Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Announcement: Try the Ask AI chatbot for answers to your technical questions about Juniper products and solutions.

close
external-header-nav
Documentation
Menu
License Guide
Quick Starts
Validated Designs
Home Documentation JSA Series Virtual Appliance Juniper Secure Analytics Configuring DSMs Guide Novell EDirectory

Juniper Secure Analytics Configuring DSMs Guide

keyboard_arrow_up
close
keyboard_arrow_left
Juniper Secure Analytics Configuring DSMs Guide
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Novell eDirectory Sample Event Message

date_range 14-Jul-21
arrow_backward
arrow_forward

Use this sample event message to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

Novell eDirectory sample message when you use the Syslog protocol

The following sample event message shows that an account security token modification failed.

content_copy zoom_out_map
eDirectory: INFO {"Source" : "eDirectory#DS","Observer" : {"Account" : {"Domain" : "DOMAINEXAMPLE-
TEST","Name" : "CN=ws,OU=SRV,O=COMPANY"},"Entity" : {"SysAddr" :
"172.16.20.1","SysName" : "ws.domain.example.test"}},"Initiator" : {"Account" : {"Domain" :
"DOMAIN-EXAMPLE-TEST","Name" : "CN=ws,OU=SRV,O=COMPANY"},"Entity" : {"SysAddr" :
"172.16.20.1"}},"Target" : {"Data" : {"ClassName" : "User","Version" : "2"},"Account" :
{"Domain" : "DOMAIN-EXAMPLE-TEST","Name" : "CN=TEST,OU=usr,O=ORG","Id" : "11111111"}},"Action" :
{"Event" : {"Id" : 0.0.0.6","Name" : "MODIFY_ACCOUNT_SECURITY_TOKEN","CorrelationID" :
"eDirectory#0#","SubEvent" : "DSE_CHGPASS"},"Time" : {"Offset" : 1567083869},"Log" :
{"Severity" : 7},"Outcome" : "1.10","ExtendedOutcome" : "-215"}}
Table 1: Highlighted Values in the Novell eDirectory Sample Event

JSA field name

Highlighted values in the event payload

Event ID

MODIFY_ACCOUNT_SECURITY_TOKEN - FAILED is extracted from the Event.Name and Outcome fields in Action object.

If Outcome = 0, then eventID = Event.Name.

Otherwise, eventID = Event.Name + "-FAILED", as shown in this sample event.

Device Category

eDirectory

Username

TEST

Source IP

172.16.20.1

Device Time

1567083869 (which is Aug 29, 2019, 10:04:29 AM)

Chapter

arrow_backward PREVIOUS Configuring a Log Source
NEXT arrow_forward Observe IT JDBC
external-footer-nav