We have an Exchange 2003 server that is sending its logs to CS-MARS. We need to parse these logs to detect unauthorized user mailbox access. It?s easy to build this regular expression. But there are some exceptions like some users can do a logon in their boss primary account. I mean:
CEO mailbox is: domain1\ceo_mailbox
CEO user id: domain1\ceo_user
CEO?s personal assistant: domain1\assistant_user
The personal assistant is able to logon CEO mailbox and this kind of access is not an incident. Other user access to this mailbox will fire an incident.
To do that, we need to keep the user id that is trying to login into a mailbox and the owner id of this mailbox. Then, with a custom rule, we need to compare these two string fields and depend on the result, a new incident will be generated or not.
When I?m parsing the message, I try to keep these IDs (user and mailbox owner) in any CS-MARS string field (source/destination IP in hostname format, port in string format, protocol in string format, etc.) Here is the problem: CS-MARS store this information in a non string format. In the following images you could see CS-MARS is trying to store the matched string ?translating? the format to a numeric, IP dotted quad, etc.
a)Using the port field as the parsed field: see attached file custom_parser_port.jpg
The matched string (OSansano) is translated to 0. This is due to MARS stores the value in numeric format.
b)Using the protocol field as the parsed field: see attached file custom_parser_protocol.jpg
In this case, MARS try to translate the matched string in the protocol numeric value. For example, If I change the OSansano string for TCP string, the Parsed Value will be the number 6. When CS-MARS doesn?t know the ?protocol? the value will be -1.
c)Using the IP address (source or destination) as the parsed field: see attached file custom_parser_hostname.jpg
In this case, CS-MARS try to do a reverse dns resolution to store the IP and not the matched string.
What we could do to store the Matched String in one of the Parsed Fields in string format? Or, is it possible to create new Parsed Fields?
Any suggestion to this issue will be appreciated?
Antoni Gutierrez Barbara
Dimension Data Spain