You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
166 lines
7.4 KiB
166 lines
7.4 KiB
<form version="1.1">
|
|
<label>ldapsearch</label>
|
|
<description></description>
|
|
<row>
|
|
<panel>
|
|
<html>
|
|
<div style="max-width: 860px;">
|
|
<h1>The ldapsearch command</h1>
|
|
<p>
|
|
The ldapsearch command opens a connection to an LDAP server. It then performs a search using the specified
|
|
options and generates one event per result entry. The ldapsearch command must appear at the beginning of
|
|
a search pipeline.
|
|
</p>
|
|
<h3>Example</h3>
|
|
<p style="margin-left: 6px;">
|
|
Get all attributes for all users in the default domain.
|
|
</p>
|
|
<pre style="margin-left: 6px;">
|
|
| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="distinguishedName,objectCategory"
|
|
</pre>
|
|
<h2>Options</h2>
|
|
<!-- search -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>search=</b><i><search-filter></i></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
An LDAP search filter. The filter must conform to the string representation for search filters as defined in
|
|
<a href="http://tools.ietf.org/html/rfc2254">RFC 2254</a>.
|
|
</p>
|
|
<!-- attrs -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>attrs=</b><i><attribute-names></i></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
A comma-separated list of attribute names. If you specify '*' or do not specify any attributes, the command returns
|
|
all user attributes. If you specify '+', it returns all operational attributes.
|
|
</p>
|
|
<!-- domain -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>domain=</b><i><domain-specifier></i></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
Specifies the name of a configuration stanza in ldap.conf. If you do not specify a domain, the command uses the
|
|
default stanza.
|
|
</p>
|
|
<!-- basedn -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>basedn=</b><i><search-base></i></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
Specifies a search base as the starting point instead of the default as set in the ldap configuration stanza
|
|
identified by <b>domain</b>.
|
|
</p>
|
|
<!-- scope -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>scope=</b><b>base</b>|<b>one</b>|<b><u>sub</u></b></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
Specifies the scope of the search to be one of <b>base</b>, <b>one</b>, or <b>sub</b>. The default is <b>sub</b>.
|
|
</p>
|
|
<!-- limit -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>limit=</b><i><size-limit></i></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
Specifies the maximum number of entries that the command should retrieve. A value of 0 (zero) means there is no
|
|
limit. A server can impose a maximum size limit. The default is zero.
|
|
</p>
|
|
<!-- debug -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>debug=</b><i><bool></i></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
If set to true, debug logging is in effect. This is a short-hand for <b>logging_level=DEBUG</b>.
|
|
</p>
|
|
<!-- decode -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>decode=</b><i><bool></i></p>
|
|
<p style="margin-left: 45px; margin-top: 2px;">
|
|
If set to true, Active Directory formatting rules are applied to attributes. The default is the value of decode as
|
|
specified in the configuration stanza for domain.
|
|
</p>
|
|
<!-- logging_level -->
|
|
<p style="margin-bottom: 0; margin-left: 6px;"><b>logging_level=</b><b>critical</b>|<b>error</b>|<b>warning</b>|<b>info</b>|<b>debug</b></p>
|
|
<p style="margin-bottom: 2px; margin-left: 45px; margin-top: 2px;">
|
|
Specifies the logging level for the $SPLUNK_HOME/var/log/splunk/SA-ldapsearch.log file. Splunk can access this file
|
|
with the "index=_internal sourcetype=SA-ldapsearch" search and exposes the following fields:
|
|
<table cellpadding="2" style="margin-left: 43px; margin-top: 2px">
|
|
<tr>
|
|
<td><b>File</b></td>
|
|
<td>Full pathname of the source file where the logging call was made.</td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Level</b></td>
|
|
<td>
|
|
Level of the logging call that was made; one of <b>CRITICAL</b>, <b>ERROR</b>, <b>WARNING</b>,
|
|
<b>INFO</b>, or <b>DEBUG</b>.
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Line</b></td>
|
|
<td>Line number in the source file where the logging call was made.</td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Pid</b></td>
|
|
<td>ID of the process that made the logging call.</td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>log_source</b></td>
|
|
<td>
|
|
String of the form "<b>Pid=</b><i><Pid></i><b>, File=</b><i><File></i><b>,
|
|
Line=</b><i><Line></i>".
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>message</b></td>
|
|
<td>Full text of the logged message.</td>
|
|
</tr>
|
|
</table>
|
|
</p>
|
|
<h2>Output Format</h2>
|
|
<p style="margin-left: 6px;">
|
|
The command returns each event as the Java Standard Object Notation (JSON) representation of the record. It also
|
|
returns a number of attributes as field values. When the command returns attributes as values, it decodes those
|
|
values on the fly and presents globally unique IDs (GUID), security IDs (SID), or security descriptor in
|
|
human-readable form.
|
|
</p>
|
|
<h2>Examples</h2>
|
|
<p style="margin-left: 6px;">To get a table suitable for pushing into the identities.csv file for Enterprise Security:</p>
|
|
<pre style="margin-left: 6px;">
|
|
| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))"
|
|
| search userAccountControl="NORMAL_ACCOUNT"
|
|
| eval suffix=""
|
|
| eval priority="medium"
|
|
| eval category="normal"
|
|
| eval watchlist="false"
|
|
| eval endDate=""
|
|
| table sAMAccountName, personalTitle, displayName, givenName, sn, suffix, mail, telephoneNumber,
|
|
mobile, manager, priority, department, category, watchlist, whenCreated, endDate
|
|
| rename sAMAccountName as identity, personalTitle as prefix, displayName as nick,
|
|
givenName as first, sn as last, mail as email, telephoneNumber as phone,
|
|
mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate
|
|
</pre>
|
|
<p style="margin-left: 6px;">
|
|
If you have multiple domains, join multiple 'ldapsearch' commands with the 'append' command. For instance:
|
|
</p>
|
|
<pre style="margin-left: 6px;">
|
|
| ldapsearch domain=SPL search="(&(objectClass=user)(!(objectClass=computer)))"
|
|
| search userAccountControl="NORMAL_ACCOUNT"
|
|
| eval suffix=""
|
|
| eval priority="medium"
|
|
| eval category="normal"
|
|
| eval watchlist="false"
|
|
| eval endDate=""
|
|
| eval identity = "SPL\\" + sAMAccountName
|
|
| table identity, personalTitle, displayName, givenName, sn, suffix, mail, telephoneNumber,
|
|
mobile, manager, priority, department, category, watchlist, whenCreated, endDate
|
|
| rename personalTitle as prefix, displayName as nick, givenName as first, sn as last,
|
|
mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy,
|
|
department as bunit, whenCreated as startDate
|
|
| append [
|
|
ldapsearch domain=ENG search="(&(objectClass=user)(!(objectClass=computer)))"
|
|
| search userAccountControl="NORMAL_ACCOUNT"
|
|
| eval suffix=""
|
|
| eval priority="medium"
|
|
| eval category="normal"
|
|
| eval watchlist="false"
|
|
| eval endDate=""
|
|
| eval identity = "ENG\\" + sAMAccountName
|
|
| table identity, personalTitle, displayName, givenName, sn, suffix, mail, telephoneNumber,
|
|
mobile, manager, priority, department, category, watchlist, whenCreated, endDate
|
|
| rename personalTitle as prefix, displayName as nick, givenName as first, sn as last,
|
|
mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy,
|
|
department as bunit, whenCreated as startDate]
|
|
</pre>
|
|
</div>
|
|
</html>
|
|
</panel>
|
|
</row>
|
|
</form>
|