategory field in the sourcetype="ActiveDirectory" data. +
+
+ Important Note: The dc_val field is a Calculated Field, where it replaces the values ",DC=" with a ".". Make sure that the format entered matches the dc_value. +
+
+ It is used to filter the admon data for this specific domain, where only that domain's admon data is loaded/updated in the new lookups. +
+
+ Verify: Click the Verify button to open a new search using the set Domain DC Value. Verify that there are results returned, and look through the resulting data to ensure that the dc_val field and the ...DC=.* portion from the objectCategory field are correct for the targeted domain. +
+
+
+
+ 		+
+
+
+ + + + + +
+ + + + +
+ + + + +
+ + + + +
+ + + + + + + +
+ + + + +
+
+

Make Sure all of the Configuration Steps have been completed before Saving

+

Configuration Has Been Saved

+

Warning - AD_Obj_Domain table was not updated with configuration changes.

+ + Updated Domain Details
+ + + + + + + + + + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_change_history__analysis.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_change_history__analysis.xml new file mode 100644 index 00000000..23703cf9 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_change_history__analysis.xml @@ -0,0 +1,185 @@ +
+ + + active + + + `ms_obj_changes_base_all` +| fields _time,src_user,msad_action,src_user,obj_type +| eval src_user=lower(src_user) +| lookup AD_Obj_User lookup_usr AS src_user OUTPUT cn AS Admin +| eval Admin=if(isnull(Admin),src_user,Admin) +| eval Day=strftime(_time,"%m/%d/%y") +| stats count by msad_action, Admin,Day,obj_type +| table Admin,Day, count, msad_action,obj_type + $field1.earliest$ + $field1.latest$ + 1 + +
+ + + + -24h@h + now + + + + + All + User + Group + OU + Group Policy + all + all + + + stats sum(count) AS count by msad_action, Admin,Day + All + + + search obj_type="user" + User + + + search obj_type="group" + Group + + + search obj_type="organizationalunit" + Organizational Unit + + + search obj_type="grouppolicycontainer" + Group Policy + + + +
+ + + +
+

$tok_obj_label$ Object Change History Analysis

+
+ + + + + + + + + + + + + + Count By Day - Pivot On Admin By Change Type + + $tok_obj_type$|eval comb="|".Day." (".count.")" +| sort -count +| stats list(comb) AS Daily_Change_Summary, sum(count) AS Total_Events by Admin,msad_action +| makemv delim="|" Daily_Change_Summary +| sort -Day +| xyseries Admin msad_action Daily_Change_Summary + + + + + + + + + +
+ + + + + + Count By Day - Pivot On Change By Admin + + $tok_obj_type$|eval comb="|".Day." (".count.")" +| sort -count +| stats list(comb) AS Daily_Change_Summary, sum(count) AS Total_Events by Admin,msad_action +| makemv delim="|" Daily_Change_Summary +| sort -Day +| xyseries msad_action Admin Daily_Change_Summary + + + + + + + + + +
+ + + + + + Count By Change Type - Pivot On Day By Admin + + $tok_obj_type$|eval comb="|".msad_action." (".count.")" +| sort -count +| stats list(comb) AS Daily_Change_Summary, sum(count) AS Total_Events by Admin,Day +| makemv delim="|" Daily_Change_Summary +| sort -Day +| xyseries Day Admin Daily_Change_Summary + + + + + + + + + +
+ + + + + + Count By Change Type - Pivot On Day By Admin + + $tok_obj_type$|eval comb="|".Admin." (".count.")" +| sort -count +| stats list(comb) AS Daily_Change_Summary, sum(count) AS Total_Events by msad_action,Day +| makemv delim="|" Daily_Change_Summary +| rename msad_action AS Change_Type +| sort -Day +| xyseries Day Change_Type Daily_Change_Summary + + + + + + + + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_computers_active.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_computers_active.xml new file mode 100644 index 00000000..069c6a5e --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_computers_active.xml @@ -0,0 +1,82 @@ +
+ + stats count by sAMAccountName,cn +
+ + + + All + + |inputlookup AD_Obj_Domain | stats count by domain | table domain | sort domain + + domain + domain + all + all + + + + + + dest_nt_domain="$value$" + + + + + + All + + | inputlookup AD_Obj_Computer |$tok_filt_comp$ | table sAMAccountName,cn | sort sAMAccountName + + + + user_type="computer" + + + user_type="computer" user="$value$" + + + cn + sAMAccountName + all + all + + + + + + + + stats count by sAMAccountName,cn + + + WHERE match(cn,"$value$")|stats count by sAMAccountName,cn + + + + + + + -60m@m + now + + +
+ + + + Active Computer Accounts + + eventtype=ms_ad_obj_msad-successful-computer-logons $tok_domain_srch$ $tok_sel_comp_search$ | fields _time, dest_nt_domain, user|stats max(_time) as lastLogonTime by dest_nt_domain,user |rex field=user "^(?<cn>[^\$]+)" |join cn [|inputlookup AD_Obj_Computer | makemv delim=":" uac_details| table cn,dNSHostName,uac_details,operatingSystem,operatingSystemServicePack] |eval lastLogonTime=strftime(lastLogonTime,"%c") |table cn,dNSHostName,uac_details,operatingSystem,operatingSystemServicePack,lastLogonTime|rename cn as Computer,operatingSystem as "Operating System",operatingSystemServicePack as "Service Pack",lastLogonTime as "Last Logon Time" + $field1.earliest$ + $field1.latest$ + + + + + + +
+ + +
\ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_conf_analysis.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_conf_analysis.xml new file mode 100644 index 00000000..f4434ee9 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_conf_analysis.xml @@ -0,0 +1,220 @@ + + + + | rest services/apps/local + + + | rest services/saved/searches + + + | rest services/data/lookup-table-files + + + | rest /servicesNS/-/-/admin/macros + + + | rest services/saved/eventtypes + + + | rest servicesNS/admin/-/data/models + + + + + + stats count + + + + + + + + + + + + + + + + + + + + + stats count + + + + + + + + + + + + + + + + + + + + + stats count + + + + + + + + + + + + + + + + + + + + + stats count + + + + + + + + + + + + + + + + + + + + + stats count + + + + + + + + + + + + + + + + + + + + + stats count + + + + + + + + + + + + + + + + + + + + + + Apps + + table title disabled eai:acl.perms.read eai:acl.perms.write eai:acl.sharing | rename title as Title disabled AS Disabled eai:acl.perms.read AS Read eai:acl.perms.write AS Write eai:acl.sharing AS Sharing + +
+ + + + + + Saved Searches + + table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule next_scheduled_time dispatch.earliest_time eai:acl.perms.read eai:acl.perms.write eai:acl.sharing | rename title as Title eai:acl.app AS App eai:acl.owner AS Owner disabled AS Disabled is_scheduled AS Scheduled cron_schedule AS "Cron Schedule" next_scheduled_time AS "Next Scheduled Time" dispatch.earliest_time AS "Dispatch Earliest Time" eai:acl.perms.read AS Read eai:acl.perms.write AS Write eai:acl.sharing AS Sharing search AS Search tags AS Tags + + +
+ + + + + + Lookups + + table title eai:acl.app eai:acl.owner disabled updated eai:acl.perms.read eai:acl.perms.write eai:acl.sharing | rename title as Title eai:acl.app AS App eai:acl.owner AS Owner disabled AS Disabled updated AS "Last Updated" eai:acl.perms.read AS Read eai:acl.perms.write AS Write eai:acl.sharing AS Sharing + + + + + + +
+ + + + + + Macros + + table title eai:acl.app eai:acl.owner disabled definition eai:acl.perms.read eai:acl.perms.write eai:acl.sharing | rename title as Title eai:acl.app AS App eai:acl.owner AS Owner disabled AS Disabled definition AS Definition eai:acl.perms.read AS Read eai:acl.perms.write AS Write eai:acl.sharing AS Sharing + +
+ + + + + + Eventtypes + + table title eai:acl.app eai:al.owner disabled search tags eai:acl.perms.read eai:acl.perms.write eai:acl.sharing | rename title as Title eai:acl.app AS App eai:acl.owner AS Owner disabled AS Disabled search AS Search tags AS Tags eai:acl.perms.read AS Read eai:acl.perms.write AS Write eai:acl.sharing AS Sharing + + + + + + +
+ + + + + + Data Models + + table title eai:acl.app eai:acl.owner disabled acceleration eai:acl.perms.read eai:acl.perms.write eai:acl.sharing | replace 1 with "Enabled" 0 with "Disabled" in acceleration | rename title as Title eai:acl.app AS App eai:acl.owner AS Owner disabled AS Disabled acceleration AS Acceleration eai:acl.perms.read AS Read eai:acl.perms.write AS Write eai:acl.sharing AS Sharing + +
+ + + \ No newline at end of file diff --git a/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_file_acl_analysis.xml b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_file_acl_analysis.xml new file mode 100644 index 00000000..b50033a2 --- /dev/null +++ b/deployment-apps/ms_windows_ad_objects/default/data/ui/views/ms_ad_obj_file_acl_analysis.xml @@ -0,0 +1,832 @@ +
+ + + active + + + `ms_obj_win_dir_acl` +| rex max_match=0 "(?:\[)(?<object_acls>[^\]]+)" +| mvexpand object_acls +| rex max_match=0 field=object_acls "(?:\"IdentityReference\"\:\")(?<IdentityReference>[^\"]+)\"\,\"FileSystemRights\"\:\"(?<FileSystemRights>[^\"]+)\"\,\"AccessControlType\"\:\"(?<AccessControlType>[^\"]+)\"\,\"IsInherited\"\:\"(?<IsInherited>[^\"]+)\"\,\"InheritanceFlags\"\:\"(?<InheritanceFlags>[^\"]+)\"\,\"PropagationFlags\"\:\"(?<PropagationFlags>[^\"]+)\"" +| fields host,object_path,object_last_mod_time,object_size,object_dir_cnt,object_file_cnt,IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags,PropagationFlags +| eventstats values(FileSystemRights) AS FileSystemRights by object_path,IdentityReference,IsInherited +| eval FileSystemRights="[".IsInherited."] (".mvjoin(FileSystemRights,",").")" +| rex field=IdentityReference "((?<object_domain>[^\x5C{1}]+)\x5C{1}|^)(?<object_id>.*)" +| makemv delim="," InheritanceFlags +| fillnull value="NA" object_path,object_last_mod_time,object_size,object_dir_cnt,object_file_cnt,IdentityReference,AccessControlType,PropagationFlags,object_domain +| stats values(FileSystemRights) AS "(IsInherited) FileSystemRights",values(InheritanceFlags) AS InheritanceFlags,count by host,object_path,object_last_mod_time,object_size,object_dir_cnt,object_file_cnt,IdentityReference,AccessControlType,PropagationFlags,object_domain,object_id +| eval InheritanceFlags=mvjoin(InheritanceFlags,", ") +| eval object_id=trim(object_id),object_domain=trim(object_domain) +| lookup AD_Obj_User domain AS object_domain,sAMAccountName AS object_id OUTPUT cn AS object_u_cn,dn_path AS object_u_dn_path,dn AS object_u_dn,objectClass AS object_u_class +| lookup AD_Obj_User domain AS object_domain,cn AS object_id OUTPUT cn AS object_u_c_cn,dn_path AS object_u_c_dn_path,dn AS object_u_c_dn,objectClass AS object_u_c_class +| eval object_cn=if(isnull(object_u_cn),if(isnull(object_u_c_cn),"NA",object_u_c_cn),object_u_cn),object_dn_path=if(isnull(object_u_dn_path),if(isnull(object_u_c_dn_path),"NA",object_u_c_dn_path),object_u_dn_path),object_dn=if(isnull(object_u_dn),if(isnull(object_u_c_dn),"NA",object_u_c_dn),object_u_dn),object_class=if(isnull(object_u_class),if(isnull(object_u_c_class),"NA",object_u_c_class),object_u_class) +| lookup AD_Obj_Group domain AS object_domain,sAMAccountName AS object_id OUTPUT cn AS object_g_cn,dn_path AS object_g_dn_path,dn AS object_g_dn,objectClass AS object_g_class +| eval object_cn=if(object_cn=="NA",if(isnull(object_g_cn),"NA",object_g_cn),object_cn),object_dn_path=if(object_dn_path=="NA",if(isnull(object_g_dn_path),"NA",object_g_dn_path),object_dn_path),object_dn=if(object_dn=="NA",if(isnull(object_g_dn),"NA",object_g_dn),object_dn),object_class=if(object_class=="NA",if(isnull(object_g_class),"NA",object_g_class),object_class) +| eval object_class=if(object_domain="NT AUTHORITY" OR object_domain=="BUILTIN","Local System",object_class),object_dn=if(object_domain="NT AUTHORITY" OR object_domain=="BUILTIN","Local",object_dn),object_dn_path=if(object_domain="NT AUTHORITY" OR object_domain=="BUILTIN","Local",object_dn_path),object_cn=if(object_domain="NT AUTHORITY" OR object_domain=="BUILTIN",object_id,object_cn) +| fillnull value="NA" object_size,object_dir_cnt,object_file_cnt,IdentityReference,AccessControlType,PropagationFlags,object_domain,object_dn_path,object_cn,object_class +| table host,object_domain,object_id,object_class,object_dn,object_dn_path,object_cn,object_path,object_last_mod_time,object_size,object_dir_cnt,object_file_cnt,IdentityReference,FileSystemRights,AccessControlType,InheritanceFlags,PropagationFlags + $field1.earliest$ + $field1.latest$ + 1 + + + + `ms_obj_win_events_security` Object_Server="Security" ("File" OR "Removable Storage") $tok_object_path_dd$ +| fields _time,_raw,history,Object_Name,EventCode,RecordNumber,eventtimes,Account_Name,src_user,Object_Path,Access_Reasons,Granted_Permissions,src_user,Accesses +| eval Object_Path=Object_Name +| eval temp=_time +| convert timeformat="%m-%d-%Y %H:%M:%S" ctime(temp) AS eventtimes +| eval history=eventtimes."(User: ".Account_Name." Type:".Accesses.")" +| rex max_match=0 "(?msi)(?:Access\sReasons\:)(?<Access_Reasons>.*)(?:Access Mask\:)" +| rex field=Access_Reasons max_match=0 "(^|\r|\n)(?<Granted_Permissions>[^\:]+)\:\s+Granted\sby" +| eval Granted_Permissions=if(isnull(Granted_Permissions),Accesses,Granted_Permissions) +| table _time,_raw,history,Object_Name,EventCode,RecordNumber,eventtimes,Account_Name,src_user,Object_Path,temp,Access_Reasons,Granted_Permissions,src_user + + $field1.earliest$ + $field1.latest$ + +
+ + + + -24h@h + now + + + + + All + host + host + all + all + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ +| stats count by host + + + + + + + host="$value$" + + + + + + + + + + + + + | WHERE match(object_path,"(?msi)$value$") + $value$ + + + + + + All + object_path_label + object_path + all + all + + search $tok_object_id$ $tok_domain$ $tok_host$ $tok_dn_path$ +| stats count by object_path +| eval object_path_label=object_path +| rex mode=sed field=object_path "s/\\\/\\\\\\\/g" +$tok_obj_path_filt$ + + + + + + start + + + object_path="$value$" + Object_Name="$value$" + $label$ + + + + + + AD User + AD Group + Local System + group + group + + + top|person|organizationalPerson|user + True + True + + + + top|group + True + True + + + + Local System + True + True + + + + + + + + All + object_domain + object_domain + all + all + + search $tok_object_id$ $tok_object_path$ $tok_dn_path$ +| stats count by object_domain + + + + + + + object_domain="$value$" + + + + + + All + object_dn_path + object_dn_path + all + all + + search object_class="$tok_object_class$" $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_domain$ +| stats count by object_dn_path + + + + + + + object_dn_path="$value$" + + + + + + All + object_cn + object_id + all + all + + search object_class="$tok_object_class$" $tok_domain$ $tok_object_path$ $tok_domain$ $tok_dn_path$ +| eval object_domain=if(isnull(object_domain),"",object_domain."\x5C{1}".object_id) +| eval object_cn=if(isnull(object_cn),object_domain."".object_id,object_cn) +| stats count by object_id,object_cn + + + + + + + object_id="$value$" + + + + + + All + object_cn + object_id + all + all + + search object_class="top|group" $tok_domain$ $tok_object_path$ $tok_domain$ $tok_dn_path$ +| eval object_domain=if(isnull(object_domain),"",object_domain."\x5C{1}".object_id) +| eval object_cn=if(isnull(object_cn),object_domain."".object_id,object_cn) +| stats count by object_id,object_cn + + + + + + + object_id="$value$" + + + +
+ + + + + + + + + + + Total Size by Authorization (MB) + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ +| stats max(object_size) AS Total_Size by object_path,object_id +| sort -Total_Size +| stats sum(Total_Size) AS Total_Size by object_id +| sort -Total_Size +| eval Total_Size=round(Total_Size/1024,2) + + + + + + + Total Directories by Authorization + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ +| stats dc(object_path) AS Total_Directories by object_id +| sort -Total_Directories + + + + + + + + + + + Authorization Summary + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ +| stats sum(object_size) AS Total_Size by object_id,object_cn,object_dn +| sort -Total_Size + + + + + + + + + +
+ + + + + ACL Details + + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ + + + + + + + + + +
+ + + + + + Top 10 Object Paths by Authorization ID Count + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ +| stats dc(object_id) AS Authorization_IDs by object_path +| sort -Authorization_IDs +| head 10 + + + + + + + + + Top 10 Directories by Size (MB) + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ +| stats max(object_size) AS Total_Size, max(object_dir_cnt) AS Total_Directories,max(object_file_cnt) AS Total_Files by object_path +| sort -Total_Size +| head 10 +| eval Total_Size=round(Total_Size/1024,2) + + + + + + + + + + + +
+ + + + + + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ +| stats values(object_path) As Directory by object_id +| eval Directory_Count=mvcount(Directory) +| rename object_id AS Authorization_IDs +| sort -Directory_Count + + + + + + + + + +
+ + + search $tok_object_id$ $tok_domain$ $tok_object_path$ $tok_dn_path$ $tok_host$ +| stats max(object_size) AS Directory_Size, max(object_file_cnt) AS Total_Files by object_path +| sort -Directory_Size + + + + + + + + + +
+ + + + + File Audit Events - Select Object Path for viewing File Audit Windows Events + + + + + + + + + + | WHERE match(object_path,"(?msi)$value$") + + + + + + Select Object Path + object_path_label + object_path + start + start + + search $tok_object_id$ $tok_domain$ $tok_host$ $tok_dn_path$ +| stats count by object_path +| eval object_path_label=object_path +| rex mode=sed field=object_path "s/\\\/\\\\\\\/g" +$tok_obj_path_dd_filt$ + + + + + True + + + Object_Name="$value$" + + + + + + + View Counts + View Details + View Raw + counts + counts + + + True + True + True + + + True + True + True + + + True + True + True + + + + + +

Select an Object Path in the panel to the left in order to see if any File Auditing Windows Events are available for the specific directory path.

+ + + + Count Over Time by src_user and Change Types + + fields _time, Object_Path +| timechart count by Object_Path + + + + + + + Counts by src_user and Change Types + + stats count,values(src_user) AS src_user,max(_time) AS Last_Time,values(Granted_Permissions) AS Granted_Permissions by Object_Name +| eval Granted_Permissions=replace(mvjoin(Granted_Permissions,","),"\s\s+","") +| eval Last_Time=strftime(Last_Time,"%m/%d/%y %I:%M:%S %P") + + + +
+ + + Detailed Summary of File or Directory Changes + + + stats values(history) as Change_History, values(EventCode) as Win_Event_IDs, values(RecordNumber) as Win_Event_Record, min(eventtimes) as First_Change_Time, values(Account_Name) as Change_Admin by Object_Path +| dedup Object_Path +| eval Win_Event_Record=mvjoin(Win_Event_Record,", ") +| eval Win_Event_IDs=mvjoin(Win_Event_IDs,", ") +| eval Change_Type=mvjoin(Change_Type,", ") +| table First_Change_Time, Object_Path, Change_Admin, Win_Event_IDs, Win_Event_Record, Change_History, +| sort First_Change_Time + + +
+ + + File Auditing Raw Events + + + fields _raw,_time + + + + + + + + +
+
+
+

+ Collecting Directory ACL Details - Powershell Script +

+
+
+